Edit tour

Windows Analysis Report
bv2DbIiZeK.exe

Overview

General Information

Sample name:	bv2DbIiZeK.exe renamed because original name is a hash value
Original sample name:	f33a0556ba844ec2745fceff565bdacaf0b26412b940dbf19b4ca97013057842.exe
Analysis ID:	1556368
MD5:	5526f8b855b92a67fbdfa72a46efbe28
SHA1:	593100b5694703f31613adbc6f8ccecfc1950a45
SHA256:	f33a0556ba844ec2745fceff565bdacaf0b26412b940dbf19b4ca97013057842
Tags:	45-130-145-152exeuser-JAMESWT_MHT
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

bv2DbIiZeK.exe (PID: 592 cmdline: "C:\Users\user\Desktop\bv2DbIiZeK.exe" MD5: 5526F8B855B92A67FBDFA72A46EFBE28)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "anti_vm": false, "anti_dbg": false, "port": 15666, "build_name": "Seo", "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 4194304}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: bv2DbIiZeK.exe PID: 592	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: bv2DbIiZeK.exe PID: 592	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.bv2DbIiZeK.exe.1ef42620000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.bv2DbIiZeK.exe.1ef42620000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:47.646469+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49709	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:47.646469+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.651707+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49709	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T10:28:47.646469+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.651707+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49709	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.bv2DbIiZeK.exe.1ef42620000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "anti_vm": false, "anti_dbg": false, "port": 15666, "build_name": "Seo", "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 4194304}

Multi AV Scanner detection for submitted file

Source: bv2DbIiZeK.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426916A0 CryptUnprotectData,LocalFree,	0_2_000001EF426916A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42657C80 CryptUnprotectData,LocalFree,	0_2_000001EF42657C80
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F8060 CryptUnprotectData,CompareStringEx,ExitProcess,	0_2_000001EF426F8060

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: bv2DbIiZeK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DBA38 FindClose,FindFirstFileExW,GetLastError,	0_2_000001EF426DBA38
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DBAE8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_000001EF426DBAE8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F80C8 FindFirstFileW,ExitProcess,	0_2_000001EF426F80C8

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426AA4B0 GetLogicalDriveStringsW,

0_2_000001EF426AA4B0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49709 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49709 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.6:49709 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49709 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426A7BC0 recv,recv,closesocket,WSACleanup,

0_2_000001EF426A7BC0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: bv2DbIiZeK.exe, 00000000.00000003.2255833247.000001EF431A0000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2255979771.000001EF431A4000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2255867429.000001EF431A0000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2162129451.000001EF43191000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: bv2DbIiZeK.exe, 00000000.00000002.2258031248.000001EF42240000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256533387.000001EF4223F000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256470694.000001EF4223D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: bv2DbIiZeK.exe, 00000000.00000003.2163157026.000001EF4229D000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000002.2258031248.000001EF42240000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256533387.000001EF4223F000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256470694.000001EF4223D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF409AA000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42DF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: bv2DbIiZeK.exe, 00000000.00000003.2172984663.000001EF438FF000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42DFC000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2169911837.000001EF42314000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42539000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2171500000.000001EF42590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42DF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org#
Source: bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426A8CC0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,GetObjectW,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,DeleteObject,EnterCriticalSection,EnterCriticalSection,GdiplusShutdown,LeaveCriticalSection,LeaveCriticalSection,

0_2_000001EF426A8CC0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426AD700 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_000001EF426AD700
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F86D8 NtQueryObject,CoInitializeEx,	0_2_000001EF426F86D8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F86B8 NtAllocateVirtualMemory,LdrEnumerateLoadedModules,	0_2_000001EF426F86B8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F86B0 RtlInitUnicodeString,NtAllocateVirtualMemory,CoInitializeEx,	0_2_000001EF426F86B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F86A8 NtQuerySystemInformation,	0_2_000001EF426F86A8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426ACFC0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtDuplicateObject,GetCurrentProcess,NtDuplicateObject,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_000001EF426ACFC0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABA2C60 NtQueryVirtualMemory,NtProtectVirtualMemory,	0_2_00007FF64ABA2C60

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C96B8	0_2_000001EF426C96B8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426AA760	0_2_000001EF426AA760
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426B0440	0_2_000001EF426B0440
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426AB410	0_2_000001EF426AB410
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4267E4E0	0_2_000001EF4267E4E0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265D510	0_2_000001EF4265D510
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4267B5BD	0_2_000001EF4267B5BD
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265E5A0	0_2_000001EF4265E5A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42681A80	0_2_000001EF42681A80
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426AFA58	0_2_000001EF426AFA58
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426B1B00	0_2_000001EF426B1B00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DBAE8	0_2_000001EF426DBAE8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42650BD0	0_2_000001EF42650BD0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A7BC0	0_2_000001EF426A7BC0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A18D0	0_2_000001EF426A18D0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A9960	0_2_000001EF426A9960
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265C9C0	0_2_000001EF4265C9C0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C5EB4	0_2_000001EF426C5EB4
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265EC50	0_2_000001EF4265EC50
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A8CC0	0_2_000001EF426A8CC0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A2D10	0_2_000001EF426A2D10
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426512C0	0_2_000001EF426512C0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A8400	0_2_000001EF426A8400
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426640B0	0_2_000001EF426640B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426971A0	0_2_000001EF426971A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42693670	0_2_000001EF42693670
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C765C	0_2_000001EF426C765C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42690616	0_2_000001EF42690616
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426AD700	0_2_000001EF426AD700
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42646770	0_2_000001EF42646770
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42649760	0_2_000001EF42649760
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42696720	0_2_000001EF42696720
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426477B0	0_2_000001EF426477B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BB7B0	0_2_000001EF426BB7B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BD474	0_2_000001EF426BD474
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42626480	0_2_000001EF42626480
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4266E419	0_2_000001EF4266E419
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DE500	0_2_000001EF426DE500
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4266C4E0	0_2_000001EF4266C4E0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C14C4	0_2_000001EF426C14C4
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426E3570	0_2_000001EF426E3570
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42689600	0_2_000001EF42689600
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C85DC	0_2_000001EF426C85DC
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268D590	0_2_000001EF4268D590
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426ADA50	0_2_000001EF426ADA50
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42659A59	0_2_000001EF42659A59
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BDABC	0_2_000001EF426BDABC
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C6B2C	0_2_000001EF426C6B2C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268DBD0	0_2_000001EF4268DBD0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4266CB90	0_2_000001EF4266CB90
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426D0824	0_2_000001EF426D0824
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268F820	0_2_000001EF4268F820
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426518F0	0_2_000001EF426518F0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42626900	0_2_000001EF42626900
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268D8B0	0_2_000001EF4268D8B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426948A0	0_2_000001EF426948A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42698980	0_2_000001EF42698980
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DE980	0_2_000001EF426DE980
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4267B5BD	0_2_000001EF4267B5BD
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C9934	0_2_000001EF426C9934
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268FE50	0_2_000001EF4268FE50
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BDE4C	0_2_000001EF426BDE4C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4267AF00	0_2_000001EF4267AF00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268DF00	0_2_000001EF4268DF00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42657ED0	0_2_000001EF42657ED0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265BEE0	0_2_000001EF4265BEE0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C9EBC	0_2_000001EF426C9EBC
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42676F70	0_2_000001EF42676F70
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A3F80	0_2_000001EF426A3F80
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CF60	0_2_000001EF4268CF60
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C6FDC	0_2_000001EF426C6FDC
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4269EFD0	0_2_000001EF4269EFD0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42697C20	0_2_000001EF42697C20
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A0CA0	0_2_000001EF426A0CA0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426C7D88	0_2_000001EF426C7D88
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4267FD8E	0_2_000001EF4267FD8E
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42651D4E	0_2_000001EF42651D4E
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4266FDF9	0_2_000001EF4266FDF9
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4265AE00	0_2_000001EF4265AE00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BD28C	0_2_000001EF426BD28C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268D260	0_2_000001EF4268D260
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42685220	0_2_000001EF42685220
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4269F370	0_2_000001EF4269F370
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BE354	0_2_000001EF426BE354
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42696080	0_2_000001EF42696080
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42627010	0_2_000001EF42627010
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A2100	0_2_000001EF426A2100
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426260C0	0_2_000001EF426260C0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426BD0A4	0_2_000001EF426BD0A4
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF42690180	0_2_000001EF42690180
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A6133	0_2_000001EF426A6133
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426A6123	0_2_000001EF426A6123
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABDAB90	0_2_00007FF64ABDAB90
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABB03F0	0_2_00007FF64ABB03F0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBCC28	0_2_00007FF64ABBCC28
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABA5BF0	0_2_00007FF64ABA5BF0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABFBB88	0_2_00007FF64ABFBB88
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64AC05C4C	0_2_00007FF64AC05C4C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF9C74	0_2_00007FF64ABF9C74
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABD39B0	0_2_00007FF64ABD39B0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC5896	0_2_00007FF64ABC5896
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABCE960	0_2_00007FF64ABCE960
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC2B10	0_2_00007FF64ABC2B10
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC4A80	0_2_00007FF64ABC4A80
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABD7A80	0_2_00007FF64ABD7A80
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64AC1BFF0	0_2_00007FF64AC1BFF0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABFA108	0_2_00007FF64ABFA108
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABD8E00	0_2_00007FF64ABD8E00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64AC02E10	0_2_00007FF64AC02E10
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABB3E20	0_2_00007FF64ABB3E20
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBBF00	0_2_00007FF64ABBBF00
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABADED0	0_2_00007FF64ABADED0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF2EE8	0_2_00007FF64ABF2EE8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC6E90	0_2_00007FF64ABC6E90
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF242C	0_2_00007FF64ABF242C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF7354	0_2_00007FF64ABF7354
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC7360	0_2_00007FF64ABC7360
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABB4510	0_2_00007FF64ABB4510
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBD4D7	0_2_00007FF64ABBD4D7
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABAE450	0_2_00007FF64ABAE450
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBC1E0	0_2_00007FF64ABBC1E0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABAF160	0_2_00007FF64ABAF160
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64AC032AC	0_2_00007FF64AC032AC
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF2834	0_2_00007FF64ABF2834
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC77F2	0_2_00007FF64ABC77F2
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABD5790	0_2_00007FF64ABD5790
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABFA788	0_2_00007FF64ABFA788
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF3774	0_2_00007FF64ABF3774
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC28D0	0_2_00007FF64ABC28D0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC78E0	0_2_00007FF64ABC78E0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF2630	0_2_00007FF64ABF2630
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABE85E0	0_2_00007FF64ABE85E0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBA5F0	0_2_00007FF64ABBA5F0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABAF5A0	0_2_00007FF64ABAF5A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABB3550	0_2_00007FF64ABB3550
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC4550	0_2_00007FF64ABC4550
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABAD560	0_2_00007FF64ABAD560
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABBF570	0_2_00007FF64ABBF570
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC3570	0_2_00007FF64ABC3570
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF5570	0_2_00007FF64ABF5570

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 000001EF42651D20 appears 56 times
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 000001EF4264D510 appears 52 times
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 000001EF4264FB70 appears 35 times
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 000001EF42656990 appears 41 times
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 00007FF64ABA80E0 appears 36 times
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: String function: 000001EF426B86D8 appears 36 times

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF4265E5A0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000001EF4265E5A0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF4268F820 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,

0_2_000001EF4268F820

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963857B4EDF

Source: bv2DbIiZeK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bv2DbIiZeK.exe

ReversingLabs: Detection: 50%

Source: bv2DbIiZeK.exe	String found in binary or memory: --help
Source: bv2DbIiZeK.exe	String found in binary or memory: --help

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: bv2DbIiZeK.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: bv2DbIiZeK.exe

Static file information: File size 1851904 > 1048576

Source: bv2DbIiZeK.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x137a00

Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: bv2DbIiZeK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: bv2DbIiZeK.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: bv2DbIiZeK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: bv2DbIiZeK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: bv2DbIiZeK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: bv2DbIiZeK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: bv2DbIiZeK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: bv2DbIiZeK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF4265D510 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000001EF4265D510

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CB00 push rsp; retf	0_2_000001EF4268CBA1
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBB8 push rsp; retf	0_2_000001EF4268CBB9
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBBC push rsp; retf	0_2_000001EF4268CBBD
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBB0 push rsp; retf	0_2_000001EF4268CBB1
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBB4 push rsp; retf	0_2_000001EF4268CBB5
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBC0 push rsp; retf	0_2_000001EF4268CBC1
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBC4 push rsp; retf	0_2_000001EF4268CBC5
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF4268CBAC push rsp; retf	0_2_000001EF4268CBAD
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABC7C00 push rcx; iretd	0_2_00007FF64ABC7C01

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426971A0 ExitProcess,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_000001EF426971A0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-91094

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-91214

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DBA38 FindClose,FindFirstFileExW,GetLastError,	0_2_000001EF426DBA38
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426DBAE8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_000001EF426DBAE8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F80C8 FindFirstFileW,ExitProcess,	0_2_000001EF426F80C8

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426AA4B0 GetLogicalDriveStringsW,

0_2_000001EF426AA4B0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426BFBD0 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_000001EF426BFBD0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2256256990.000001EF42244000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000002.2258061373.000001EF42246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`c+B
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: bv2DbIiZeK.exe, 00000000.00000002.2258181340.000001EF422B5000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2163157026.000001EF422B5000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256056883.000001EF422B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: bv2DbIiZeK.exe, 00000000.00000002.2257391727.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256345781.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-client-migration-replacement.mannnt.man
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: bv2DbIiZeK.exe, 00000000.00000003.2166972667.000001EF422F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	API call chain: ExitProcess graph end node			graph_0-88985
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	API call chain: ExitProcess graph end node			graph_0-88982

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426AD700 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_000001EF426AD700

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426DDC60 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000001EF426DDC60

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426DDC60 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000001EF426DDC60

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF4265D510 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000001EF4265D510

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426F82A8 SetUnhandledExceptionFilter,	0_2_000001EF426F82A8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_000001EF426B83E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000001EF426B83E8
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64ABF5088 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF64ABF5088
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: 0_2_00007FF64AC08E48 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF64AC08E48

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_000001EF426DB634
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_000001EF426CF494
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_000001EF426CF564
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_000001EF426C4518
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: GetLocaleInfoW,	0_2_000001EF426C4A5C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000001EF426CFB7C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000001EF426CF9A0
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000001EF426CF148
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF64AC00C0C
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF64AC00A28
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_00007FF64AC00520
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF64AC001C4
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_00007FF64ABFC240
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: GetLocaleInfoW,	0_2_00007FF64ABFC5D4
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Code function: EnumSystemLocalesW,	0_2_00007FF64AC005F0

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426D5CD8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000001EF426D5CD8

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426A9410 GetUserNameW,

0_2_000001EF426A9410

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Code function: 0_2_000001EF426C96B8 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_000001EF426C96B8

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: bv2DbIiZeK.exe PID: 592, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.bv2DbIiZeK.exe.1ef42620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bv2DbIiZeK.exe.1ef42620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bv2DbIiZeK.exe PID: 592, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: bv2DbIiZeK.exe, 00000000.00000003.2179089816.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets
Source: bv2DbIiZeK.exe, 00000000.00000003.2179089816.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\configa
Source: bv2DbIiZeK.exe, 00000000.00000003.2164711090.000001EF4092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNTVdCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: bv2DbIiZeK.exe, 00000000.00000003.2179089816.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodusilla\IceCatef
Source: bv2DbIiZeK.exe, 00000000.00000003.2179089816.000001EF4090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binanceron
Source: bv2DbIiZeK.exe, 00000000.00000002.2257935528.000001EF42230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: bv2DbIiZeK.exe, 00000000.00000002.2257935528.000001EF42230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bv2DbIiZeK.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\bv2DbIiZeK.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: bv2DbIiZeK.exe PID: 592, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.bv2DbIiZeK.exe.1ef42620000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.bv2DbIiZeK.exe.1ef42620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bv2DbIiZeK.exe PID: 592, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bv2DbIiZeK.exe	50%	ReversingLabs	Win64.Spyware.Meduzastealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.ipify.org	bv2DbIiZeK.exe, 00000000.00000002.2258031248.000001EF42240000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256533387.000001EF4223F000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2256470694.000001EF4223D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42E04000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org	bv2DbIiZeK.exe, 00000000.00000003.2171788991.000001EF42DF4000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ns.microsoft.t/Regi	bv2DbIiZeK.exe, 00000000.00000003.2255833247.000001EF431A0000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2255979771.000001EF431A4000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2255867429.000001EF431A0000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2162129451.000001EF43191000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF409AA000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	bv2DbIiZeK.exe, 00000000.00000003.2164391354.000001EF40965000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	bv2DbIiZeK.exe, 00000000.00000003.2169041009.000001EF42480000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	bv2DbIiZeK.exe, 00000000.00000003.2178075673.000001EF40984000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	bv2DbIiZeK.exe, 00000000.00000003.2179424239.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2177238718.000001EF40983000.00000004.00000020.00020000.00000000.sdmp, bv2DbIiZeK.exe, 00000000.00000003.2178497787.000001EF422C1000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556368
Start date and time:	2024-11-15 10:27:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bv2DbIiZeK.exe renamed because original name is a hash value
Original Sample Name:	f33a0556ba844ec2745fceff565bdacaf0b26412b940dbf19b4ca97013057842.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 90 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: bv2DbIiZeK.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
45.130.145.152	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	NewVoicemail - +1 392 504 7XXX00-33Rebecca.silvaTranscript.html	Get hash	malicious	Unknown	Browse	104.16.123.96
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
ASBAXETNRU	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	kBZhM3H0Qm.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	y2m8g4DArI.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	seRpOAk8gH.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	1n72lp2XjT.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	fyL0RS744g.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.850220226960451
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bv2DbIiZeK.exe
File size:	1'851'904 bytes
MD5:	5526f8b855b92a67fbdfa72a46efbe28
SHA1:	593100b5694703f31613adbc6f8ccecfc1950a45
SHA256:	f33a0556ba844ec2745fceff565bdacaf0b26412b940dbf19b4ca97013057842
SHA512:	deb34b0a60300516dcf2806a4a9201e4205703bca27f563013c49c3a711c442f1876b719901cd2c634b0f1b9760bdba970456b852335e36dda17a81960c80b90
SSDEEP:	24576:APgPjwrmemcbk5ehMEP6h0lhSMXlzuRfqYc4w79fmCKFTN:mUNmk5ejuncdf
TLSH:	6785BF67FA4474F7E87091348CA70B57A73BB441836287DB2698662A5E537C42F3BF80
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.w.x.w.x.w.ht.p.w.hs.w.w.h*r.%.w.3.r...w.3.t.r.w.3.s.m.w.@.r.V.w.@.s.t.w.0+s.\.w.3.v.u.w.x.v...w.3+~.n.w.3+..y.w.3+u.y.w

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140068db8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x672A2615 [Tue Nov 5 14:05:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	979454a65972c76dcd425798f051e66e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F940867103Ch
dec eax
add esp, 28h
jmp 00007F94086703EFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F9408670582h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F9408670585h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F940867057Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F940866FFAEh
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001B2EFh]
dec eax
mov ecx, ebx
call dword ptr [0001B2DEh]
call dword ptr [0001B228h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001B2D4h]
dec eax
mov dword ptr [esp+00h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1bad34	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c6000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1c0000	0x582c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c7000	0x1ec8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1af5c0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1af780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1af480	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x84000	0x3a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x829bc	0x82a00	de31c101e2e12791cf5ba8d7e1f8800e	False	0.5204694976076555	data	6.517331379202456	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x84000	0x1379ce	0x137a00	6874bcbb5b251e6c76eb2d50cbeeb962	False	0.5867068416566386	OpenPGP Secret Key	6.740736072260912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1bc000	0x3854	0x1e00	ec58ecde7347958bc3316e2765de7f98	False	0.18411458333333333	data	3.7806079944399755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1c0000	0x582c	0x5a00	e918791e54d22356033ffd22c63696d7	False	0.48333333333333334	PEX Binary Archive	5.797933837224379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1c6000	0x1e0	0x200	c42f687ad326746e03982f0db0a277bd	False	0.529296875	data	4.7137725829467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c7000	0x1ec8	0x2000	5c76bdd43a83c4d82f28c527b58e6952	False	0.652099609375	data	6.406061516145914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1c6060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	FindNextFileW, FindFirstFileExW, FindClose, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, UnmapViewOfFile, CloseHandle, CreateFileMappingW, MapViewOfFile, GetProcAddress, GetCurrentProcess, VirtualQuery, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, MultiByteToWideChar, ExitProcess, WideCharToMultiByte, GetTickCount, GetLastError, VirtualProtect, VirtualQueryEx, ReadProcessMemory, WriteProcessMemory, GetSystemInfo, InitializeCriticalSection, DeleteCriticalSection, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, GetCommandLineA, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, HeapSize, GetCPInfo, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetModuleHandleExW, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, GetProcessHeap, SetStdHandle, ReadConsoleW, FlushFileBuffers, WriteConsoleW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, QueryPerformanceFrequency, TryAcquireSRWLockExclusive, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx
USER32.dll	LoadAcceleratorsA, LoadAcceleratorsW
ADVAPI32.dll	GetTokenInformation, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T10:28:47.646469+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.646469+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.646469+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.651707+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49709	45.130.145.152	15666	TCP
2024-11-15T10:28:47.651707+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49709	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 10:28:40.069421053 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:40.074704885 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:40.074934959 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:40.587131977 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:40.587177038 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:40.587351084 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:40.597515106 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:40.597560883 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.216480017 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.216810942 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.431051016 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.431077003 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.432094097 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.432163000 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.434139013 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.475339890 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.605390072 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.605532885 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:41.605705976 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.605706930 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.623285055 CET	49710	443	192.168.2.6	104.26.13.205
Nov 15, 2024 10:28:41.623311043 CET	443	49710	104.26.13.205	192.168.2.6
Nov 15, 2024 10:28:47.646469116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651609898 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651626110 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651644945 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651654005 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651706934 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651729107 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651738882 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651741028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651772976 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651776075 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651783943 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651810884 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651829958 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.651869059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651880026 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.651910067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.656719923 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656733036 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656754017 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656764030 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656781912 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656790972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656802893 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.656822920 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.656862974 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.656933069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.656974077 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.657119036 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.657129049 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.657150030 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.657195091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.657223940 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.661920071 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.661988974 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.661998987 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662029028 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662070990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662471056 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662553072 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662638903 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662683964 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662687063 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662710905 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662722111 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662749052 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.662822962 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.662870884 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.666574955 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.666623116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.666933060 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.666977882 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667362928 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667373896 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667407990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667416096 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667424917 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667426109 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667454004 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667459965 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667483091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667489052 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667499065 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667522907 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667531013 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667572021 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667582989 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667620897 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667629004 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667660952 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667668104 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667704105 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667733908 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667743921 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667761087 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667779922 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667783022 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667804003 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667829990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667862892 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667896986 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667924881 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667937040 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.667949915 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667979956 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.667989969 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668000937 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668010950 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668030977 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668050051 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668050051 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668061972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668092012 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668107033 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668116093 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668118000 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668140888 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668154001 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668155909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668164968 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668194056 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668210030 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668219090 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668230057 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668250084 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668262005 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668277979 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668299913 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668342113 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668356895 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668368101 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668380976 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668389082 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668392897 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668414116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668430090 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668467045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668478012 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668509007 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668556929 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668566942 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668596029 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668615103 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668642044 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668675900 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668768883 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668780088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668808937 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668812037 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668818951 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668847084 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668869019 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668896914 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668908119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668936014 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668943882 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668955088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668962955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668977976 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.668978930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668991089 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.668996096 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669018984 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669035912 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669056892 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669068098 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669097900 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669105053 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669122934 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669142962 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669154882 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669166088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669176102 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.669195890 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.669215918 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.671591997 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.671633005 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.671659946 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.671674013 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.671886921 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.671910048 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672065973 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672286987 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672297955 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672333956 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672348022 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672370911 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672415972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672429085 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672445059 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672461033 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672476053 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672497988 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672524929 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672544956 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672549963 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672560930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672565937 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672584057 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672600985 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672625065 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672641039 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672668934 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672683001 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672694921 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672707081 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672734976 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672755003 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672786951 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672797918 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672841072 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672843933 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672854900 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672885895 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672925949 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672945023 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672970057 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.672986984 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.672988892 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673029900 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673063993 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673110962 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673145056 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673156023 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673187017 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673203945 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673204899 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673216105 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673244953 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673269033 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673295975 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673305988 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673347950 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673376083 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673404932 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673443079 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673449039 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673460960 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673465014 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673486948 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673491955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673506975 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673530102 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673533916 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673574924 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673576117 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673585892 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673607111 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673634052 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673648119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673660040 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673677921 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673686981 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673703909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673719883 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673722982 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673759937 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673795938 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673806906 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673818111 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673847914 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673851967 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673871040 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673894882 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673906088 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673942089 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.673944950 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673959017 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.673985004 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674011946 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674016953 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674060106 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674065113 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674072027 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674096107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674108028 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674122095 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674140930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674150944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674168110 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674177885 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674177885 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674201012 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674215078 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674221992 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674261093 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674318075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674329042 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674364090 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674474001 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674504995 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674521923 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674540043 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674540043 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674561024 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674582958 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674603939 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674643993 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674654961 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674691916 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674701929 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674704075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674714088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674727917 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674738884 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674753904 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674772978 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674777985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674788952 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674824953 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674833059 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.674834967 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.674874067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675033092 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675044060 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675077915 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675215006 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675225019 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675235033 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675244093 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675259113 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675270081 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675280094 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675295115 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675322056 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675349951 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675380945 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675390005 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675400019 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675414085 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675430059 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675894022 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675906897 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675916910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675926924 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675935984 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675945997 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675950050 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675957918 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675965071 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675970078 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675981045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.675985098 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.675991058 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676002979 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676012039 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676028013 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676038980 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676045895 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676064968 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676065922 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676080942 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676088095 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676105976 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676115990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676136017 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676145077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676147938 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676177025 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676182032 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676222086 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676222086 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676258087 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676331997 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676367044 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676376104 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676376104 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676387072 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676403046 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676414967 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676429033 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676465988 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676476002 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676486015 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676495075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676505089 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.676511049 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676532030 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.676547050 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677140951 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677155972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677174091 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677184105 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677196026 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677207947 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677217960 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677221060 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677234888 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677256107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677352905 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677365065 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677373886 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677383900 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677392960 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677402020 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677413940 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677423000 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677433968 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677444935 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677462101 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677470922 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677472115 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677496910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677496910 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677511930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677514076 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677546024 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677550077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677587032 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677589893 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677601099 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677611113 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677625895 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677634954 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677642107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677648067 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677659035 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677666903 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677675962 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677678108 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677694082 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677716970 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677748919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677768946 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677840948 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.677865028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677910089 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.677949905 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678018093 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678030014 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678040028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678057909 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678061962 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678069115 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678078890 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678087950 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678101063 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678112984 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678118944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678183079 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678193092 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678205013 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678211927 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678224087 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678239107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678248882 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678260088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678281069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678289890 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678297043 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678309917 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678311110 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678322077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678328037 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678334951 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678344965 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678349018 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678369045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678375006 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678394079 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678406954 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678415060 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678451061 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678462029 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678472996 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678483963 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678507090 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678519964 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678541899 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678553104 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678563118 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678571939 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678580999 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678586960 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678599119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678601980 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678611994 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678626060 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678653002 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678661108 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678672075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678706884 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678715944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678728104 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678759098 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678765059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678807020 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678854942 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678865910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678869963 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678911924 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.678946018 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678956032 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678966045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.678993940 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.679003000 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.722794056 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.723212957 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723284006 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723340034 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723393917 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723453045 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723515987 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723572016 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723634958 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.723686934 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770179033 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.770210028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.770657063 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770746946 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770796061 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770858049 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770904064 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.770965099 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.771019936 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.771090984 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.822736025 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.822925091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.874963045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.875169992 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.890672922 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.891006947 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891067028 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891119003 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891179085 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891230106 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891288996 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891354084 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891412973 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891475916 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891532898 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.891556025 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896178007 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896189928 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896236897 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896445036 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896482944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896532059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896569014 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896646976 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896657944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896697998 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896743059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896775961 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896800041 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896821022 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896847010 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896857023 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896882057 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896899939 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896902084 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896930933 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.896939993 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.896970034 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897070885 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897080898 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897114992 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897125006 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897162914 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897175074 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897275925 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897303104 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897305012 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897322893 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897340059 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897378922 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897388935 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897398949 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897411108 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897419930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897425890 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897430897 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897449970 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897480011 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897520065 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897532940 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897578955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897680998 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897692919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897728920 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897840023 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897859097 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897877932 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897891045 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897932053 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897949934 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.897983074 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.897996902 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898056984 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898066044 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898097038 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898190975 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898200989 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898238897 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898392916 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898401976 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898432970 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898468018 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898494959 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898509026 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898524046 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898613930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898622990 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898653030 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898667097 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898682117 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898690939 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898719072 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898722887 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898758888 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898783922 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898806095 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898808002 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898817062 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898832083 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898838043 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898854017 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898868084 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898883104 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898910999 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898951054 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.898977041 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.898986101 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899003983 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899008989 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899029970 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899045944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899082899 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899092913 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899110079 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899118900 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899123907 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899137974 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899144888 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899161100 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899190903 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899243116 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899252892 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899283886 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899333000 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899369955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899414062 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899450064 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899458885 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899476051 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899492025 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899503946 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899673939 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899683952 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899708986 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899715900 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899744034 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899753094 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899785995 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899816990 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899827003 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899857998 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899873972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899888039 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899913073 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899921894 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899944067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899946928 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899965048 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899971008 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.899991035 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.899991989 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900006056 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900023937 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900028944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900058985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900068045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900072098 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900095940 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900110960 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900151014 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900161028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900187969 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900202990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900212049 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900222063 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900249004 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900258064 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900259018 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900293112 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900316000 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900351048 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900435925 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900445938 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900500059 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900532007 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900542974 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900573015 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900578022 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900587082 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900593042 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900614023 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900634050 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900645018 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900655031 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900686026 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900757074 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900767088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900769949 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900779009 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900794983 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900800943 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900804043 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900820971 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900835991 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900841951 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900876999 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900878906 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900913954 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.900959015 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.900998116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901002884 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901036978 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901058912 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901067972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901098967 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901113033 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901169062 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901179075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901215076 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901304007 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901320934 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901338100 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901357889 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901411057 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901443958 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901457071 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901477098 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901520967 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901540041 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901551008 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901561022 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901566982 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901572943 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901592016 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901608944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901662111 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901698112 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901707888 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901717901 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901746988 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901757002 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901757956 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901776075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901783943 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901793957 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901803017 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901812077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901819944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901834965 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901859999 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901874065 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901885033 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901904106 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901911974 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.901920080 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901945114 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.901990891 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902000904 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902009010 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902018070 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902036905 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902051926 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902070999 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902089119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902101994 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902110100 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902117968 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902127028 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902127028 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902137041 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902146101 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902167082 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902189970 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902249098 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902259111 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902267933 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902276993 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902287006 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902306080 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902322054 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902339935 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902350903 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902359009 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902369022 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902380943 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902381897 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902407885 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902427912 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902476072 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902487040 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902494907 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902517080 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902530909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902801037 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902810097 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902841091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902859926 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902869940 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902880907 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902901888 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.902909994 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.902916908 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903026104 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903188944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903234959 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903338909 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903348923 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903361082 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903372049 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903392076 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903399944 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903417110 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903433084 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903449059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903464079 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903477907 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903505087 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903595924 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903634071 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903666019 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903675079 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903682947 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903691053 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903702021 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903706074 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903724909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903750896 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903810024 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903819084 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903827906 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903839111 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903844118 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903848886 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903858900 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903865099 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903870106 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903887033 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903911114 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.903933048 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.903971910 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904190063 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904200077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904207945 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904232025 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904243946 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904252052 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904256105 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904266119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904274940 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904280901 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904300928 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904315948 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904340029 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904376984 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904388905 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904414892 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904422998 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904428005 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904445887 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904464006 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904517889 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904526949 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904548883 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904557943 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904561043 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904598951 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.904685020 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904694080 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.904732943 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905107975 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905117989 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905128956 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905137062 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905145884 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905155897 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905159950 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905180931 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905198097 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905206919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905208111 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905220985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905235052 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905261040 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905287981 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905297995 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905307055 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905316114 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905324936 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905324936 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905339003 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905340910 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905350924 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905384064 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905411005 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905441046 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905452013 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905493975 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905543089 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905551910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905577898 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905596018 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905635118 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905669928 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905713081 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905750990 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905762911 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905797958 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905833006 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905848980 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905850887 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905859947 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905862093 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905869961 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905879021 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905891895 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905960083 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.905965090 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905977011 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905986071 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.905996084 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906018019 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906039000 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906043053 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906054020 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906064034 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906073093 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906080961 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906084061 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906102896 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906105042 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906115055 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906124115 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906127930 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906147957 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906169891 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906176090 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906186104 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906194925 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906203032 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906212091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906232119 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906243086 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906336069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906347036 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906356096 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906363964 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906389952 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906407118 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906450033 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906459093 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906467915 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906476021 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906490088 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906522036 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906569004 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906622887 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906781912 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906793118 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906800985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906810045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906825066 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906851053 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906857967 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906868935 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906883001 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906892061 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906899929 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906903982 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906909943 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906915903 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906938076 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906955957 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.906968117 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906982899 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.906991959 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907001972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907006979 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907011986 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907030106 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907048941 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907131910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907141924 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907150030 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907157898 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907179117 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907196999 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907208920 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907217026 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907226086 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907234907 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907243013 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907249928 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907249928 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907263994 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907300949 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907366991 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907377958 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907387018 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907397985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907402992 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907407045 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907417059 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907426119 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907428980 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907435894 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907449961 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907465935 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907478094 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907483101 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907511950 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907531023 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907540083 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907563925 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907571077 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907581091 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907594919 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907608032 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907627106 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907681942 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907691956 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907700062 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907707930 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907732964 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907752037 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907764912 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907773972 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907804012 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907804966 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907814980 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907843113 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907862902 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907905102 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907916069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907936096 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907943964 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907944918 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.907965899 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.907985926 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908127069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908137083 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908160925 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908169985 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908176899 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908191919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908200979 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908214092 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908226013 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908260107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908277035 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908286095 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908318996 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908443928 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908484936 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908488989 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908531904 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908540010 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908566952 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908575058 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908586979 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908615112 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908617020 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908638000 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908652067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908711910 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908723116 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908732891 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908751011 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908759117 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908768892 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908801079 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908838034 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908874989 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908921957 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.908970118 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.908981085 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909010887 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909015894 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909028053 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909039021 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909044981 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909061909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909077883 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909122944 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909135103 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909169912 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909226894 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909235954 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909275055 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909284115 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909306049 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909308910 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909316063 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909334898 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909352064 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909367085 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909379959 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909420013 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909430981 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909440994 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909451962 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909475088 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909476995 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909493923 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909550905 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909560919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909569025 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909591913 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909606934 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909617901 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909635067 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909635067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909643888 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909650087 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909662008 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909673929 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909691095 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909707069 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909727097 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909739971 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909771919 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909774065 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909781933 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909807920 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909810066 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909820080 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909827948 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909843922 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909888029 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909898043 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909931898 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.909953117 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909962893 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909971952 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.909987926 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910003901 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910053968 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910063982 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910073042 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910082102 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910101891 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910106897 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910151958 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910196066 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910206079 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910213947 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910232067 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910244942 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.910244942 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.910679102 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.950705051 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.950865984 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951384068 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951447010 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951487064 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951544046 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951582909 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951654911 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951700926 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951761007 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951805115 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951857090 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951904058 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.951960087 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952008009 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952071905 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952116013 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952178955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952220917 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952279091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.952320099 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.960896969 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.960961103 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.960978031 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.961039066 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.961049080 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.961102009 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.961129904 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:47.961153984 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961219072 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961266041 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961323977 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961373091 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961437941 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:47.961474895 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.002883911 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.003041029 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003117085 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003165007 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003228903 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003282070 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003348112 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.003379107 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.050764084 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.050873995 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.069484949 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.069631100 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.069695950 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.069744110 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.069797039 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.069842100 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.074940920 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.075088024 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.075158119 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.075201988 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.075253010 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.075278044 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.118700981 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.118783951 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158142090 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.158303022 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158401966 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.158430099 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158482075 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158521891 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158576012 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158643007 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158700943 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158747911 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158807039 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158848047 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158900023 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.158915043 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.163486004 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.163630962 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.206773043 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.206825972 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.227844000 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.227983952 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228034973 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.228039980 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228086948 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228140116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228183985 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228240967 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228283882 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228338003 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228384972 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228430986 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228477955 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.228526115 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.232882977 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.233036041 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233246088 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233302116 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233354092 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233402014 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233444929 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233496904 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.233510971 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.274774075 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.274820089 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.306710958 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.306848049 CET	15666	49709	45.130.145.152	192.168.2.6
Nov 15, 2024 10:28:48.306871891 CET	49709	15666	192.168.2.6	45.130.145.152
Nov 15, 2024 10:28:48.307034016 CET	49709	15666	192.168.2.6	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 10:28:40.573158979 CET	192.168.2.6	1.1.1.1	0x147d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 10:28:40.580051899 CET	1.1.1.1	192.168.2.6	0x147d	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:28:40.580051899 CET	1.1.1.1	192.168.2.6	0x147d	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 15, 2024 10:28:40.580051899 CET	1.1.1.1	192.168.2.6	0x147d	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	104.26.13.205	443	592	C:\Users\user\Desktop\bv2DbIiZeK.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 09:28:41 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-15 09:28:41 UTC	399	IN	HTTP/1.1 200 OK Date: Fri, 15 Nov 2024 09:28:41 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e2e366b48a8466c-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1185&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=2475213&cwnd=251&unsent_bytes=0&cid=217a746a0e5575e7&ts=405&x=0"
2024-11-15 09:28:41 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 39 Data Ascii: 173.254.250.89

Target ID:	0
Start time:	04:28:39
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\bv2DbIiZeK.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\bv2DbIiZeK.exe"
Imagebase:	0x7ff64aba0000
File size:	1'851'904 bytes
MD5 hash:	5526F8B855B92A67FBDFA72A46EFBE28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	78.9%
Signature Coverage:	23.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	126

Executed Functions

Function 000001EF426A8CC0 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 374
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000001EF426A8D0C
GetSystemMetrics.USER32 ref: 000001EF426A8D1A
GetSystemMetrics.USER32 ref: 000001EF426A8D28
GetSystemMetrics.USER32 ref: 000001EF426A8D36
GetDC.USER32 ref: 000001EF426A8D40
GetDeviceCaps.GDI32 ref: 000001EF426A8D56
GetDeviceCaps.GDI32 ref: 000001EF426A8D66
CreateCompatibleDC.GDI32 ref: 000001EF426A8D73
CreateCompatibleBitmap.GDI32 ref: 000001EF426A8D8B
SelectObject.GDI32 ref: 000001EF426A8DA1
BitBlt.GDI32 ref: 000001EF426A8DD7
SHCreateMemStream.SHLWAPI ref: 000001EF426A8DFD
SelectObject.GDI32 ref: 000001EF426A8E17
DeleteDC.GDI32 ref: 000001EF426A8E20
ReleaseDC.USER32 ref: 000001EF426A8E2B
DeleteObject.GDI32 ref: 000001EF426A8E34
EnterCriticalSection.KERNEL32 ref: 000001EF426A8F2B
LeaveCriticalSection.KERNEL32 ref: 000001EF426A8F38
GetObjectW.GDI32 ref: 000001EF426A8F54
IStream_Size.SHLWAPI ref: 000001EF426A8FFF
IStream_Reset.SHLWAPI ref: 000001EF426A900F
IStream_Read.SHLWAPI ref: 000001EF426A9070
SelectObject.GDI32 ref: 000001EF426A90BF
DeleteDC.GDI32 ref: 000001EF426A90C8
ReleaseDC.USER32 ref: 000001EF426A90D5
DeleteObject.GDI32 ref: 000001EF426A90DE
DeleteObject.GDI32 ref: 000001EF426A91E8
EnterCriticalSection.KERNEL32 ref: 000001EF426A91FA
EnterCriticalSection.KERNEL32 ref: 000001EF426A920A
GdiplusShutdown.GDIPLUS ref: 000001EF426A9218
LeaveCriticalSection.KERNEL32 ref: 000001EF426A9225
LeaveCriticalSection.KERNEL32 ref: 000001EF426A922F

Strings

, xrefs: 000001EF426A8DAC

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Object$CriticalSection$Delete$MetricsSystem$CreateEnterLeaveSelectStream_$CapsCompatibleDeviceRelease$BitmapGdiplusReadResetShutdownSizeStream
String ID:
API String ID: 4119826074-3916222277
Opcode ID: 6016e5cde231670ab120f25f23840e756dcdc48949450077b95a35fafbcf6ff8
Instruction ID: 485159cd815efd16fb30235a74a57a0df719a880a45efeb302ba8c19ea7e60a9
Opcode Fuzzy Hash: 6016e5cde231670ab120f25f23840e756dcdc48949450077b95a35fafbcf6ff8
Instruction Fuzzy Hash: 0102673A610BC48AEB10CF65E8447DE77A1F789B98F504239EE5947B98EF38C586C740

Function 000001EF426DBAE8 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 000001EF426DBB95
GetLastError.KERNEL32 ref: 000001EF426DBB9F
FindFirstFileW.KERNEL32 ref: 000001EF426DBBB6
GetLastError.KERNEL32 ref: 000001EF426DBBC2
FindClose.KERNEL32 ref: 000001EF426DBBD0
__std_fs_open_handle.LIBCPMT ref: 000001EF426DBC63
CloseHandle.KERNEL32 ref: 000001EF426DBC79
CloseHandle.KERNEL32 ref: 000001EF426DBDEC

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: b0954c19c2ec1b49376cfeb0a7b9e933d87c955ad15e2e4042eb139bd7e8b443
Instruction ID: 5275fc02eeeae2bf96d39cf1bfb9d7ec0b725eda2ff09bb970a347c0c0ef8aa0
Opcode Fuzzy Hash: b0954c19c2ec1b49376cfeb0a7b9e933d87c955ad15e2e4042eb139bd7e8b443
Instruction Fuzzy Hash: 7491B539314A8946FAB48B25E8547DF63A4A795FB0F1807389D7A477D8EF38C9438740

Function 000001EF426AB410 Relevance: 22.4, APIs: 3, Strings: 9, Instructions: 1387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF426A98A0: EnumDisplayDevicesW.USER32 ref: 000001EF426A98F9

Part of subcall function 000001EF426A97D0: RegGetValueA.ADVAPI32 ref: 000001EF426A9837

Part of subcall function 000001EF426A9410: GetUserNameW.ADVAPI32 ref: 000001EF426A9455

Part of subcall function 000001EF426A94B0: GetComputerNameW.KERNEL32 ref: 000001EF426A94F5

GlobalMemoryStatusEx.KERNEL32 ref: 000001EF426AB8C6
wcsftime.LIBCMT ref: 000001EF426AC13F
GetModuleFileNameA.KERNEL32 ref: 000001EF426AC301

Strings

computer_name, xrefs: 000001EF426ABAB7
time, xrefs: 000001EF426AC227
user_name, xrefs: 000001EF426AB560
cpu, xrefs: 000001EF426AB786
%d-%m-%Y, %H:%M:%S, xrefs: 000001EF426AC12C
ram, xrefs: 000001EF426AB9B3
gpu, xrefs: 000001EF426AB670
timezone, xrefs: 000001EF426AC650
system, xrefs: 000001EF426AB50C, 000001EF426AB61C, 000001EF426AB732, 000001EF426AB824, 000001EF426AB95F, 000001EF426ABA61, 000001EF426ABB64, 000001EF426ABD06, 000001EF426ABF22, 000001EF426AC1D3, 000001EF426AC3B0, 000001EF426AC5FC, 000001EF426AC7B5, 000001EF426AC973, 000001EF426ACA32

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Name$ComputerDevicesDisplayEnumFileGlobalMemoryModuleStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2156669781-1182675529
Opcode ID: b46901fea55b4b2ad244d64202a9089f04cba4112d9a5d8ab0bc026efc890228
Instruction ID: c1b894e8abf2307a50ebccf5ed841f1b1a616feb9eba86674c0fa76cc4bcdd74
Opcode Fuzzy Hash: b46901fea55b4b2ad244d64202a9089f04cba4112d9a5d8ab0bc026efc890228
Instruction Fuzzy Hash: 73E25C76615BC489EB208F34D8803DE37A5F795B88F50922AEE9D47B99EF34C285C740

Function 000001EF426971A0 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 596
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

APPB:, xrefs: 000001EF42697912
--key, xrefs: 000001EF4269773B, 000001EF42697899
--type, xrefs: 000001EF426977D1
1.0, xrefs: 000001EF4269763B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: --key$--type$1.0$APPB:
API String ID: 0-155154914
Opcode ID: f990a64e6ff3af871978a7eca08b8cd7602b2c7df706f7012e6a654f9eb70e86
Instruction ID: d21630dd02288920fa42266732019cd0129078d430d1ff6c82dc50a1fcd8f3e0
Opcode Fuzzy Hash: f990a64e6ff3af871978a7eca08b8cd7602b2c7df706f7012e6a654f9eb70e86
Instruction Fuzzy Hash: 0242877A215AC492FA25AB25E4553EFA361F785F80F805139EE8D03BDADF38C596C700

Function 000001EF4267E4E0 Relevance: 20.2, APIs: 2, Strings: 9, Instructions: 954
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001EF4267E56F

Strings

ios_base::eofbit set, xrefs: 000001EF42680B64
--key ", xrefs: 000001EF4268002E
cmd /c "", xrefs: 000001EF4267FF69
, xrefs: 000001EF4267E5BE
File.exe, xrefs: 000001EF4267FA9B
" --type , xrefs: 000001EF4267FFC1
status, xrefs: 000001EF4267E2D7, 000001EF4267E31C, 000001EF4267E3FC, 000001EF42680B27
ios_base::failbit set, xrefs: 000001EF42680B5D
ios_base::badbit set, xrefs: 000001EF42680B51

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: $ --key "$" --type $File.exe$cmd /c ""$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$status
API String ID: 514040917-2526376952
Opcode ID: f8b1236de03079af79b81a087eb188df9dc77e1876ee9d035298f6647cef9b78
Instruction ID: cdc9ee0cd8a98587c7c1ae656f52497a987e04e1a500e9de97dbad909fa4a239
Opcode Fuzzy Hash: f8b1236de03079af79b81a087eb188df9dc77e1876ee9d035298f6647cef9b78
Instruction Fuzzy Hash: B2B2AF36925BC489E7608F38E8813DE73A0F795748F506629EE8D17B9AEF34C285C700

Function 000001EF4265D510 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 864
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000001EF4265D5ED
GetProcAddress.KERNEL32 ref: 000001EF4265D6EB
GetProcAddress.KERNEL32 ref: 000001EF4265D7AF
GetProcAddress.KERNEL32 ref: 000001EF4265D82A
GetProcAddress.KERNEL32 ref: 000001EF4265D8AF
GetProcAddress.KERNEL32 ref: 000001EF4265D92A
GetProcAddress.KERNEL32 ref: 000001EF4265D9AF
FreeLibrary.KERNEL32 ref: 000001EF4265E4D8

Strings

cannot use push_back() with , xrefs: 000001EF4265E52A
system, xrefs: 000001EF4265E2DB
vault, xrefs: 000001EF4265E32F

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 39a6e07d2d23a1b6063e3bbec4e2a81180c0863cee2736fd5349db6d4d99b6a1
Instruction ID: 5e8e998ddce7be114939f07e54ebced34076882f2601ed2859bd259677d8ec0a
Opcode Fuzzy Hash: 39a6e07d2d23a1b6063e3bbec4e2a81180c0863cee2736fd5349db6d4d99b6a1
Instruction Fuzzy Hash: 93924B76205BC48AEB618F29E8403DE73A4F749B98F104229EE9C57B99EF35C695C700

Function 000001EF4267B5BD Relevance: 19.9, APIs: 2, Strings: 8, Instructions: 2437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

exists, xrefs: 000001EF4267E2B0, 000001EF4267E300, 000001EF4267E3DA, 000001EF4267E4BA
recursive_directory_iterator::operator++, xrefs: 000001EF4267E3A6, 000001EF4267E486
cannot use push_back() with , xrefs: 000001EF4267E34D, 000001EF4267E42D
filename, xrefs: 000001EF4267C4ED, 000001EF4267CFD8, 000001EF4267DBD2
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000001EF4267E3BD, 000001EF4267E49D
content, xrefs: 000001EF4267C5E4, 000001EF4267D0CE, 000001EF4267DCC8
status, xrefs: 000001EF4267E2D7, 000001EF4267E31C, 000001EF4267E3FC
directory_iterator::directory_iterator, xrefs: 000001EF4267E2C7

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $content$directory_iterator::directory_iterator$exists$filename$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-4250644884
Opcode ID: 1755e3af28544f6a4f005d8614fe6a43fc1aa9559c97ccdd1cd6c6af4023ff84
Instruction ID: 3bb2c7b65474dac16db9768a1580991264d9a4e6d95b161c4a558031d1f3f3ed
Opcode Fuzzy Hash: 1755e3af28544f6a4f005d8614fe6a43fc1aa9559c97ccdd1cd6c6af4023ff84
Instruction Fuzzy Hash: 60433876219BC481EA309B24E4903DFA361F7C5B94F50563ADE9D43ADAEF38C586CB40

Function 000001EF426C96B8 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000001EF426C96FD

Part of subcall function 000001EF426C8D68: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426C8D7C

Part of subcall function 000001EF426C3E04: HeapFree.KERNEL32 ref: 000001EF426C3E1A
Part of subcall function 000001EF426C3E04: GetLastError.KERNEL32 ref: 000001EF426C3E24

Part of subcall function 000001EF426D1E20: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426D1D6B

_get_daylight.LIBCMT ref: 000001EF426C96EC

Part of subcall function 000001EF426C8DC8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426C8DDC

_get_daylight.LIBCMT ref: 000001EF426C9962
_get_daylight.LIBCMT ref: 000001EF426C9973
_get_daylight.LIBCMT ref: 000001EF426C9984
GetTimeZoneInformation.KERNEL32 ref: 000001EF426C99AB

Strings

Eastern Summer Time, xrefs: 000001EF426C9A69
Eastern Standard Time, xrefs: 000001EF426C9A51

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 609cd5c29350d2d3e78b88e11d30510763bd4abb1a3ad7102f6c9217ea61b909
Instruction ID: 79613d9e715ad21a64161617d25dc4452fcf4be08a21012119a61f0f1d4f0617
Opcode Fuzzy Hash: 609cd5c29350d2d3e78b88e11d30510763bd4abb1a3ad7102f6c9217ea61b909
Instruction Fuzzy Hash: 77D1AE3A6112D086FB20BF2AD8517EF77A1EB94F84F84453AEE4947AC5EB38C442C744

Function 000001EF426A8400 Relevance: 13.9, APIs: 9, Instructions: 377
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000001EF426A8632

Part of subcall function 000001EF426D4D80: EnterCriticalSection.KERNEL32 ref: 000001EF426D4D90

InternetOpenUrlA.WININET ref: 000001EF426A86A2
HttpQueryInfoW.WININET ref: 000001EF426A86FA
HttpQueryInfoW.WININET ref: 000001EF426A8783
InternetQueryDataAvailable.WININET ref: 000001EF426A87C1
InternetReadFile.WININET ref: 000001EF426A887B
InternetQueryDataAvailable.WININET ref: 000001EF426A8941
InternetCloseHandle.WININET ref: 000001EF426A89E1
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426A8A21

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskCriticalEnterFileHandleReadSection
String ID:
API String ID: 2604747929-0
Opcode ID: fc949e963c715c86a0271e1d00848540d7925f451aecd845b44620503928b94d
Instruction ID: c6d80336cbc9802cafc64306390dc79962d76bd4481c5f282343031921651da8
Opcode Fuzzy Hash: fc949e963c715c86a0271e1d00848540d7925f451aecd845b44620503928b94d
Instruction Fuzzy Hash: BD029E36A24B9489FB40CB65E84039E77B5F795B98F101239EE8D57B99EF38C182C740

Function 000001EF426A18D0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 452fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 000001EF426A1AEF
SetFilePointer.KERNEL32 ref: 000001EF426A1BA2
ReadFile.KERNEL32 ref: 000001EF426A1BD1

Strings

exists, xrefs: 000001EF426A2056
ios_base::eofbit set, xrefs: 000001EF426A20B8
ios_base::failbit set, xrefs: 000001EF426A20B1
ios_base::badbit set, xrefs: 000001EF426A207D, 000001EF426A20A5

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: cef45a48f7878a3e5fa5529296e44061d008e29dbbd771ba8ffc6168d7640e7b
Instruction ID: 59dac73c4e78040a0299662656a534e0e5dd7000e1255e5efb8d0d55522b1418
Opcode Fuzzy Hash: cef45a48f7878a3e5fa5529296e44061d008e29dbbd771ba8ffc6168d7640e7b
Instruction Fuzzy Hash: 3832E436610BC489EB20DF29D8907DE37A1F785B48F44863ADE8D57A99EF74C686C700

Function 000001EF426C5EB4 Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426C62E6

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ee587dfff83579d0b9a43f58f55dddc981fcf35f929c9061162775006bc08a8
Instruction ID: c7110ab8530eba2e82570ff4be3426223f2d0ca05368d485ba797ad6a6a614f9
Opcode Fuzzy Hash: 9ee587dfff83579d0b9a43f58f55dddc981fcf35f929c9061162775006bc08a8
Instruction Fuzzy Hash: 99C1FE7A2046C499FB61AB2AD4483EF7BA0F785F80F444139EE9A077DACB79C456C704

Function 000001EF426C9934 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000001EF426C9962

Part of subcall function 000001EF426C8DC8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426C8DDC

_get_daylight.LIBCMT ref: 000001EF426C9973

Part of subcall function 000001EF426C8D68: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426C8D7C

_get_daylight.LIBCMT ref: 000001EF426C9984

Part of subcall function 000001EF426C8D98: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426C8DAC

Part of subcall function 000001EF426C3E04: HeapFree.KERNEL32 ref: 000001EF426C3E1A
Part of subcall function 000001EF426C3E04: GetLastError.KERNEL32 ref: 000001EF426C3E24

GetTimeZoneInformation.KERNEL32 ref: 000001EF426C99AB

Strings

Eastern Summer Time, xrefs: 000001EF426C9A69
Eastern Standard Time, xrefs: 000001EF426C9A51

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: fdae8f1dfa777fce5a3e66d579c9e7bc87631294a273493ab54ac6bcce4f220c
Instruction ID: a2246570cc3a8c5be50dab367b9d284380f47b56a3d9b9b8af2c0842e7b46cf9
Opcode Fuzzy Hash: fdae8f1dfa777fce5a3e66d579c9e7bc87631294a273493ab54ac6bcce4f220c
Instruction Fuzzy Hash: 17514C3A6106C086F720EF2AE8916DF77A0F798F84F84513DEE4943AD5DB38D5428B94

Function 000001EF426B1B00 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 421COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426B1CB0
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426B1CBE
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426B1F4D
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426B1F5B

Strings

value, xrefs: 000001EF426B1BD6, 000001EF426B1E7D

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 2b244e27728f2584efe1108659c4b86547b200678eb8a970704ff1d82b4043d2
Instruction ID: 6a4a5efe5b1f067dbc01db9bf93fdb5e792538b5d614ef438b27ba4ed6556ec3
Opcode Fuzzy Hash: 2b244e27728f2584efe1108659c4b86547b200678eb8a970704ff1d82b4043d2
Instruction Fuzzy Hash: 0B129E36625BC485FB00CB78E4843EE6B61E795BA4F505239FE9D43ADADF68C186C700

Function 000001EF4265E5A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 324processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000001EF4265E5E8
Process32FirstW.KERNEL32 ref: 000001EF4265E62A
Process32NextW.KERNEL32 ref: 000001EF4265E829
CloseHandle.KERNEL32 ref: 000001EF4265EA9B

Strings

[PID: , xrefs: 000001EF4265E664

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: a26ee468e19f021f08034df1c9a05ea792373fa16e59ac33925991e896167ccd
Instruction ID: a5c3bbfb5c245944a770762b2dfdc3d527e120059c881e6f54eec697919f1cd9
Opcode Fuzzy Hash: a26ee468e19f021f08034df1c9a05ea792373fa16e59ac33925991e896167ccd
Instruction Fuzzy Hash: EAE16A76214BC086FB258F25E8943DE67A5F385BA8F504229EE9D07BD9DF78C281C700

Function 00007FF64ABDAB90 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64AC10690: GetCurrentThreadId.KERNEL32 ref: 00007FF64AC106E1
Part of subcall function 00007FF64AC10690: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF64AC10700

std::_Throw_Cpp_error.LIBCPMT ref: 00007FF64ABDAEA7
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF64ABDAEB2
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF64AC106AA

Strings

PLH, xrefs: 00007FF64ABDB056

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Cpp_errorExclusiveLockThrow_std::_$AcquireCurrentReleaseThread
String ID: PLH
API String ID: 3715443949-3073785353
Opcode ID: 3fb75c1586c35fb31c76f8ed2ec01c275833c96b0a8b23f2fd5c08da0dabd3ff
Instruction ID: ae6e68a1dfc5965ccd7d76dd9b776b037b70b5e292a3931cf37b97745ffa585a
Opcode Fuzzy Hash: 3fb75c1586c35fb31c76f8ed2ec01c275833c96b0a8b23f2fd5c08da0dabd3ff
Instruction Fuzzy Hash: 4302EE72A0DB8192EB64EF25D450139B7A4FB89B90FA88075DB9D87B94DF3CD891C700

Function 000001EF42681A80 Relevance: 6.8, Strings: 5, Instructions: 571COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF42681A64, 000001EF42683E7C
prefs.js, xrefs: 000001EF42682FB8
cannot use push_back() with , xrefs: 000001EF426827E9
status, xrefs: 000001EF42682828, 000001EF4268284A, 000001EF42682872, 000001EF4268289A
directory_iterator::directory_iterator, xrefs: 000001EF4268283A, 000001EF42683E93

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 17eb7d0e8086073e77331b5d85a0d51c697534cf5b90661359c783595879bb63
Instruction ID: 3c2ba7fb0cde5853da86411a19af2aa0bc76409135358874e9286e0ae5bc883c
Opcode Fuzzy Hash: 17eb7d0e8086073e77331b5d85a0d51c697534cf5b90661359c783595879bb63
Instruction Fuzzy Hash: 2B524636619BC485E6719B29E8813DFB3A4F789B84F505229DECC43B99EF78C185CB40

Function 000001EF426A7BC0 Relevance: 6.4, APIs: 4, Instructions: 431networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001EF426A7D9E
recv.WS2_32 ref: 000001EF426A82B9
closesocket.WS2_32 ref: 000001EF426A82CB
WSACleanup.WS2_32 ref: 000001EF426A82D1

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9b6de6ef4d1276c4406894e8f0fcad5e3e47ad72a796665445ebe788dfe55c1f
Instruction ID: 36248a96cbdf1ff7d8ee873d9817a05e8c606b4995def3c65bfad6701965156f
Opcode Fuzzy Hash: 9b6de6ef4d1276c4406894e8f0fcad5e3e47ad72a796665445ebe788dfe55c1f
Instruction Fuzzy Hash: 0412B476614BC481FA21CB18E4543DFA761F799B90F504639EEAC43ADADF78C582CB00

Function 000001EF4265C9C0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 668COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000001EF4265CA22
CredFree.ADVAPI32 ref: 000001EF4265D434

Strings

cannot use push_back() with , xrefs: 000001EF4265D480

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: b99e392b310656b040ca23111d08bd72b96c4835794341a3d4c67a601aa4ff15
Instruction ID: 8a3d2efce3d6d47994e593a4e4b646f1b83bdd01d4df1104c914a6bb4e589afe
Opcode Fuzzy Hash: b99e392b310656b040ca23111d08bd72b96c4835794341a3d4c67a601aa4ff15
Instruction Fuzzy Hash: 2F625B76614BC489EB208F24E8803DE7761F789B98F505329EEAC57BD9DB78C285C700

Function 00007FF64ABB03F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABB064F
__std_exception_copy.LIBVCRUNTIME ref: 00007FF64ABB06B8

Strings

1.3.1.zlib-ng, xrefs: 00007FF64ABB0458

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: 1.3.1.zlib-ng
API String ID: 1109970293-992988628
Opcode ID: cef2e707c8c157b1bcf6bf32851de45a32f9dcf762f5a237605fead0d0c85985
Instruction ID: 041f5f764afc846acf8c316dd5f22b8a9b43652848e8aba31a4afc49cf49fea8
Opcode Fuzzy Hash: cef2e707c8c157b1bcf6bf32851de45a32f9dcf762f5a237605fead0d0c85985
Instruction Fuzzy Hash: D381A262F18B81A5EB00EF74D4902BD33A1EB95748F609232EE4D97F95EE38E590C340

Function 00007FF64ABA2C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF64ABA2CB5
NtProtectVirtualMemory.NTDLL ref: 00007FF64ABA2D08

Strings

0, xrefs: 00007FF64ABA2C93

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: cf04bd947f7070a94b62a6b5bcccf2b71133d9e9c5bc2d6e3d512b8803c010d6
Instruction ID: ce18df0eb1e661ac5bbe6b37153c811a81b69ff958d3725911b3878de8d64c39
Opcode Fuzzy Hash: cf04bd947f7070a94b62a6b5bcccf2b71133d9e9c5bc2d6e3d512b8803c010d6
Instruction Fuzzy Hash: 95112E22A1DB8192E650EF24F45036677A0FB897B4F201376EAAD46BE4DF3CD1948B40

Function 000001EF426AA760 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000001EF426AAAA5

Strings

[UTC, xrefs: 000001EF426AAA72

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 73b2d6551cd68c03bc10944c980a103c9ecd6a6435edc3f6c52f5e9528d7fcf7
Instruction ID: 31ff8a854221ce294fb74feb3735dc636f5db33fe8f5e6a3f835647177dadd16
Opcode Fuzzy Hash: 73b2d6551cd68c03bc10944c980a103c9ecd6a6435edc3f6c52f5e9528d7fcf7
Instruction Fuzzy Hash: 3191F536615FC889E7718F29E84129EB7A4F39D788F105329EECD57B59EB38C2548B00

Function 000001EF426916A0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000001EF426916F8
LocalFree.KERNEL32 ref: 000001EF4269178A

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 4e58c951b7c5e6adfc0a1d9a22f9c6bd733eaecc205548daf511c016fcdcf1dd
Instruction ID: 2232371e56ec4363ac19619ede7aafeb9551eac3011eb25f55137ff6d6d78f61
Opcode Fuzzy Hash: 4e58c951b7c5e6adfc0a1d9a22f9c6bd733eaecc205548daf511c016fcdcf1dd
Instruction Fuzzy Hash: AE413F36614A80CAF7208F74E4403EE37A4F759B8CF444279EE8807E8ADB79C6A58754

Function 000001EF426A2D10 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF426A3633
ios_base::badbit set, xrefs: 000001EF426A357F, 000001EF426A35BC, 000001EF426A35FA

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CriticalEnterSection
String ID: exists$ios_base::badbit set
API String ID: 1904992153-2074760687
Opcode ID: d353e85737c4dc16f6951876094991e5f875e5a0f67309b72c572c6927fd98f1
Instruction ID: b842743abb1c31b6e297f6fdc383c70b2f274e89f970c7b88bd350f9f5f65fd6
Opcode Fuzzy Hash: d353e85737c4dc16f6951876094991e5f875e5a0f67309b72c572c6927fd98f1
Instruction Fuzzy Hash: 4C324F36215BC496EA21DB18E4903DFA764F795B40F504239EE9D43AD9EF78C546CB00

Function 000001EF426AA4B0 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000001EF426AA521

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 7bc890d83d3b4a0e63cf1542b5475e21a6824dbc5121659db7d348b1b6621ac6
Instruction ID: 7d8934da9ebfef205c9814bd606b49ed7a70d0e455b00a246375ce9f09d767e3
Opcode Fuzzy Hash: 7bc890d83d3b4a0e63cf1542b5475e21a6824dbc5121659db7d348b1b6621ac6
Instruction Fuzzy Hash: DC717F36A18BC482F710CF24E48439E7771F795B98F205229EE9813AA9DB78D5D1DB40

Function 000001EF426A9410 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000001EF426A9455

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: adc87d1fa371ba8ec33ef8919547b2750fc0b2bbce7d02902e7188b025d9366e
Instruction ID: 6b8160d2aedd0c5204ebd1563304b544c61ab01280d397d53dbde290b2987579
Opcode Fuzzy Hash: adc87d1fa371ba8ec33ef8919547b2750fc0b2bbce7d02902e7188b025d9366e
Instruction Fuzzy Hash: 0B0161362187C482EB20CF25F4513DEB3A4F798B88F540135EE8D42A99DFBCC1958B44

Function 000001EF426A9960 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

cores, xrefs: 000001EF426A9B96

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 4722d089a90c732ce43d4776dc92d5206f360e061225a942db370daae173fd3a
Instruction ID: 79f3e9ba2e60e11820e3df36272f1599881e52294ae3a4b2c7fed6c7c28308ea
Opcode Fuzzy Hash: 4722d089a90c732ce43d4776dc92d5206f360e061225a942db370daae173fd3a
Instruction Fuzzy Hash: 7DB1AE76F10BC48AF700CFB8C4413DD3762A799B98F605329EE5923ADADB748196C384

Function 000001EF426B0440 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000001EF426B0636

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 4c5848268c85a42d971ed2b89f6bcaaa9c05278fdbdd3cc0fcef5c8ba17ae349
Instruction ID: 7b1d238f8e4004d097bbb0fc28245ad62a3fb96854c29adb876fa60209aea48b
Opcode Fuzzy Hash: 4c5848268c85a42d971ed2b89f6bcaaa9c05278fdbdd3cc0fcef5c8ba17ae349
Instruction Fuzzy Hash: 3681BF3A2046E496FA54CB25D5907EE6F61F785F80F94943ADF4A43BE2EB38C616C300

Function 000001EF426AFA58 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

": , xrefs: 000001EF426AFB35, 000001EF426AFBD5

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 5c7663efe092e97a5bfc1b10979cce433aae873457d53606f951c5d4b0992113
Instruction ID: 559c77e1b3a470eb6d54a13f69b7788b1988e752b92239e4d7fe68f5bb98ffc9
Opcode Fuzzy Hash: 5c7663efe092e97a5bfc1b10979cce433aae873457d53606f951c5d4b0992113
Instruction Fuzzy Hash: CF91147A204A85C1EB20DF26E09469E7761F789FC8F45902ACF5E47BA4CF7AC159C701

Function 000001EF426640B0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 000001EF42664139

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 437ae662eb117c41f44ff7f9c77615c2854eafd9d66bebc79b763ab490802efe
Instruction ID: c60d1af4b2b70336282ba6a53b480edd4f3af63a6939e26ac8add1ba7f9d059f
Opcode Fuzzy Hash: 437ae662eb117c41f44ff7f9c77615c2854eafd9d66bebc79b763ab490802efe
Instruction Fuzzy Hash: D941A0776196E04AE702CB3984113BD7FB2E366F88F1C8166DBD487786DA2DC216CB11

Function 000001EF4265EC50 Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eed650f1dd5ed8a2c84de12954ff222856c8e4a51a8d95637fb2b28ee48ffdf
Instruction ID: d1825195a87c50039623ac6dbd25801914d305b8826532f36fae09609866413c
Opcode Fuzzy Hash: 2eed650f1dd5ed8a2c84de12954ff222856c8e4a51a8d95637fb2b28ee48ffdf
Instruction Fuzzy Hash: A3725D76615BC489EB308F29E8413DE73A5F389B98F504229EE9C57B99DF78C285C700

Function 000001EF42650BD0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1ef235b21b11ac8251876c724bae84282ef74ca4d17a748efc12a0c8d6ac15
Instruction ID: c75f2db53bbd7ab8eabb1c06f78e6db2a6889e27e080167821a4500f649ca381
Opcode Fuzzy Hash: 7b1ef235b21b11ac8251876c724bae84282ef74ca4d17a748efc12a0c8d6ac15
Instruction Fuzzy Hash: A3F15236615FC889EB208B69E44139E77B1F78DB98F105329EEDC57B99DB78C1818B00

Function 000001EF426512C0 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8849b0289721132f3e5f40ffc6e27eeb38d1e34faac3596688eeda63eba861be
Instruction ID: 1d37636a9adaddc0ca71962dd62f2249ce390e3b07b268266ea6805379cab9f0
Opcode Fuzzy Hash: 8849b0289721132f3e5f40ffc6e27eeb38d1e34faac3596688eeda63eba861be
Instruction Fuzzy Hash: 68F14236615FC889EB208B69E44139E77B1F78DB98F105325EEDC57B99EB38C1918B00

Function 00007FF64ABACE40 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to hook VirtualAlloc in trash code., xrefs: 00007FF64ABAD346
HeapAlloc, xrefs: 00007FF64ABAD1D1
Failed to get address of HeapAlloc., xrefs: 00007FF64ABAD24F
HeapAlloc offset (relative to kernel32.dll): 0x, xrefs: 00007FF64ABAD1EA
kernel32.dll, xrefs: 00007FF64ABAD1C1, 00007FF64ABAD2EA
c3 , xrefs: 00007FF64ABAD13A
VirtualAlloc, xrefs: 00007FF64ABAD2F7

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID:
String ID: Failed to get address of HeapAlloc.$Failed to hook VirtualAlloc in trash code.$HeapAlloc$HeapAlloc offset (relative to kernel32.dll): 0x$VirtualAlloc$c3 $kernel32.dll
API String ID: 0-3441928642
Opcode ID: e24098b7a3418c233ea65c7986e3453cf49db42afa70e862ec10a2c4dd23eef7
Instruction ID: 2896b2ed8df9e29cdc5fbf42d6a62f6c7926b6b2685cd8476b1f2b2417a4553a
Opcode Fuzzy Hash: e24098b7a3418c233ea65c7986e3453cf49db42afa70e862ec10a2c4dd23eef7
Instruction Fuzzy Hash: ABE1E362B1DA42A1EA10FF11E4503F96362EF86B84F644172EA5DC7BE6DE3CE546C340

Function 000001EF426A14B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF426A1320: InitializeCriticalSectionEx.KERNEL32 ref: 000001EF426A1371
Part of subcall function 000001EF426A1320: GetLastError.KERNEL32 ref: 000001EF426A137B

EnterCriticalSection.KERNEL32 ref: 000001EF426A14F1
GdiplusStartup.GDIPLUS ref: 000001EF426A1518
LeaveCriticalSection.KERNEL32 ref: 000001EF426A1526
LeaveCriticalSection.KERNEL32 ref: 000001EF426A1554
GdipGetImageEncodersSize.GDIPLUS ref: 000001EF426A1562
GdipGetImageEncoders.GDIPLUS ref: 000001EF426A15F6
GdipCreateBitmapFromScan0.GDIPLUS ref: 000001EF426A16BA
GdipSaveImageToStream.GDIPLUS ref: 000001EF426A16D8
GdipDisposeImage.GDIPLUS ref: 000001EF426A173D
GdipDisposeImage.GDIPLUS ref: 000001EF426A1751

Strings

&, xrefs: 000001EF426A16B4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: 7b341c53486f43070d1c6ed6aee1070c3fc9f73d796a39bf4224e0cad6e524bc
Instruction ID: 5e4a8c66020ea7c5f8afe8ccf4e39dcc79df1385a7e11eab70df326b77b09c5e
Opcode Fuzzy Hash: 7b341c53486f43070d1c6ed6aee1070c3fc9f73d796a39bf4224e0cad6e524bc
Instruction Fuzzy Hash: 3991293A200B848AFB20CF25E8407DE37A4F759F98F559279EE4A47BD4DB34C6568740

Function 000001EF4269783A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 192
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 000001EF42697977

Part of subcall function 000001EF4268F820: CoInitializeEx.OLE32 ref: 000001EF4268F8CE

OpenMutexA.KERNEL32 ref: 000001EF42697A7F
ExitProcess.KERNEL32 ref: 000001EF42697A8F
CreateMutexA.KERNEL32 ref: 000001EF42697AB4
ExitProcess.KERNEL32 ref: 000001EF42697AD5
ReleaseMutex.KERNEL32 ref: 000001EF42697B50
CloseHandle.KERNEL32 ref: 000001EF42697B59

Strings

APPB:, xrefs: 000001EF42697912
--key, xrefs: 000001EF42697899
--type, xrefs: 000001EF4269784E

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ExitMutexProcess$CloseCreateHandleInitializeOpenRelease
String ID: --key$--type$APPB:
API String ID: 2480080097-2541764812
Opcode ID: 242afc60a1b9a7c5911455471c9d6bc6f32910ce8b20bd2a007793628d0bd071
Instruction ID: 932c383a6f31247a3944359211d8f22db2d17a76d70282a92d4391efb9dd9d8c
Opcode Fuzzy Hash: 242afc60a1b9a7c5911455471c9d6bc6f32910ce8b20bd2a007793628d0bd071
Instruction Fuzzy Hash: DA91A179215AC581FA61EB64E4553EFA360FBC5B80F401579EE8D43ADAEF38C586CB00

Function 000001EF426A29E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 193
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF426A8A30: GetUserGeoID.KERNEL32 ref: 000001EF426A8A55
Part of subcall function 000001EF426A8A30: GetGeoInfoA.KERNEL32 ref: 000001EF426A8A6D
Part of subcall function 000001EF426A8A30: GetGeoInfoA.KERNEL32 ref: 000001EF426A8ABD

WSAStartup.WS2_32 ref: 000001EF426A2AEC
socket.WS2_32 ref: 000001EF426A2B07
htons.WS2_32 ref: 000001EF426A2B28
inet_pton.WS2_32 ref: 000001EF426A2B55
connect.WS2_32 ref: 000001EF426A2B6D
closesocket.WS2_32 ref: 000001EF426A2B83
WSACleanup.WS2_32 ref: 000001EF426A2B89

Strings

geo, xrefs: 000001EF426A2A99
system, xrefs: 000001EF426A2A5A

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 4ac7e58d4ce2cc2a61abb52f43d454f3727fcf7897087ca566c48be208fdc2a9
Instruction ID: 7ad6f27893270bca84cb2f7506d10db1aa4ab0b6fdf83ff8ad9563ab6f89d986
Opcode Fuzzy Hash: 4ac7e58d4ce2cc2a61abb52f43d454f3727fcf7897087ca566c48be208fdc2a9
Instruction Fuzzy Hash: 55917E7A751A8189FB00CF74E8903DE2361E745B98F90563ADE59536E9EF38C64AC340

Function 000001EF426E3C08 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001EF426E37E8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426E3829
Part of subcall function 000001EF426E37E8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426E38A9
Part of subcall function 000001EF426E37E8: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426E38FD
Part of subcall function 000001EF426E37E8: _get_daylight.LIBCMT ref: 000001EF426E3955

CreateFileW.KERNEL32 ref: 000001EF426E3D0E
CreateFileW.KERNEL32 ref: 000001EF426E3D5E
GetLastError.KERNEL32 ref: 000001EF426E3D8E
GetFileType.KERNEL32 ref: 000001EF426E3DA3
GetLastError.KERNEL32 ref: 000001EF426E3DAD
CloseHandle.KERNEL32 ref: 000001EF426E3DE0
CloseHandle.KERNEL32 ref: 000001EF426E3F44
CreateFileW.KERNEL32 ref: 000001EF426E3F79
GetLastError.KERNEL32 ref: 000001EF426E3F88

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 6285118774f749e8d84d89f3fc9727a5f198784a2c206228c38fa5836f6e4f91
Instruction ID: e535e9ad1e15fe7159149ac070f60a65c4b575c9b5e9ff34c15cccfa6301006f
Opcode Fuzzy Hash: 6285118774f749e8d84d89f3fc9727a5f198784a2c206228c38fa5836f6e4f91
Instruction Fuzzy Hash: E2C1BE3A720A8489FB10CFA9C4906EE7761F349FA8F015229DE2E9B7D5DB34C566C340

Function 000001EF426ACDC0 Relevance: 13.6, APIs: 9, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF426ACE24
GetProcessId.KERNEL32 ref: 000001EF426ACE2D

Part of subcall function 000001EF426D4D20: EnterCriticalSection.KERNEL32 ref: 000001EF426D4D30
Part of subcall function 000001EF426D4D20: LeaveCriticalSection.KERNEL32 ref: 000001EF426D4D70

RmStartSession.RSTRTMGR ref: 000001EF426ACE5C
RmRegisterResources.RSTRTMGR ref: 000001EF426ACE85
RmGetList.RSTRTMGR ref: 000001EF426ACEBE
RmGetList.RSTRTMGR ref: 000001EF426ACF20
RmEndSession.RSTRTMGR ref: 000001EF426ACF5C

Part of subcall function 000001EF426D4D80: EnterCriticalSection.KERNEL32 ref: 000001EF426D4D90

RmEndSession.RSTRTMGR ref: 000001EF426ACF94
RmEndSession.RSTRTMGR ref: 000001EF426ACFA9

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Session$CriticalSection$EnterListProcess$CurrentLeaveRegisterResourcesStart
String ID:
API String ID: 3440422588-0
Opcode ID: d7a364759b3dbcf11fb9cdf69c51cca138d24a74673e17ad1cdbcdcc327df430
Instruction ID: 9377347f7dbe3417b411c47dd933b917e2b30af254b8dc4772dda4d9061606fd
Opcode Fuzzy Hash: d7a364759b3dbcf11fb9cdf69c51cca138d24a74673e17ad1cdbcdcc327df430
Instruction Fuzzy Hash: B8510A3A7006848AFB50CFA5E8547DE73A5BB88B54F414539DE0E93AD4DF38CA06C740

Function 00007FF64ABD5180 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF64ABD51B7
LoadLibraryA.KERNEL32 ref: 00007FF64ABD520F
GetProcAddress.KERNEL32 ref: 00007FF64ABD5224
GetCurrentProcess.KERNEL32 ref: 00007FF64ABD522D
VirtualAlloc2.KERNELBASE ref: 00007FF64ABD525B

Strings

kernelbase.dll, xrefs: 00007FF64ABD51F9
VirtualAlloc2, xrefs: 00007FF64ABD521A

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: 0e0abdd12b88005321260c04ab8a94d4e8af7926ab9791165807831670d0e7fa
Instruction ID: 39f2b7d9aba2ca68bbd629c5d2f9c2c9c0d949dc01e4e7140e6b202095eec44b
Opcode Fuzzy Hash: 0e0abdd12b88005321260c04ab8a94d4e8af7926ab9791165807831670d0e7fa
Instruction Fuzzy Hash: 48212636A09B8192EB10DF11F4443A9B7B4FB99B84F645229EB8D43B64EF7CD195CB00

Function 00007FF64ABB00D0 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABB03BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABB03C3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64ABB03CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABB03D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABB03DB

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 219f4f4f41df4a763007e0c5554b64e668db321e0b2afe851a5c400cab673880
Instruction ID: cd11dfcfede6c0598744176ad88cee5c0dc2bb72db81fbbfe2ce461f9b5663ae
Opcode Fuzzy Hash: 219f4f4f41df4a763007e0c5554b64e668db321e0b2afe851a5c400cab673880
Instruction Fuzzy Hash: 2E819072A1CF8196EA10EF64E48426A73A5FB49794F205735EA9C42FD9DF7CE180C700

Function 00007FF64ABAFEA0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF64ABAFEEF
OpenProcessToken.ADVAPI32 ref: 00007FF64ABAFF02
GetTokenInformation.KERNELBASE ref: 00007FF64ABAFF3E
RtlEnterCriticalSection.NTDLL ref: 00007FF64ABAFF7F
RtlLeaveCriticalSection.NTDLL ref: 00007FF64ABAFF8D

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: CriticalProcessSectionToken$CurrentEnterInformationLeaveOpen
String ID:
API String ID: 2440646923-0
Opcode ID: 9ab9300c0f4551c81633224fb06f0f89bab90709a367cb91cc1a670632937391
Instruction ID: abe737827ec60ce0f3e6adb80e97453f4b93dbe417aeb69a11d9e969188d4e41
Opcode Fuzzy Hash: 9ab9300c0f4551c81633224fb06f0f89bab90709a367cb91cc1a670632937391
Instruction Fuzzy Hash: 16516621B0CA0662FAA0FF25A5903BA6361FF86B80F645171EE4E87F95DF3DE4418740

Function 00007FF64ABC8B00 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF64ABC8B23
ReadProcessMemory.KERNEL32 ref: 00007FF64ABC8B4C
GetLastError.KERNEL32 ref: 00007FF64ABC8B60
VirtualQueryEx.KERNEL32 ref: 00007FF64ABC8B7E
ReadProcessMemory.KERNEL32 ref: 00007FF64ABC8BAD

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: dc075e0e2fa7d39a4b06bb62cacae32b3ddb62e8aafcae57b1d9cb5024b06f87
Instruction ID: 5d410de9dc3af56cea7408cea3aec9096f3265423871b1b5a23e28aabe82c1e4
Opcode Fuzzy Hash: dc075e0e2fa7d39a4b06bb62cacae32b3ddb62e8aafcae57b1d9cb5024b06f87
Instruction Fuzzy Hash: DB217C72A0CB4592EA60AF52E900BA973A8FB55FC0F2840B6DE9C83B55CF3ED5518704

Function 000001EF426A97D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000001EF426A9837

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000001EF426A9829
--type, xrefs: 000001EF426A97D5
ProductName, xrefs: 000001EF426A9822

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Value
String ID: --type$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-3762788641
Opcode ID: 4129fc85b9082b641b48e58c8b8c6e2472d04c9c51b6127818adc047f838f3e9
Instruction ID: 89901d92dbfab5cb20e7503f6997f940b9d907013945c1099f7966bfcc7fd61c
Opcode Fuzzy Hash: 4129fc85b9082b641b48e58c8b8c6e2472d04c9c51b6127818adc047f838f3e9
Instruction Fuzzy Hash: 4F112E36208BC582E7208F21F44139EB3A4F799B88F911229EE9946B98DF78D255CB40

Function 00007FF64ABA3010 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64ABA2D30: GetModuleHandleW.KERNEL32 ref: 00007FF64ABA2D6D
Part of subcall function 00007FF64ABA2D30: RtlImageNtHeader.NTDLL ref: 00007FF64ABA2D8D
Part of subcall function 00007FF64ABA2D30: RtlGetNtVersionNumbers.NTDLL ref: 00007FF64ABA2DEA
Part of subcall function 00007FF64ABA2D30: RtlGetNtVersionNumbers.NTDLL ref: 00007FF64ABA2F84

RtlGetNtVersionNumbers.NTDLL ref: 00007FF64ABA307B
RtlGetNtVersionNumbers.NTDLL ref: 00007FF64ABA30E3
RtlImageDirectoryEntryToData.NTDLL ref: 00007FF64ABA3178

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: NumbersVersion$Image$DataDirectoryEntryHandleHeaderModule
String ID:
API String ID: 1637451276-0
Opcode ID: 712474940e18f77ab57ca1f1dd19ab4846e11f5ffb392c7771a0b5f644fe9222
Instruction ID: c7c522c1f2d372ff2b49471695227de1d33e2a1d7c5cfb5c6b7d547a1e792fdb
Opcode Fuzzy Hash: 712474940e18f77ab57ca1f1dd19ab4846e11f5ffb392c7771a0b5f644fe9222
Instruction Fuzzy Hash: 4B61AC36B18B02AAEB50EF64D5402ED37B2FB49708F640176CA0DA7A58DF38E955C700

Function 00007FF64ABD6580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64ABD66AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABD66B4

Strings

nop, xrefs: 00007FF64ABD6C24

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: nop
API String ID: 73155330-258488684
Opcode ID: 389c02a4f68a42f52438d16875c9a2168016208ccb590f182ea7b7427c83fc84
Instruction ID: caa0dbb89d6560f3b7b5d52f0192ba9f6ccba671245c39cebed3a8875c838192
Opcode Fuzzy Hash: 389c02a4f68a42f52438d16875c9a2168016208ccb590f182ea7b7427c83fc84
Instruction Fuzzy Hash: 6831BC62B2DB41A0EE10FF09E0542B96265EB49BE0F644671DAAD87FD9DF2CE491C300

Function 000001EF426A9D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000001EF426A9D6A

Strings

Unknown, xrefs: 000001EF426A9E25
--type, xrefs: 000001EF426A9D3B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: --type$Unknown
API String ID: 2104809126-2669863112
Opcode ID: 760e4e3f67c90bb7446da2159c480b59186af3a8e3a154873368319c074eb2c9
Instruction ID: 201e331092ee5e476337f34e4e529a5c81b5f0a4125b4ce28e42f66bfb46ab69
Opcode Fuzzy Hash: 760e4e3f67c90bb7446da2159c480b59186af3a8e3a154873368319c074eb2c9
Instruction Fuzzy Hash: 82317E36628BC482F6208F25F55039FB760F799B84F545229EFC902A9ADB7DD685CB00

Function 000001EF426A01B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF426A0201
RegCloseKey.ADVAPI32 ref: 000001EF426A0213

Strings

--type, xrefs: 000001EF426A01B7

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: --type
API String ID: 47109696-2654721227
Opcode ID: 7014c8b6109ec6826950106e7f7fa36bc9ff855a9ac06537b893ea57d2061009
Instruction ID: 794b0b925a8a75ee8aa3ac7227399401ec8358e6aee299861c6fcc4f3b149ead
Opcode Fuzzy Hash: 7014c8b6109ec6826950106e7f7fa36bc9ff855a9ac06537b893ea57d2061009
Instruction Fuzzy Hash: B0218039710AC445FE509B21E8907EFA360EB9AFD4F485139EE4D03BD5DF28C5828700

Function 00007FF64ABAA830 Relevance: 4.8, APIs: 3, Instructions: 298libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64ABAC900: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF64ABAB66C,?,?,?,00007FF64ABA2707), ref: 00007FF64ABAC950

LoadLibraryA.KERNEL32 ref: 00007FF64ABAAB18
GetProcAddress.KERNEL32 ref: 00007FF64ABAAB2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABAABAC

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: AddressLibraryLoadProcQueryVirtual_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3513549592-0
Opcode ID: d2e8c7aaed6e6c64566d84ba3d96d17ea8af480c2609a8a52e003b5272578578
Instruction ID: 6004b70187c82614b013837d0ebbbc256740e50ab206df86689cc134af3b1f3e
Opcode Fuzzy Hash: d2e8c7aaed6e6c64566d84ba3d96d17ea8af480c2609a8a52e003b5272578578
Instruction Fuzzy Hash: 32C1B163F0CA91A5FB10BF61D4403AC27A2FB0AB98FA5417ACE1D97A85DF39D485C350

Function 000001EF426A7F4E Relevance: 4.7, APIs: 3, Instructions: 186networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001EF426A82B9
closesocket.WS2_32 ref: 000001EF426A82CB
WSACleanup.WS2_32 ref: 000001EF426A82D1

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a02013ff56e0863db6598a7053ec74867d0982dbe617a38d302520dafb74340e
Instruction ID: 910b21d992f6e8c5c59ed2da70dd4b52eee8f6547acbdcc18ab9f91451b46e36
Opcode Fuzzy Hash: a02013ff56e0863db6598a7053ec74867d0982dbe617a38d302520dafb74340e
Instruction Fuzzy Hash: 38918176614BC481FA208B19E4553DF6761F79ABA0F505339EEAC03AEADF78C582C740

Function 000001EF426AA211 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF426AA229
RegEnumKeyExA.ADVAPI32 ref: 000001EF426AA26E
RegCloseKey.ADVAPI32 ref: 000001EF426AA464

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: e4d17b863811ac805bb3cfb8191430d72f76d945f5bb8ef6f2a71ab4a8ce5029
Instruction ID: 4bb19bd7bd4fa1860e2dc912a28d1ceecdbeb0e9cdfa46c6cb6044ee139b87f8
Opcode Fuzzy Hash: e4d17b863811ac805bb3cfb8191430d72f76d945f5bb8ef6f2a71ab4a8ce5029
Instruction Fuzzy Hash: DE717D76614BC486FB10CB69E44479E6771F785BA8F60023AEEAD13AD9DB78C4C2C700

Function 000001EF426AA1A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF426AA229
RegEnumKeyExA.ADVAPI32 ref: 000001EF426AA26E

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 69012de8002506ae3a43370800cbb35ce774bed31c35727b5f468cc9562c4237
Instruction ID: 43120f48337d2065e11b028da82d64550e5ebfa8a19087336368c7a5573a926c
Opcode Fuzzy Hash: 69012de8002506ae3a43370800cbb35ce774bed31c35727b5f468cc9562c4237
Instruction Fuzzy Hash: 8E317C36700BC486FB20CFA5E854B9E7774F785B98F60023AEE9917A94DB78C592C700

Function 000001EF426B7114 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426B713B

Part of subcall function 000001EF426B70D0: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426B70E7

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426B71E8
_local_unwind.LIBVCRUNTIME ref: 000001EF426B71F9

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 3b153441c32461bfb0eb759f9cc7ec2d93a122d6959f07e27f40eb8d54cdee1f
Instruction ID: c34653b9e5aac5157aa9b4f7193c67d3e552d4928495709edce7837b95ce1fb1
Opcode Fuzzy Hash: 3b153441c32461bfb0eb759f9cc7ec2d93a122d6959f07e27f40eb8d54cdee1f
Instruction Fuzzy Hash: 1E21B13A6106D481FA56DB14E8513EF3B61E795F84F98013AEE1A473E6DB38C206C720

Function 000001EF426A9EDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF426A9EF7
RegQueryValueExA.ADVAPI32 ref: 000001EF426A9F36
RegCloseKey.ADVAPI32 ref: 000001EF426A9FD4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: aeb71fd352264c1b9eee5993f9eaac2461e1c68eb05d08c908a1cd922f3faec3
Instruction ID: 2f09acba76af190a82f6f7fa3910971b90545ec136677eb12d42872183ff8aa7
Opcode Fuzzy Hash: aeb71fd352264c1b9eee5993f9eaac2461e1c68eb05d08c908a1cd922f3faec3
Instruction Fuzzy Hash: 6521913A715BC481FA108F25E48039FA361E7D6BD4F50523AEE8D42AD9EE28C185CB04

Function 000001EF426A8A30 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000001EF426A8A55
GetGeoInfoA.KERNEL32 ref: 000001EF426A8A6D
GetGeoInfoA.KERNEL32 ref: 000001EF426A8ABD

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: abc5036c296a8e57beceb74fdc647dcfa0ac5a3609073149a4a7ea06c52c9197
Instruction ID: e7dbf0f9ab4931cca63da14e103f3ac14a7d0a7d3ce3cc30fc052fd9f73d17f4
Opcode Fuzzy Hash: abc5036c296a8e57beceb74fdc647dcfa0ac5a3609073149a4a7ea06c52c9197
Instruction Fuzzy Hash: 9F118B36A24B8486EB109F61E45478EB361F794F88F045239EF8903B99EF7CD5518B84

Function 000001EF426A2470 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001EF426A24AB
OpenProcessToken.ADVAPI32 ref: 000001EF426A24BC
GetTokenInformation.ADVAPI32 ref: 000001EF426A24F4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 843c4e881ea1c955be678229682ad12d7f62d781caae3c893c8b4e9352b10c93
Instruction ID: bbf83adbdbcdfc1de0b937957d4a47eddf5cfee78b4b41b50d6ca83c5e6937bd
Opcode Fuzzy Hash: 843c4e881ea1c955be678229682ad12d7f62d781caae3c893c8b4e9352b10c93
Instruction Fuzzy Hash: 9E112936218B8186EB508F11F85078FB3A0F788B84F455139EE8947BA8DF3CC556CB40

Function 00007FF64ABABA70 Relevance: 3.9, APIs: 3, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF64ABABBD7

Part of subcall function 00007FF64ABAC900: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF64ABAB66C,?,?,?,00007FF64ABA2707), ref: 00007FF64ABAC950

VirtualFree.KERNEL32(?), ref: 00007FF64ABABCD5
VirtualAlloc.KERNEL32 ref: 00007FF64ABABD16

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Virtual$Alloc$FreeQuery
String ID:
API String ID: 609462816-0
Opcode ID: 07120e4ad77d0ed78d8cc2a36b75502f8507cddbf4e8b4e482180b5fccf2e1e8
Instruction ID: 979f1365139ac2230b85d3818dc82d1c03dfd6c3db4ae64b010a2412fa4406a8
Opcode Fuzzy Hash: 07120e4ad77d0ed78d8cc2a36b75502f8507cddbf4e8b4e482180b5fccf2e1e8
Instruction Fuzzy Hash: 21719421B0C64661FB64BF1195502BA6392AF67BC0F6440B4DE6D97F86EF3DEC568300

Function 000001EF42667540 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42667699

Strings

cannot use operator[] with a numeric argument with , xrefs: 000001EF42667A69

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 84078dc48dd260d6a6d7404a2f1f2bea2e41f1ccc26d56d4f36e002bba0bb3c3
Instruction ID: 46b45d1b458114dabb6f692c3779f0708064a936eb094ad08ca3aaad3e98d682
Opcode Fuzzy Hash: 84078dc48dd260d6a6d7404a2f1f2bea2e41f1ccc26d56d4f36e002bba0bb3c3
Instruction Fuzzy Hash: 7631AC7A3057C495FE159B2AE5043DEA252F704FE4F680B389EAD4BBD6DE78C0928700

Function 00007FF64ABA8E90 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64ABA900C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF64ABA9012

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 62c6a462bddb442d9bb1d36239809d0b0a4dca485d0c64cc10a4dc477bd56375
Instruction ID: 45a0140f65b80fe11cf680e4f611808dfac4e0b2a36e2d526cac83eb8cd03f98
Opcode Fuzzy Hash: 62c6a462bddb442d9bb1d36239809d0b0a4dca485d0c64cc10a4dc477bd56375
Instruction Fuzzy Hash: CB41D261B0C742A5EE20BF56A4042B9A253BB06FD4F644A72DEAD8BFC5DE3DD0419340

Function 000001EF426A1780 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000001EF426A17D9
CoTaskMemFree.OLE32 ref: 000001EF426A189A

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 0ada433c28abcb86cdef0f69cf612539cd7a0534f812acdf0e11966572c42b97
Instruction ID: 5af4d9d9b430adac48f2ae4599f6e83d7d27916e4170dcf7cb6c223d53721e9d
Opcode Fuzzy Hash: 0ada433c28abcb86cdef0f69cf612539cd7a0534f812acdf0e11966572c42b97
Instruction Fuzzy Hash: B1314276A14BC481E6108B29E44035FB761F799BE4F605329FEAC037D5DB7CC1818B40

Function 000001EF42697AEA Relevance: 3.1, APIs: 2, Instructions: 61synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF4265E5A0: CreateToolhelp32Snapshot.KERNEL32 ref: 000001EF4265E5E8
Part of subcall function 000001EF4265E5A0: Process32FirstW.KERNEL32 ref: 000001EF4265E62A

Part of subcall function 000001EF4265C9C0: CredEnumerateA.ADVAPI32 ref: 000001EF4265CA22

Part of subcall function 000001EF426A7BC0: recv.WS2_32 ref: 000001EF426A7D9E

ReleaseMutex.KERNEL32 ref: 000001EF42697B50
CloseHandle.KERNEL32 ref: 000001EF42697B59

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 156d097af29c4f5ea8f6df1dcfbc1a883085688cc5cf8c260fc458ec5aa08c2a
Instruction ID: a07edbf9c52926bcd68b73b9e337769fecda26d2908e4caa11bd7a4ccc9d9b15
Opcode Fuzzy Hash: 156d097af29c4f5ea8f6df1dcfbc1a883085688cc5cf8c260fc458ec5aa08c2a
Instruction Fuzzy Hash: BB21F0BD6156C480FA22BB74F4063DF5341AB89FA0F4415BDFDA9022CB9E28C583C621

Function 000001EF426C6428 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000001EF426C6474
GetLastError.KERNEL32 ref: 000001EF426C647E

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0b289e67f3315a15b91e6abf967764529b2485836cde0f12dbfa8971809dfebb
Instruction ID: 4864ffc764e01cc15ddd20a84483fcd2c0869ae00aad3fcb0f9d3f036d4d2448
Opcode Fuzzy Hash: 0b289e67f3315a15b91e6abf967764529b2485836cde0f12dbfa8971809dfebb
Instruction Fuzzy Hash: 1011BF76304A8081EA209B2AE54429E7361E784FF4F548339EE79477E9DE38C1568744

Function 00007FF64AC08B14 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64AC08B44

Part of subcall function 00007FF64AC09868: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF64AC09871

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF64AC08B4A

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 3b4601a600e6d8583585d6b890b82c0c7b93104b81c23db0e6f95a0016b351e7
Instruction ID: 8075e871521d8bc19761c0212f060996b991007e2b70f01c07a8540729bbbd79
Opcode Fuzzy Hash: 3b4601a600e6d8583585d6b890b82c0c7b93104b81c23db0e6f95a0016b351e7
Instruction Fuzzy Hash: 94E0ECC4E5D10762FDA8BEE218161B550A44F4B7B0E7C6BB0EBBDC9BC7AD1CE4918210

Function 000001EF426D4E90 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426D4EC0

Part of subcall function 000001EF426D5CAC: std::bad_alloc::bad_alloc.LIBCMT ref: 000001EF426D5CB5

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426D4EC6

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 9b26ece190ddfef467b4df6d1441cacb056fd69bbf8aa7748d5518b3e61eb427
Instruction ID: 8743c440a6279c21e65d1a1f3f1103f20b7ead7f2d580efde3b02b3c9a927a8d
Opcode Fuzzy Hash: 9b26ece190ddfef467b4df6d1441cacb056fd69bbf8aa7748d5518b3e61eb427
Instruction Fuzzy Hash: C2E0173C63128EAAFE2936B2981A3FF01800F59F74F2C1B3C6D35092C3AD2488978190

Function 00007FF64ABF8C40 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,44F642F9048B4AC0,00007FF64ABFE056,?,?,?,00007FF64ABFE3D3,?,?,00000000,00007FF64ABFED39,?,?,00007FF64AC05FDA,00007FF64ABFEC6B), ref: 00007FF64ABF8C56
GetLastError.KERNEL32(?,?,44F642F9048B4AC0,00007FF64ABFE056,?,?,?,00007FF64ABFE3D3,?,?,00000000,00007FF64ABFED39,?,?,00007FF64AC05FDA,00007FF64ABFEC6B), ref: 00007FF64ABF8C60

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4beb02ae198b01a3e73c7be97fef6af71b976333c9762f1a71bbb7bbb81d7103
Instruction ID: 70fc3497fe7c2ff57f638e32f73b99f323bfab6fea2864f5c74289004cd45460
Opcode Fuzzy Hash: 4beb02ae198b01a3e73c7be97fef6af71b976333c9762f1a71bbb7bbb81d7103
Instruction Fuzzy Hash: D3E0CD5AF0E20363FF047FF154440782192DF55740F2854B8D94DC7651DE2C68954700

Function 000001EF426C3E04 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000001EF426C3E1A
GetLastError.KERNEL32 ref: 000001EF426C3E24

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b876a730213cecfd686e206b510f5b7d457d852c74abe91743a1d3f1a15d8d1b
Instruction ID: 92eff0046c294de4a4dc02aa2276355827ec301d5e91fcdb8628c1698390d9ec
Opcode Fuzzy Hash: b876a730213cecfd686e206b510f5b7d457d852c74abe91743a1d3f1a15d8d1b
Instruction Fuzzy Hash: 73E08CB87016C442FF18ABB6D8842EF22509F89F40F44003C8D19432E1EA284A934360

Function 000001EF426B60D0 Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426B6317

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f680b58de8bf2d06c7c47c85c978ff829cfdda138cf43f3d0274ded4a4af5dbf
Instruction ID: ca5fbd927337ea3ffd466b73f34739cd5c0daecd7f9f45f48e81ddf43a2bc7dc
Opcode Fuzzy Hash: f680b58de8bf2d06c7c47c85c978ff829cfdda138cf43f3d0274ded4a4af5dbf
Instruction Fuzzy Hash: 06619F3AB016E485FE24CE5AD0543AE6B61E705F94F588639CF6E0B7D2DE39C482C300

Function 000001EF42661020 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4266120F

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 59d2347b98472a44a1f0cb87164641e2161bc0e68de9603546f43f70f04d2dfa
Instruction ID: 84b6cf4d1104134bcb6fc453faa488502e3209886d8586820754e9cbdaaed9d9
Opcode Fuzzy Hash: 59d2347b98472a44a1f0cb87164641e2161bc0e68de9603546f43f70f04d2dfa
Instruction Fuzzy Hash: B251693A204B8489EB158F2AD45439E77A5F389FA4F94457ACE1D473E5DE39C482CB40

Function 000001EF426A9550 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF426A2670: __std_fs_get_current_path.LIBCPMT ref: 000001EF426A26E8

GetVolumeInformationW.KERNEL32 ref: 000001EF426A95DD

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: InformationVolume__std_fs_get_current_path
String ID:
API String ID: 155845060-0
Opcode ID: b4c8a1029c2b9b60bc67bfd5abbf64dcf4c4f06ae66df3cd6cbce50130d53ab4
Instruction ID: 6a4f152d6563e437e587668899901b395132284b95caac77bd105eb776b8060b
Opcode Fuzzy Hash: b4c8a1029c2b9b60bc67bfd5abbf64dcf4c4f06ae66df3cd6cbce50130d53ab4
Instruction Fuzzy Hash: 99711936A14B9089FB10CF64E8803DE37B4F785B58F60522AEE8D53A99EF74C685C740

Function 000001EF426676B0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42667848

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9bc6c6429cabcd1affeb2a27c9e1711bc252cbf5df559db7cd8085457a9f1b29
Instruction ID: 96e2bf7dee8c3ce46d43e6071410976c21000b48edf4310c3eb60a7822feb097
Opcode Fuzzy Hash: 9bc6c6429cabcd1affeb2a27c9e1711bc252cbf5df559db7cd8085457a9f1b29
Instruction Fuzzy Hash: ED417A3A315AC481FA219B26E50439FA755F744FE4F984639DFAD07BCADE78C4428704

Function 000001EF4268BC80 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268BE25

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 07665e7a6b2e0f5531ac46c31e8bdd455e72424a19a62ead2351c6404ccb227c
Instruction ID: bd171c5ddda9084fa670e7bf47d0ed09e03e9888b00f1dea48040efab5464a3d
Opcode Fuzzy Hash: 07665e7a6b2e0f5531ac46c31e8bdd455e72424a19a62ead2351c6404ccb227c
Instruction Fuzzy Hash: 43417A7A216AC491EA24DF66E4443AFA7A5B348FD0F6446399FAD83BD5DE38C0528340

Function 000001EF4264FC40 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000001EF4264FD53

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: d5d61070a347b3db4bc21c26a85ede8feeb59c9fd738753003be38a1dc5db9ce
Instruction ID: 1b17e0339daa232935af8bac0f9b2e4ac01a14f1aa31c1cd9acb43378bd352f8
Opcode Fuzzy Hash: d5d61070a347b3db4bc21c26a85ede8feeb59c9fd738753003be38a1dc5db9ce
Instruction Fuzzy Hash: A941DE7760068082FA209B19E9443EE6361E785BB4F14433DEEA8477E5EB78D6C28708

Function 000001EF426C4300 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426C4328

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: af97434640a838a5f551ed2e2dfffd87e7f6ff24c5d315330158e50efae3ec73
Instruction ID: ca6f230574e66c6e24df51c9de5dc311778cfe5eae719a62a20de01f5e04a527
Opcode Fuzzy Hash: af97434640a838a5f551ed2e2dfffd87e7f6ff24c5d315330158e50efae3ec73
Instruction Fuzzy Hash: 58417C3A60168087FA34EA1EE5403AF77A0E795F94F244239DE9A87BD9CB38D503C751

Function 000001EF42666D59 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f98ced947e42f5ca7f06e5c8da96ec71bcd600a08ec97d6e49f61e9ee54e5b
Instruction ID: 72fb8ed6312884901302d17f478ec92f3c938f05d702a93426898d1c60d3295a
Opcode Fuzzy Hash: c2f98ced947e42f5ca7f06e5c8da96ec71bcd600a08ec97d6e49f61e9ee54e5b
Instruction Fuzzy Hash: 1731AE7A3056C085FE249B26F6043DEA252F748FE4F4806399E6D0BBD6DE3CC4828780

Function 000001EF426B3FF0 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426B4145

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0d49fec7d81e77aab1e78e694a4cd9ae16ab0192faee7a75efb097ea789b1b05
Instruction ID: dd04148db7c87de296f116cd60259fcf5f87731ccdfe95fb644c94469cd3a3d7
Opcode Fuzzy Hash: 0d49fec7d81e77aab1e78e694a4cd9ae16ab0192faee7a75efb097ea789b1b05
Instruction Fuzzy Hash: 85317C7A311AD482FA24DF29E5543AFA7A1E748FD0F6046399FAD13BD9DE38C0428300

Function 000001EF42661A80 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42661B8C

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3025b46c24a93013e538fddb28da000c2905704beb0d1b49e7d7ff912568d3be
Instruction ID: 0293f403ad74749298d0ea19cb9f87ca546ae79536a70c2652e30972653f6dd0
Opcode Fuzzy Hash: 3025b46c24a93013e538fddb28da000c2905704beb0d1b49e7d7ff912568d3be
Instruction Fuzzy Hash: 5E21AC36601A8545FE19AB29E6103AE6251AB44FB4F2487399E7903BD6EE78C4D38780

Function 000001EF42677F50 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42678075

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 33d1243b47e31fda1100824291fa2a9e0f2f0b5e4c43bb09c7e53d13836181fa
Instruction ID: 933a7bac0b0d5deedd9e2f7045573a29dacb2d8551deeaec4dcb4c60dee9c35d
Opcode Fuzzy Hash: 33d1243b47e31fda1100824291fa2a9e0f2f0b5e4c43bb09c7e53d13836181fa
Instruction Fuzzy Hash: 3B412876504B8086EB14CF25E45026E77B0F388F94F158629DE8D43395DF34C8A1C794

Function 000001EF426633FD Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426634F6

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ffc1f0567cdfbdf7053bafaed729564ab40ea6a83b07c352937b0f8d08f14ca
Instruction ID: 2d01dbc378d022722a2c92da8937f8f2f57b4e6df6c66c55291b3b2f023bc83f
Opcode Fuzzy Hash: 6ffc1f0567cdfbdf7053bafaed729564ab40ea6a83b07c352937b0f8d08f14ca
Instruction Fuzzy Hash: D721B23A3026C455FE1ADB29D5143EF9251AB00FE4F540A399E6E07FD6DE78C4938344

Function 000001EF426C5D98 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426C5E8F

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6f786347a37d4684b13f6cf6e78b2ce699f61a5fd7bf47ee94c93a2a041324e2
Instruction ID: 26da4afc343df49d93f549bb4e3b24cea164bb9687361f72536051d50ba64740
Opcode Fuzzy Hash: 6f786347a37d4684b13f6cf6e78b2ce699f61a5fd7bf47ee94c93a2a041324e2
Instruction Fuzzy Hash: D331B47A2006808AF7116B5AD8813EE3A52AB8CFE1F55023DEE29073E2CB7885478751

Function 000001EF426E34AC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426E34CF

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4f9b2f8469ee7c7c2fa910a4f0b010034c9d4173bbd88a1f33b49acec34b0f12
Instruction ID: f8c3417f8f37ed14477742724cdeac445cc3bcba9f71ab1d4d3946517bf85bad
Opcode Fuzzy Hash: 4f9b2f8469ee7c7c2fa910a4f0b010034c9d4173bbd88a1f33b49acec34b0f12
Instruction Fuzzy Hash: 44216F36214AC087FB619F1DE4407BEB6A0E785F94F684238EE5E476D9DB39C8128B00

Function 000001EF426DE978 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426DE8D5

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 071eab0d2ddb6d97d7b7232e2de0088f1d155ba52ad6f2216ba9fc5c62e5c193
Instruction ID: 78b7e0f841e5b6a756a43ab6efc83d3b88a43eaf72ef980dcf4a727ada82329f
Opcode Fuzzy Hash: 071eab0d2ddb6d97d7b7232e2de0088f1d155ba52ad6f2216ba9fc5c62e5c193
Instruction Fuzzy Hash: DD11BE3A624AD481FA60AF51D4003EFA7A4BB85F80F54403AEE8947BD6DF7CC9038700

Function 00007FF64ABE9210 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF64ABE926E

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 76df20d3830129ebccc759a6376518e9b168c08c4084b8211cca368eb6aac460
Instruction ID: 667c524cfe2d269df8929288fe70108bc697775716f76a7461c0e58b12630aa1
Opcode Fuzzy Hash: 76df20d3830129ebccc759a6376518e9b168c08c4084b8211cca368eb6aac460
Instruction Fuzzy Hash: 44311D16E1CA81AAF312EFB894012F86371FF7530DF146365DEC962825EF7562D58350

Function 000001EF426A3EF0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000001EF426A3F38

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 4e306829149e169d4783c267f1d2206ea130793025a9a04d510cabbcf64490f0
Instruction ID: 5484adf2d80c346d74816cfa999e7be73b5189fd5dbcd7ac42450607b7efae09
Opcode Fuzzy Hash: 4e306829149e169d4783c267f1d2206ea130793025a9a04d510cabbcf64490f0
Instruction Fuzzy Hash: 6501D635714AC482EB508F1AF94025AE3A0F789FD4F586174EF5D03B88EB28C8528700

Function 00007FF64ABE9550 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF64ABE9F34), ref: 00007FF64ABE9564

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 83258455bf70b88076b5dafb5707af98eb42bdecddf7b753287fc6cf9babc9f9
Instruction ID: c61b74da206d05b0efa4ace5726ee80834d837a2c8ab09ed33cbbd717cc4b860
Opcode Fuzzy Hash: 83258455bf70b88076b5dafb5707af98eb42bdecddf7b753287fc6cf9babc9f9
Instruction Fuzzy Hash: 36F04F35B1C6069BE748EF1EA80122977E2F798700F504279E98ED37A4DE7CE811CB40

Function 000001EF42657671 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000001EF426576B4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d66c6789144ba1e35efb442882a242fd38313b147d2b64ebd79fbcf9248c3a46
Instruction ID: ab9252ad39f6d284e572942a13ff6078a5da86c6e0c268741a702af0f7b87a15
Opcode Fuzzy Hash: d66c6789144ba1e35efb442882a242fd38313b147d2b64ebd79fbcf9248c3a46
Instruction Fuzzy Hash: CB01FF3A218AC581EA71CB56F85439F6364F788B94F544076DE8D43B99DE38C987CB00

Function 000001EF426B7814 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426B7833

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e3199247b15e626e1ff80a5878ee6ff274038b46c14856a595a092b0a0f0e46b
Instruction ID: 88638e988d5993ece2c3e87f5fc03337d8be98c443cf3fd9e1ae955c1368c90f
Opcode Fuzzy Hash: e3199247b15e626e1ff80a5878ee6ff274038b46c14856a595a092b0a0f0e46b
Instruction Fuzzy Hash: CEE0223620168089FF222B78E1812AE65509B04FF0F204339BE38022C2DA2484918610

Function 000001EF426DB9F8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000001EF426DB9FC

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 021893cd2ed339d1065ce6c5a318dc70dc0859a0caadd9e5077c2889b17622f9
Instruction ID: 6f8953f3c453979ea19d2f6272dc55102e8160cf48ad8274a3bf2fe9c3d23e1e
Opcode Fuzzy Hash: 021893cd2ed339d1065ce6c5a318dc70dc0859a0caadd9e5077c2889b17622f9
Instruction Fuzzy Hash: 36C04C29F519C5C1FE5417639C8638B1194A744B40F9585788D1880194ED1C86A74611

Function 000001EF426DD520 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 000001EF426DD529

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7625abf66e5e969e873e9ca9c619bb3736778813dbd6fa0c580d282ca7e19459
Instruction ID: 3db699fcec3aa4c1acedf304e0d50d92a3651423ccf748e7217f4c56297688bd
Opcode Fuzzy Hash: 7625abf66e5e969e873e9ca9c619bb3736778813dbd6fa0c580d282ca7e19459
Instruction Fuzzy Hash: F3B0923AB288C0C3DA11EB04E84204A7331F794B08FD00060EA8D426A4EF2CCA2A8E00

Function 00007FF64ABE9F10 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF64ABE9550: GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF64ABE9F34), ref: 00007FF64ABE9564

InitializeCriticalSection.KERNEL32 ref: 00007FF64ABE9FE0

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: 3c4ce3373927c8d3b37df18586ce10027d6ae3d6562ee6245d43f4ff5daa866a
Instruction ID: 3a0470fa61d66f8849046ccd59bc3f88aeea286710cad559e6c435280059a910
Opcode Fuzzy Hash: 3c4ce3373927c8d3b37df18586ce10027d6ae3d6562ee6245d43f4ff5daa866a
Instruction Fuzzy Hash: A541E132A08B889AD710EF12E84065EBBF8FB68B90F558075DF9983B50DF38E590C740

Function 000001EF426C67A4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000001EF426C67E2

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 63dca5d6534b0d653004b60d89eca86bfc1e356748a4aa90e791ce6c2ec14080
Instruction ID: 81c5c8884b848cb751f39e15fb94781a0d1ee017ec1d7ae117e3618605bbf84e
Opcode Fuzzy Hash: 63dca5d6534b0d653004b60d89eca86bfc1e356748a4aa90e791ce6c2ec14080
Instruction Fuzzy Hash: 2DF01C3C31528549FF557BA7E9597EF61905B88FB0F180A3C9D2A856C1EE2CC4868278

Function 00007FF64ABF98EC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF64AC015B5,?,?,00000000,00007FF64AC07CC3,?,?,?,00007FF64AC05D03,?,?,?,00007FF64AC05BF9), ref: 00007FF64ABF992A

Memory Dump Source

Source File: 00000000.00000002.2259434632.00007FF64ABA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF64ABA0000, based on PE: true

Associated: 00000000.00000002.2259410289.00007FF64ABA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259489107.00007FF64AC24000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259621780.00007FF64AD5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2259662159.00007FF64AD60000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff64aba0000_bv2DbIiZeK.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 52841ac695254bd62c098478f830f14578a06dba53232b58a06de83c9125a133
Instruction ID: 382bbcc5266439a783b7291b84e87d32bbc7f29febd90384eb6e41ae6e027513
Opcode Fuzzy Hash: 52841ac695254bd62c098478f830f14578a06dba53232b58a06de83c9125a133
Instruction Fuzzy Hash: 8CF08229F0D24761FE547FB1580167612D14FC6764F2D87B8ED2EC5AC1DD2CE4918510

Non-executed Functions

Function 000001EF4266FDF9 Relevance: 33.0, APIs: 3, Strings: 15, Instructions: 1494COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426713E1
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF426714A2

Strings

conditional not closed, xrefs: 000001EF4267169B, 000001EF426716BE
No closed word, xrefs: 000001EF426713E7, 000001EF4267140A
word wasnt properly ended, xrefs: 000001EF4267142D, 000001EF426714A8
#base, xrefs: 000001EF42670786
Unexpected eof, xrefs: 000001EF426712CA
object is not closed with '}', xrefs: 000001EF426712F1
unexpected '}', xrefs: 000001EF426714CB
/, xrefs: 000001EF42670002
key opened, but never closed, xrefs: 000001EF4267147F
key declared, but no value, xrefs: 000001EF42671337, 000001EF4267135A, 000001EF4267145C
#include, xrefs: 000001EF4267075A
quote was opened but not closed., xrefs: 000001EF42671314, 000001EF4267137D
", xrefs: 000001EF426701EC
unexpected key without object, xrefs: 000001EF426713BE
*, xrefs: 000001EF4267003B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$conditional not closed$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-2258937249
Opcode ID: 58a3558c2c3b379805bf7133b7470032faa49e9206985f15e4bb9f31b590badb
Instruction ID: 738b3fb95e6bf059345d7f35aa15bd94189eddf80032d137073366f7c8861e67
Opcode Fuzzy Hash: 58a3558c2c3b379805bf7133b7470032faa49e9206985f15e4bb9f31b590badb
Instruction Fuzzy Hash: F6E27C7A211BC485FB618F64E8A03EE2761F784B98F54513ADE4D0BADADF74C686C310

Function 000001EF4266E419 Relevance: 33.0, APIs: 3, Strings: 15, Instructions: 1482COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4266FA01

Part of subcall function 000001EF4264D510: __std_exception_copy.LIBVCRUNTIME ref: 000001EF4264D553

Part of subcall function 000001EF426D7DB4: RtlPcToFileHeader.KERNEL32 ref: 000001EF426D7DF8
Part of subcall function 000001EF426D7DB4: RaiseException.KERNEL32 ref: 000001EF426D7E3E

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4266FAC2

Strings

*, xrefs: 000001EF4266E65B
/, xrefs: 000001EF4266E622
conditional not closed, xrefs: 000001EF4266FCBB, 000001EF4266FCDE
No closed word, xrefs: 000001EF4266FA07, 000001EF4266FA2A
word wasnt properly ended, xrefs: 000001EF4266FA4D, 000001EF4266FAC8
#base, xrefs: 000001EF4266EDA6
Unexpected eof, xrefs: 000001EF4266F8EA
object is not closed with '}', xrefs: 000001EF4266F911
unexpected '}', xrefs: 000001EF4266FAEB
key opened, but never closed, xrefs: 000001EF4266FA9F
key declared, but no value, xrefs: 000001EF4266F957, 000001EF4266F97A, 000001EF4266FA7C
#include, xrefs: 000001EF4266ED7A
quote was opened but not closed., xrefs: 000001EF4266F934, 000001EF4266F99D
unexpected key without object, xrefs: 000001EF4266F9DE
", xrefs: 000001EF4266E80C

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$conditional not closed$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-2258937249
Opcode ID: f6064e601807928457050d91c793c3153c63724479d8175912c5726d00273771
Instruction ID: da53e30491a15d51631e76d3a1f5194074d04282e907f43e97cb043083e77d14
Opcode Fuzzy Hash: f6064e601807928457050d91c793c3153c63724479d8175912c5726d00273771
Instruction Fuzzy Hash: 68E27A7A211AC485FB618F24D8943EE2761F744B98F54913ADE4E0BBDADF78C686C700

Function 000001EF42626480 Relevance: 30.2, Strings: 24, Instructions: 244COMMON

Download Yara Rule

Strings

bootfont.bin, xrefs: 000001EF42626520
bootstat.dat, xrefs: 000001EF42626715
boot.ini, xrefs: 000001EF426264D1
wpsettings.dat, xrefs: 000001EF426267A2
d3d9caps.dat, xrefs: 000001EF426266E6
bootmgr, xrefs: 000001EF4262685E
bootmgfw.efi, xrefs: 000001EF426264F9
ntuser.ini, xrefs: 000001EF42626659
winre.wim, xrefs: 000001EF42626800
BOOTNXT, xrefs: 000001EF4262688D
reagent.xml, xrefs: 000001EF4262682F
ntldr, xrefs: 000001EF42626592
gdipfontcachev1.dat, xrefs: 000001EF426266B7
mib.bin, xrefs: 000001EF42626744
boot.sdi, xrefs: 000001EF426267D1
bootsect.bak, xrefs: 000001EF42626546
desktop.ini, xrefs: 000001EF4262656C
ntuser.dat, xrefs: 000001EF42626604
indexervolumeguid, xrefs: 000001EF42626773
winsipolicy.p7b, xrefs: 000001EF426265B8
thumbs.db, xrefs: 000001EF42626688
ntuser.dat.log, xrefs: 000001EF4262662D
autorun.inf, xrefs: 000001EF426264A8
iconcache.db, xrefs: 000001EF426265DE

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: a96eecc44e3043773db0e883680fe3aa9f097c62710d358845abfe4b3a443794
Instruction ID: 3191b0f1805921011860bd1ec0124b6e9fbd6e35e38b8909a883aa6a370b45f7
Opcode Fuzzy Hash: a96eecc44e3043773db0e883680fe3aa9f097c62710d358845abfe4b3a443794
Instruction Fuzzy Hash: 3DC15962D60FC984F711DB35D8813EA5361F7EA788F60732A7D4865896EFA4A3C5C340

Function 000001EF426AD700 Relevance: 28.0, APIs: 18, Instructions: 1017stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 000001EF426AD743
NtAllocateVirtualMemory.NTDLL ref: 000001EF426AD778
lstrcpyW.KERNEL32 ref: 000001EF426AD7DA
lstrcatW.KERNEL32 ref: 000001EF426AD891
NtAllocateVirtualMemory.NTDLL ref: 000001EF426AD915
lstrcpyW.KERNEL32 ref: 000001EF426AD9CA
RtlInitUnicodeString.NTDLL ref: 000001EF426AD9DF
RtlInitUnicodeString.NTDLL ref: 000001EF426AD9F4
LdrEnumerateLoadedModules.NTDLL ref: 000001EF426ADA07
RtlReleasePebLock.NTDLL ref: 000001EF426ADA0D

Part of subcall function 000001EF426A1780: SHGetKnownFolderPath.SHELL32 ref: 000001EF426A17D9
Part of subcall function 000001EF426A1780: CoTaskMemFree.OLE32 ref: 000001EF426A189A

CoInitializeEx.OLE32 ref: 000001EF426ADAB5
lstrcpyW.KERNEL32 ref: 000001EF426ADCBE
lstrcatW.KERNEL32 ref: 000001EF426ADEF5
CoGetObject.OLE32 ref: 000001EF426ADF11
lstrcpyW.KERNEL32 ref: 000001EF426AE671
lstrcatW.KERNEL32 ref: 000001EF426AE8D2
CoGetObject.OLE32 ref: 000001EF426AE8EE
CoUninitialize.OLE32 ref: 000001EF426AEE62

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID:
API String ID: 1424456515-0
Opcode ID: ea73c30954d403e34ac70ea67aa3b4d3b5d5fb510e36861fe33fa665d0e938bd
Instruction ID: ca196d390cec9c391a177fa4e3f3ba2e3589585d71455dce661bf4383be5b0c7
Opcode Fuzzy Hash: ea73c30954d403e34ac70ea67aa3b4d3b5d5fb510e36861fe33fa665d0e938bd
Instruction Fuzzy Hash: C2D28736626FC48AD7918F69E88169EB3B5F788B88F105225EECD57B18EF38C154C740

Function 000001EF4268F820 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 307memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000001EF4268F8CE
CoInitializeSecurity.OLE32 ref: 000001EF4268F982
CoCreateInstance.OLE32 ref: 000001EF4268FA3B
CoSetProxyBlanket.OLE32 ref: 000001EF4268FA89
SysAllocStringByteLen.OLEAUT32 ref: 000001EF4268FAB6
SysFreeString.OLEAUT32 ref: 000001EF4268FAC6
SysAllocStringByteLen.OLEAUT32 ref: 000001EF4268FAE6
SysFreeString.OLEAUT32 ref: 000001EF4268FAF7
SysStringByteLen.OLEAUT32 ref: 000001EF4268FB56
SysFreeString.OLEAUT32 ref: 000001EF4268FBD5
SysFreeString.OLEAUT32 ref: 000001EF4268FBDF

Strings

@, xrefs: 000001EF4268FA5D

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: String$Free$Byte$AllocInitialize$BlanketCreateInstanceProxySecurity
String ID: @
API String ID: 2330523681-2766056989
Opcode ID: 1db70e437ea9ee0464da4793389cb47279f1e71db4886dc3a598569a752e6ed2
Instruction ID: ee0ecd0326dd1326cb94b2ecd9a30d4d258ce3eb56794c5c534622299a73bbac
Opcode Fuzzy Hash: 1db70e437ea9ee0464da4793389cb47279f1e71db4886dc3a598569a752e6ed2
Instruction Fuzzy Hash: 3ED1BE36B05BC4CAFB10CB78D4543EE3361E788B98F505639DE8956AD9EF78C2868344

Function 000001EF426ACFC0 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 362nativelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF426D4D80: EnterCriticalSection.KERNEL32 ref: 000001EF426D4D90

GetModuleHandleA.KERNEL32 ref: 000001EF426AD03A
GetProcAddress.KERNEL32 ref: 000001EF426AD04A

Part of subcall function 000001EF426D4D20: EnterCriticalSection.KERNEL32 ref: 000001EF426D4D30
Part of subcall function 000001EF426D4D20: LeaveCriticalSection.KERNEL32 ref: 000001EF426D4D70

OpenProcess.KERNEL32 ref: 000001EF426AD08D
NtQuerySystemInformation.NTDLL ref: 000001EF426AD0B4
NtQuerySystemInformation.NTDLL ref: 000001EF426AD0DF
GetCurrentProcess.KERNEL32 ref: 000001EF426AD1AB
NtDuplicateObject.NTDLL ref: 000001EF426AD1D1
NtQueryObject.NTDLL ref: 000001EF426AD1F8
GetFinalPathNameByHandleA.KERNEL32 ref: 000001EF426AD2F2
CloseHandle.KERNEL32 ref: 000001EF426AD406
CloseHandle.KERNEL32 ref: 000001EF426AD48E

Strings

ntdll.dll, xrefs: 000001EF426AD033
File, xrefs: 000001EF426AD22C
NtDuplicateObject, xrefs: 000001EF426AD043

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Handle$CriticalQuerySection$CloseEnterInformationObjectProcessSystem$AddressCurrentDuplicateFinalLeaveModuleNameOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 3804586167-3955674919
Opcode ID: f61ad2c00416eed5c60c93bd95c0dce48377e2600a33d0f22673fd06890ece10
Instruction ID: 13b66339187fbbbafa8fe67fe8289bae7c1062076b5b09dd89f6e48e425ff8cc
Opcode Fuzzy Hash: f61ad2c00416eed5c60c93bd95c0dce48377e2600a33d0f22673fd06890ece10
Instruction Fuzzy Hash: 5EE1A97A700AC49AFB009FA5D4543EE27A2E746F98F408639DE0967BD9DF78C646C340

Function 000001EF426D0824 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 000001EF426D0873
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426D0EA6
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426D101C
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426D12D8
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426D14F8
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426D1733
memcpy_s.LIBCPMT ref: 000001EF426D180E
memcpy_s.LIBCPMT ref: 000001EF426D18B9
memcpy_s.LIBCPMT ref: 000001EF426D1989

Part of subcall function 000001EF426BBCB4: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426BBCE6

Strings

1#INF, xrefs: 000001EF426D099F
1#IND, xrefs: 000001EF426D0963
1#QNAN, xrefs: 000001EF426D098F
1#SNAN, xrefs: 000001EF426D0986

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: bca501f0276f1f21e044aa22766a38d9c99c6cb97f7169fb83df60f8e3093b38
Instruction ID: 4abf4450d1b8542eba7b936586ee1d572ee1c17addf78bed1a8ebb5108cb0622
Opcode Fuzzy Hash: bca501f0276f1f21e044aa22766a38d9c99c6cb97f7169fb83df60f8e3093b38
Instruction Fuzzy Hash: E2B2D07A6242C88BF7648F64E540BEE36A1F354B88F545239DE0667AC8DF759A02CF40

Function 000001EF426A3F80 Relevance: 15.1, APIs: 3, Strings: 4, Instructions: 2816COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 000001EF426A754D
cannot compare iterators of different containers, xrefs: 000001EF426A75F5, 000001EF426A76AD, 000001EF426A77EF
type must be string, but is , xrefs: 000001EF426A75B3, 000001EF426A766B, 000001EF426A7741, 000001EF426A779B
value, xrefs: 000001EF426A47B3

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 118556049-2711811579
Opcode ID: 22963e1c6cf2544b8d36aa68d2758a64090c939b73b6c3e1ad298cf801232d9c
Instruction ID: 54e2f6e289ec44ce8bd63eafb801f93cb7734bbe77568764970507f466747163
Opcode Fuzzy Hash: 22963e1c6cf2544b8d36aa68d2758a64090c939b73b6c3e1ad298cf801232d9c
Instruction Fuzzy Hash: 3E632536611BC489EB309F24D8503DE23A5F786B98F505239DE9D4BADAEF74C286C740

Function 000001EF4267FD8E Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 751COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000001EF4267FE8F

Part of subcall function 000001EF426DB798: AreFileApisANSI.KERNEL32 ref: 000001EF426DB7AA

__std_fs_convert_wide_to_narrow.LIBCPMT ref: 000001EF4267FEE4

Part of subcall function 000001EF426DB808: WideCharToMultiByte.KERNEL32 ref: 000001EF426DB863

__std_fs_convert_wide_to_narrow.LIBCPMT ref: 000001EF4267FF22

Part of subcall function 000001EF426DB808: WideCharToMultiByte.KERNEL32 ref: 000001EF426DB8AD
Part of subcall function 000001EF426DB808: GetLastError.KERNEL32 ref: 000001EF426DB8BB
Part of subcall function 000001EF426DB808: WideCharToMultiByte.KERNEL32 ref: 000001EF426DB8EF
Part of subcall function 000001EF426DB808: GetLastError.KERNEL32 ref: 000001EF426DB8FD

Strings

APPB:, xrefs: 000001EF426803E2
--key ", xrefs: 000001EF4268002E
cmd /c "", xrefs: 000001EF4267FF69
" --type , xrefs: 000001EF4267FFC1
ios_base::badbit set, xrefs: 000001EF42680B51, 000001EF42680C20

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast__std_fs_convert_wide_to_narrow$ApisFile__std_fs_code_page
String ID: --key "$" --type $APPB:$cmd /c ""$ios_base::badbit set
API String ID: 287866882-2970029062
Opcode ID: 0e185fdc0ca352c8544cd7e25cf47172860859828b33a723c2968b85eab0fd5c
Instruction ID: 49d83f513d6a5a632ea402a5faa5e9a957a7720bb8daa0d7e868666e7a9c97f9
Opcode Fuzzy Hash: 0e185fdc0ca352c8544cd7e25cf47172860859828b33a723c2968b85eab0fd5c
Instruction Fuzzy Hash: 31829D76611BC489FB218F38D8853EE2761F795B98F505739DE9C06AEAEF748285C300

Function 000001EF426ADA50 Relevance: 12.8, APIs: 8, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000001EF426AD700: RtlAcquirePebLock.NTDLL ref: 000001EF426AD743
Part of subcall function 000001EF426AD700: NtAllocateVirtualMemory.NTDLL ref: 000001EF426AD778
Part of subcall function 000001EF426AD700: lstrcpyW.KERNEL32 ref: 000001EF426AD7DA
Part of subcall function 000001EF426AD700: lstrcatW.KERNEL32 ref: 000001EF426AD891

CoInitializeEx.OLE32 ref: 000001EF426ADAB5
lstrcpyW.KERNEL32 ref: 000001EF426ADCBE
lstrcatW.KERNEL32 ref: 000001EF426ADEF5
CoGetObject.OLE32 ref: 000001EF426ADF11
lstrcpyW.KERNEL32 ref: 000001EF426AE671
lstrcatW.KERNEL32 ref: 000001EF426AE8D2
CoGetObject.OLE32 ref: 000001EF426AE8EE
CoUninitialize.OLE32 ref: 000001EF426AEE62

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID:
API String ID: 3636535045-0
Opcode ID: fcf151b66219aa466957ea95fe0a176f0c178864ee902ae7033e3034f4373440
Instruction ID: 7e1284a3da535791edd2d0f36d835724941af4a46b751ce22add3072c9bfbada
Opcode Fuzzy Hash: fcf151b66219aa466957ea95fe0a176f0c178864ee902ae7033e3034f4373440
Instruction Fuzzy Hash: 29B2683662AFC48AD7A18F69E88169AB3A4F789784F106215FFCD57B18EF38C154C740

Function 000001EF42651D4E Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 804COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF42652A54
filename, xrefs: 000001EF42652396
content, xrefs: 000001EF4265244D
status, xrefs: 000001EF42652A80, 000001EF42652A96
directory_iterator::directory_iterator, xrefs: 000001EF42652A70, 000001EF42652ABA

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 0-3429737954
Opcode ID: efe2b1850f0c2f317920522a4dc391dcc26c069b87216b79c50daa9fcbef6238
Instruction ID: e0421111fc334a9fb18b6ff775e529fb15be7d0c23482c1cf2dd966216201fb9
Opcode Fuzzy Hash: efe2b1850f0c2f317920522a4dc391dcc26c069b87216b79c50daa9fcbef6238
Instruction Fuzzy Hash: A0825936611BC489FB208F25E8943DE2361F785B98F545239EE8D47BE9EF24C686C740

Function 000001EF426CFB7C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF426C0A8C: GetLastError.KERNEL32 ref: 000001EF426C0A9B
Part of subcall function 000001EF426C0A8C: FlsGetValue.KERNEL32 ref: 000001EF426C0AB0
Part of subcall function 000001EF426C0A8C: SetLastError.KERNEL32 ref: 000001EF426C0B3B

Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0AD1
Part of subcall function 000001EF426C0A8C: FlsGetValue.KERNEL32 ref: 000001EF426C0B71

GetUserDefaultLCID.KERNEL32 ref: 000001EF426CFCEC

Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0AFE
Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0B0F
Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0B20
Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0B90
Part of subcall function 000001EF426C0A8C: FlsSetValue.KERNEL32 ref: 000001EF426C0BB8

EnumSystemLocalesW.KERNEL32 ref: 000001EF426CFCD3
ProcessCodePage.LIBCMT ref: 000001EF426CFD16
IsValidCodePage.KERNEL32 ref: 000001EF426CFD28
IsValidLocale.KERNEL32 ref: 000001EF426CFD3E
GetLocaleInfoW.KERNEL32 ref: 000001EF426CFD9A
GetLocaleInfoW.KERNEL32 ref: 000001EF426CFDB6

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 4295e4083413dad5808854ef18516a2368b6283cff0b42a770a4a29eef910232
Instruction ID: eaf7492a414a433003a7dd0c39a1301c88997b6f66e698716f48fd5bda2a2448
Opcode Fuzzy Hash: 4295e4083413dad5808854ef18516a2368b6283cff0b42a770a4a29eef910232
Instruction Fuzzy Hash: C6715B3A7006948AFF50AF6AD8507EE33B4BB48F84F44403E8E1A576D5EBB8D946C750

Function 000001EF42685220 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426853D0
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF426853DE
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF4268566D
__std_exception_destroy.LIBVCRUNTIME ref: 000001EF4268567B

Strings

value, xrefs: 000001EF426852F6, 000001EF4268559D

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 277beaf352b31b4d0d3d828c02e60a3fce9f26938f758eb894fda72d55532b21
Instruction ID: 25690cfc0e1e9b1459842f8527cb6759df45a58a7bfd93215fa89f3966da152f
Opcode Fuzzy Hash: 277beaf352b31b4d0d3d828c02e60a3fce9f26938f758eb894fda72d55532b21
Instruction Fuzzy Hash: E9028F36625BC485FB00CB78D4403DE6761F795BA4F50523AFE9D52AEADF68C186C700

Function 000001EF4265AE00 Relevance: 8.4, Strings: 6, Instructions: 913COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF4265BE7E
filename, xrefs: 000001EF4265B97B
files, xrefs: 000001EF4265BC5F
key, xrefs: 000001EF4265B3CA, 000001EF4265B5A9
content, xrefs: 000001EF4265BAF4
directory_iterator::directory_iterator, xrefs: 000001EF4265BE63

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: 41a8fa66e4abc17a954fa07cc38f8ac1cafb1bb88dcdb28945a4642fabc61d7a
Instruction ID: f70f1ec79b5b882a89f95c9c2fd6cb962f96d453dcb6bbe2a0aef482f8b0dbff
Opcode Fuzzy Hash: 41a8fa66e4abc17a954fa07cc38f8ac1cafb1bb88dcdb28945a4642fabc61d7a
Instruction Fuzzy Hash: 75A26E76615BC489EB218F24E8803DE73A5F789BA8F505229EE9C07BD9DF74C285C740

Function 000001EF426BB7B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000001EF426BB81A
memcpy_s.LIBCPMT ref: 000001EF426BB845

Strings

, xrefs: 000001EF426BB978

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: 9d5adaa54e2690338b274642db5e87e49e2c2e6c581e7171550ae7f1825bc8b3
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 79C1B3766156D587EB64CF19E088BAEBB95F388B84F449139DF4643B84DB38D906CB00

Function 000001EF42659A59 Relevance: 7.3, Strings: 5, Instructions: 1060COMMON

Download Yara Rule

Strings

filename, xrefs: 000001EF42659C97, 000001EF42659F83, 000001EF4265A7A8
status, xrefs: 000001EF4265AD9F
content, xrefs: 000001EF42659CF9, 000001EF42659FDF, 000001EF4265A87B
users, xrefs: 000001EF4265A319
!, xrefs: 000001EF4265A66F

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: !$content$filename$status$users
API String ID: 3645842244-3795777748
Opcode ID: 043453ad068da4fa2b6b7bc3aa422420dcdff17dc65a30ae333cf116283caa64
Instruction ID: 77d7d47e3fd171608feeafa7bf67c8c2ef687e5325844ccc1cc5747a29444d99
Opcode Fuzzy Hash: 043453ad068da4fa2b6b7bc3aa422420dcdff17dc65a30ae333cf116283caa64
Instruction Fuzzy Hash: E5B26976211BC489FB219F24E8903DE2365F785B88F405239EE9D4BADAEF64C685C740

Function 000001EF426DDC60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF426DDCC1
IsDebuggerPresent.KERNEL32 ref: 000001EF426DDCD9
OutputDebugStringW.KERNEL32 ref: 000001EF426DDCEA

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000001EF426DDCE3

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 5c7395dc388ac93676d6db0d40de6010577d7fa9f7f31d3abeba2b9718ad71c6
Instruction ID: c480994263f888f0cc7e5f42e0b4626db8933505b99453af4362b3522ab44438
Opcode Fuzzy Hash: 5c7395dc388ac93676d6db0d40de6010577d7fa9f7f31d3abeba2b9718ad71c6
Instruction Fuzzy Hash: 9A114C3A310B8496FB049B22E6543EE32A4FB08B44F804139CE4982AD1EF78D5B6C750

Function 000001EF42693670 Relevance: 6.9, Strings: 5, Instructions: 630COMMON

Download Yara Rule

Strings

[required], xrefs: 000001EF42693F81
[nargs=, xrefs: 000001EF42693ED7
or more] , xrefs: 000001EF42693ECE
[default: , xrefs: 000001EF42693F44
[nargs: , xrefs: 000001EF42693E92, 000001EF42693EB3

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: or more] $[default: $[nargs: $[nargs=$[required]
API String ID: 0-2670406794
Opcode ID: f5dea1e844c0fb500a72ac8b4ec5dd80bf6984e65d7b1b4015866c2c26992c97
Instruction ID: a796325baa0d9b2e01a803368ddcaa52838951afe96a761154994c9f446fec9a
Opcode Fuzzy Hash: f5dea1e844c0fb500a72ac8b4ec5dd80bf6984e65d7b1b4015866c2c26992c97
Instruction Fuzzy Hash: FF526C7A610BC081FB14CB69E4843DEA761E785BA4F50423AEE9D07BE9DF38C596C740

Function 000001EF426BFBD0 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000001EF426BFC20
GetSystemInfo.KERNEL32 ref: 000001EF426BFC37
VirtualAlloc.KERNEL32 ref: 000001EF426BFCA4
VirtualProtect.KERNEL32 ref: 000001EF426BFCBE

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: d8d05873cc0ad23a6227d848cec7d083f47c87653e05dd80255be0592c12f254
Instruction ID: 31b5080de495ec02d928fa02d3e47256cb744f1378929ab4ab8496612fe80c9e
Opcode Fuzzy Hash: d8d05873cc0ad23a6227d848cec7d083f47c87653e05dd80255be0592c12f254
Instruction Fuzzy Hash: A9315A36310A948AEB10DF35D8807DE37A5F748B88F44403AAE0E8BB98DF78D646C740

Function 000001EF426D5CD8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001EF426D5D04
GetCurrentThreadId.KERNEL32 ref: 000001EF426D5D12
GetCurrentProcessId.KERNEL32 ref: 000001EF426D5D1E
QueryPerformanceCounter.KERNEL32 ref: 000001EF426D5D2E

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2ac89b5fea08dda77e100734bc6dd1b2318c7a5e5bcdef592d09e1a64040e310
Instruction ID: 5e12c1a1dbd245aadc26c5b8e55ae9c35f535de36d2e4e8f3e0fdec95f08af00
Opcode Fuzzy Hash: 2ac89b5fea08dda77e100734bc6dd1b2318c7a5e5bcdef592d09e1a64040e310
Instruction Fuzzy Hash: 2B11183A710F458AFF00CB60E8553AD33A4F359B58F451A39EE6D467A4EB78C6958380

Function 000001EF42697C20 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 416COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000001EF42697C83
ShellExecuteW.SHELL32 ref: 000001EF426982EB

Strings

--type, xrefs: 000001EF42698395

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID: --type
API String ID: 1703432166-2654721227
Opcode ID: 7c7f5049880875eb2292e0007a315c7042f1ae5c29f078fb8ba1c90f8d69b7af
Instruction ID: 786e1c99e0c15b67cb62131c2574035f5e8f410140d499bf61d25d0629c73ad0
Opcode Fuzzy Hash: 7c7f5049880875eb2292e0007a315c7042f1ae5c29f078fb8ba1c90f8d69b7af
Instruction Fuzzy Hash: 88223D36625FC48AEB408F29E88169EB3A4F388B94F505229FEDD57B58EF38C155C740

Function 000001EF42689600 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 363COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001EF4268985A

Strings

parse_error, xrefs: 000001EF4268968C
value, xrefs: 000001EF4268A536

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: de7e5360d9ace201dbf201bebf4f21a68ae465562baf7a623104fd948dd83d75
Instruction ID: 10b332079b37501c84c63a6fddb6d50c4dfd995c738a45f66e24952301bf2df0
Opcode Fuzzy Hash: de7e5360d9ace201dbf201bebf4f21a68ae465562baf7a623104fd948dd83d75
Instruction Fuzzy Hash: E3F1BC36B11AC495FB00DB74E4513EE2321E795B98F80563AEE5D57ADAEF38C286C340

Function 000001EF4265BEE0 Relevance: 5.6, Strings: 4, Instructions: 608COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF4265C96C
filename, xrefs: 000001EF4265C494
content, xrefs: 000001EF4265C653
directory_iterator::directory_iterator, xrefs: 000001EF4265C988

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: 54189642c5f67997f9ac76bf0833c963489e2676de0e34a0e0da73980b7821e8
Instruction ID: 07c162680ae1c431208b1106e7dd9c13513bbeeffca36472eaa684ece930382a
Opcode Fuzzy Hash: 54189642c5f67997f9ac76bf0833c963489e2676de0e34a0e0da73980b7821e8
Instruction Fuzzy Hash: 15524A76615BC489FB208F28E8803DE73A1F789B98F505229DE9D07BA9DF74C685C740

Function 000001EF426C9EBC Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426CA307
_get_daylight.LIBCMT ref: 000001EF426CA3A7
_get_daylight.LIBCMT ref: 000001EF426CA3C0

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 20148c59f3cedddde97dec1afec30bde424f88cecf64a6ad21c9f4eb1ed6792b
Instruction ID: b9e8c9038110d7e514031bf7d5d3d48dbbc06fc4d8f0ba3f30ad1a4271a3a3db
Opcode Fuzzy Hash: 20148c59f3cedddde97dec1afec30bde424f88cecf64a6ad21c9f4eb1ed6792b
Instruction Fuzzy Hash: 66928C3A2046D086FB24AF2AD5542AF37A5F755B98F148139EE8A07BD9DB39CD02C740

Function 000001EF426948A0 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

--version, xrefs: 000001EF42694BE5
--help, xrefs: 000001EF42694AD4
shows help message and exits, xrefs: 000001EF42694B7B
prints version information and exits, xrefs: 000001EF42694C8C

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: --help$--version$prints version information and exits$shows help message and exits
API String ID: 118556049-1172229024
Opcode ID: 84151ff836e306b6faffd43eb2c63fa74719e0d000bf09be06ef8349b6f5a6ae
Instruction ID: ace840316ce424498421efe193656d3e6c65641e22c3198c7aa4433db18151a5
Opcode Fuzzy Hash: 84151ff836e306b6faffd43eb2c63fa74719e0d000bf09be06ef8349b6f5a6ae
Instruction Fuzzy Hash: F9226736614BC085E710CF24E8907DE77A4F798B48F549229DE8C137A9EF78C69AC740

Function 000001EF426DB634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 000001EF426DB65A
FormatMessageA.KERNEL32 ref: 000001EF426DB689

Strings

!x-sys-default-locale, xrefs: 000001EF426DB64D

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 524e3a65a531c01bd4bfd41e549e365538079e1841d07b699c799e17f4840897
Instruction ID: af752e0fff58825949c2b14aefb29e0a247199d952dcdf8c2ce20be6c264edff
Opcode Fuzzy Hash: 524e3a65a531c01bd4bfd41e549e365538079e1841d07b699c799e17f4840897
Instruction Fuzzy Hash: 62015E7A7147C482FB608B11F4447AEB7A6F389B94F944139EE5942BD8CB3CC546C700

Function 000001EF42690616 Relevance: 4.1, Strings: 3, Instructions: 329COMMON

Download Yara Rule

Strings

port, xrefs: 000001EF42690B84
zMut1x64mp6RhEXWERGBS8enkn7eRQxOHwdmjOSv4uo=, xrefs: 000001EF426906CC
TCnS9XVWWhc=, xrefs: 000001EF42690754

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: TCnS9XVWWhc=$port$zMut1x64mp6RhEXWERGBS8enkn7eRQxOHwdmjOSv4uo=
API String ID: 0-365269082
Opcode ID: e29de248f7c1958537b5f32c851dcc3b5171874ead154d5cc5a2e110e1360e03
Instruction ID: 5203488531c5f0d54688d4c1a39113389d8553a5bc940b30f3e288e2a93489b3
Opcode Fuzzy Hash: e29de248f7c1958537b5f32c851dcc3b5171874ead154d5cc5a2e110e1360e03
Instruction Fuzzy Hash: 62E1AF76614BC481FB10CB68E4403DEA361F795B94F505239EE9D13AEAEF78C286CB40

Function 000001EF42657ED0 Relevance: 3.9, Strings: 2, Instructions: 1358COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF426595E3
Software, xrefs: 000001EF42658344, 000001EF42658530

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 77dd246d953cc4255eb42fbb08d6393ffa51a5468697cc410eb9a39d7fbeed09
Instruction ID: c1f82d5e04139b820afaac5add5d03f114647661c2a0ec556069a624cf2fd210
Opcode Fuzzy Hash: 77dd246d953cc4255eb42fbb08d6393ffa51a5468697cc410eb9a39d7fbeed09
Instruction Fuzzy Hash: ABE26976611BC48AFB208F29E8843DE6360F799B98F105629EE9C57BD9DF74C681C340

Function 000001EF426C4A5C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000001EF426C4AD0

Strings

GetLocaleInfoEx, xrefs: 000001EF426C4A78, 000001EF426C4A89

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 48c8ba2ab909c589d8f3a54eaaeee6d023891dddf4428f91815a6c587b1413cc
Instruction ID: 3d8e8d72e257eefa9e045d502c3a4e5ff10e03197b8f30dbde9b34639370bfb8
Opcode Fuzzy Hash: 48c8ba2ab909c589d8f3a54eaaeee6d023891dddf4428f91815a6c587b1413cc
Instruction Fuzzy Hash: FC018F79704AC485FB449B96F4002CFA661F788FC0F594039AE1907BE9DE38CA428380

Function 000001EF4266C4E0 Relevance: 3.3, APIs: 2, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3815ae4b980ca2ca5b80eda8ab2ad6c9c07865e2a1e5498f8d55100df03d905e
Instruction ID: 086b0deee200ed683ff4ae2d9442677db9aadc4656b7fc2ad75799c13bbac4be
Opcode Fuzzy Hash: 3815ae4b980ca2ca5b80eda8ab2ad6c9c07865e2a1e5498f8d55100df03d905e
Instruction Fuzzy Hash: CD917DBA211BC882EE14CB15E9542AE67A5F798FC0F54803AEE8D477A5EF38C552C700

Function 000001EF426C85DC Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000001EF426C882B
RaiseException.KERNEL32 ref: 000001EF426C883C

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: d3f8887b7b8b3517747a6c22ca831dda960a01a1d0f15fe4b7d9d18be4f800f7
Instruction ID: 5918954476e7445be677b134f43162eb0f2390a5b638a484911cad50ff31543a
Opcode Fuzzy Hash: d3f8887b7b8b3517747a6c22ca831dda960a01a1d0f15fe4b7d9d18be4f800f7
Instruction Fuzzy Hash: 13B1E57B611B848AFB669F2EC88639D77A0F344F88F158925DE5D87BA4CB39C452C700

Function 000001EF42657C80 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000001EF42657D0D
LocalFree.KERNEL32 ref: 000001EF42657D9F

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: bf70f901019ba12ee939ceb6f6214486e9ba4c8e66f2e252ede663adaf65882e
Instruction ID: 33ebf2a561503d7ac9d67cea6d497681caf971fff57284edbcf2fa410f8024d3
Opcode Fuzzy Hash: bf70f901019ba12ee939ceb6f6214486e9ba4c8e66f2e252ede663adaf65882e
Instruction Fuzzy Hash: 3B616B36B14B809AFB10DF74E4543DE73A1E759B8CF008239EE8916ECADB78C5A58344

Function 000001EF426518F0 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

emoji, xrefs: 000001EF42651997
dumps, xrefs: 000001EF4265196C

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CriticalEnterSection
String ID: dumps$emoji
API String ID: 1904992153-2873254224
Opcode ID: af5e00edc683e798e95ca524ca1326853961cc7b661e75e6756fbd160508775d
Instruction ID: 61b6d09c2b521d55ec73820e483e6df37dbf9bd3fad9ee57f138d2beb869e837
Opcode Fuzzy Hash: af5e00edc683e798e95ca524ca1326853961cc7b661e75e6756fbd160508775d
Instruction Fuzzy Hash: 7EC13C3AA01B84C9F700CF75E9812DE37B1E759B88F415269EE5C27B99EB34D1A2C344

Function 000001EF426C6FDC Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 000001EF426C7166
e+000, xrefs: 000001EF426C70E9

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 16b9f135646a10dd93220f541999e2ea7f0cca35493ca8ef993a0cfef2357b1c
Instruction ID: 28e857bce2f1c0981dc8c928d697e72796d3a4d0a251c4830da131afd0d04f42
Opcode Fuzzy Hash: 16b9f135646a10dd93220f541999e2ea7f0cca35493ca8ef993a0cfef2357b1c
Instruction Fuzzy Hash: 1A51577A7142D486F7259E3AD80079E7B95E345FA4F08C279CFA487BC5CB39C0468700

Function 000001EF42676F70 Relevance: 2.0, APIs: 1, Instructions: 460COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42676FEA

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2858a2d810c5d16a038b0b23ead3b7fce177ee4bf59ab96235eb13276e614d25
Instruction ID: 7cbf8df01cbdc74d6aacd2c9f84d1dcd15205f98fb43d5d3043d6e4864e0d999
Opcode Fuzzy Hash: 2858a2d810c5d16a038b0b23ead3b7fce177ee4bf59ab96235eb13276e614d25
Instruction Fuzzy Hash: AA02887A711BC485FB11CB65E4603DE63A1E788B98F14823ADEAD177D9DE34C492C380

Function 000001EF42696720 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

-, xrefs: 000001EF426969E1

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: bd11874fdc59d20925f1fc9654754cb7ab8c786ee38e3396a588a28a7654fc18
Instruction ID: e0db24f6bfd91460b5ba1f45cc3d27ee55b94d1f24c55aab115cd0dd67814647
Opcode Fuzzy Hash: bd11874fdc59d20925f1fc9654754cb7ab8c786ee38e3396a588a28a7654fc18
Instruction Fuzzy Hash: 9522333A614BD086EB10CF29E8403DE67A5F749B98F54462AEE9D17BD9EF34C592C300

Function 000001EF42698980 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

%, xrefs: 000001EF42698F8E

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: d55b036532c891ca09a3deb474e2cf5785d2ffa3857ba137405e233f12dac90c
Instruction ID: a5304ed6728025b1339184c72df0c21e43a538d8e060cacc567780541a94eef3
Opcode Fuzzy Hash: d55b036532c891ca09a3deb474e2cf5785d2ffa3857ba137405e233f12dac90c
Instruction Fuzzy Hash: D412F036714AC48AFB258B69D4503EE77A1EB54B88F44413AEE4D27BC9DF38C546C740

Function 000001EF4268DBD0 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268DEEC

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ce6420c4d04a0fe96625aeb9a715c5e061a1ef034888a1cb16f3a0d50e60645b
Instruction ID: 52cb44c2e823b25cad25fba093b572c0b10fe04d09b45f8a0c9273d982aec06a
Opcode Fuzzy Hash: ce6420c4d04a0fe96625aeb9a715c5e061a1ef034888a1cb16f3a0d50e60645b
Instruction Fuzzy Hash: 35A15836616B9889FB00CBB9D4843ED3770F359B48F54852ADF8997B99DB38C192C390

Function 000001EF4268D590 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268D8A4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: befd39ce9c16a882e63783290c6ed6883a33189ba1b74a57d8bcd32ab303fc76
Instruction ID: af04f2e68f383d90f91b5902eb4432b1ca8493997e6d519f1c21fb617785f614
Opcode Fuzzy Hash: befd39ce9c16a882e63783290c6ed6883a33189ba1b74a57d8bcd32ab303fc76
Instruction Fuzzy Hash: C1A15676616B9889FB00CBB9D4803ED27B0F359B48F54852ADF8D97B99DB38C092C350

Function 000001EF4268D8B0 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268DBC4

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3385634120feb312b940f20433d6ccba510a8324adb36212ce1dd2450b4516d7
Instruction ID: e917815de94af7f288bce2673ebc32123005003aa8546c44e646e0f469390c74
Opcode Fuzzy Hash: 3385634120feb312b940f20433d6ccba510a8324adb36212ce1dd2450b4516d7
Instruction Fuzzy Hash: 0EA15576616B9889FB00CBB9D4803ED77B0F359B48F54852ACF8997B99DB38C192C350

Function 000001EF4268D260 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268D589

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6984bc12ee70109b5625062afeaa56f6819c6c30e71561ed82d7f8c24550cf89
Instruction ID: 738b6ab616f543cab96a454ebd441503f296860fdee699bb2899fb673dab2a3f
Opcode Fuzzy Hash: 6984bc12ee70109b5625062afeaa56f6819c6c30e71561ed82d7f8c24550cf89
Instruction Fuzzy Hash: 5EA18836616B9889FB00CBB9E4803ED27B1F359B48F54812ADF8D97B95DB38D092C350

Function 000001EF4268CF60 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268D258

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4b656beb08595d991fb0336bbc2fb804b8bf5e509da0a7c9515e73fa1bbb1177
Instruction ID: c7f625eb270a9f4182573a9639856fa532c599cbfcb28a0e1b55ed7c54ee89ee
Opcode Fuzzy Hash: 4b656beb08595d991fb0336bbc2fb804b8bf5e509da0a7c9515e73fa1bbb1177
Instruction Fuzzy Hash: D8A18776702B9889FB01CBB9D4903ED27B0F759B48F54842ACF8997B99DB38C096C350

Function 000001EF4268DF00 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4268E1F8

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c063662b0a8d01b3703fcb861c1a03b3a9c58fa20304269b4e77c702f5f25076
Instruction ID: 59a8fd134826e0d3701660957c45974f1d5fb96ec96156c9b2fbef8d00d97b28
Opcode Fuzzy Hash: c063662b0a8d01b3703fcb861c1a03b3a9c58fa20304269b4e77c702f5f25076
Instruction Fuzzy Hash: 77A15776702B9889FB04CBA9D4803EE67B0F355B48F54842ADF8D57B99DB38C096C350

Function 000001EF426E3570 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000001EF426E35D3

Part of subcall function 000001EF426DE2CC: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426DE2E0

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 0f622ff60f30d3780f80892d390401e18fc4cc141069fbff87909c5ebbf4c4d7
Instruction ID: 007c39e860244c1956198adae84068033f55524d6c8b99a83a349c506ef19214
Opcode Fuzzy Hash: 0f622ff60f30d3780f80892d390401e18fc4cc141069fbff87909c5ebbf4c4d7
Instruction Fuzzy Hash: F36103BA7042D046FB609A2DC8457FFF691AB90F60F65023DDE2D8BBC5E675C8528B04

Function 000001EF426CF494 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF426C0A8C: GetLastError.KERNEL32 ref: 000001EF426C0A9B
Part of subcall function 000001EF426C0A8C: FlsGetValue.KERNEL32 ref: 000001EF426C0AB0
Part of subcall function 000001EF426C0A8C: SetLastError.KERNEL32 ref: 000001EF426C0B3B

EnumSystemLocalesW.KERNEL32 ref: 000001EF426CF532

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: cc2bc9e5fcae19234eddfb96daa48b4922628108c99e4c85fcc2e58e09fc0afd
Instruction ID: 5d801944cfd7f6ae175b092d06629a94c3d14cbb4bfa04d5d8529dd423aed171
Opcode Fuzzy Hash: cc2bc9e5fcae19234eddfb96daa48b4922628108c99e4c85fcc2e58e09fc0afd
Instruction Fuzzy Hash: 6A11907B6046848AFB259F6AE4407EE77A1F390FA0F54813ACE6A433D1DA74C6D2C740

Function 000001EF4267AF00 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

., xrefs: 000001EF4267B200

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 85136bda89da37cc26caece32c6c21c2887fcd92db932eb8f0fc37ace65eb707
Instruction ID: 046357c072cf449e56694bec38addcd4f789ae9f95ac7516aaa28ef800756531
Opcode Fuzzy Hash: 85136bda89da37cc26caece32c6c21c2887fcd92db932eb8f0fc37ace65eb707
Instruction Fuzzy Hash: 4BC1943A200BC486FB608B26E4A43EF63A5F799F94F554239EE99437C4DB78C842C740

Function 000001EF426CF564 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF426C0A8C: GetLastError.KERNEL32 ref: 000001EF426C0A9B
Part of subcall function 000001EF426C0A8C: FlsGetValue.KERNEL32 ref: 000001EF426C0AB0
Part of subcall function 000001EF426C0A8C: SetLastError.KERNEL32 ref: 000001EF426C0B3B

EnumSystemLocalesW.KERNEL32 ref: 000001EF426CF5E2

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 2d81400be64530b408a616b22bdcfe61cbf2ce0941f0ce553624850de7d5f966
Instruction ID: 05583cc258f2595ef41c84b3165e52520015d764b42c3ded6fdb770e55067e4b
Opcode Fuzzy Hash: 2d81400be64530b408a616b22bdcfe61cbf2ce0941f0ce553624850de7d5f966
Instruction Fuzzy Hash: 3101B17A7042C08AFB246F1AE4407EE76E1E754FA4F85823FDF66472C4DBB588828700

Function 000001EF426C4518 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000001EF426C4567

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 01640a15c2b896cce9415d7a2c1ad7323f2ceef46adc31f8481a253780bbeb1f
Instruction ID: dcef55af1a7e8efc6594cc796384e7eb621036a718c5704fe4f4e08fdbeb2057
Opcode Fuzzy Hash: 01640a15c2b896cce9415d7a2c1ad7323f2ceef46adc31f8481a253780bbeb1f
Instruction Fuzzy Hash: 0EF0197A300B8486F704DB1AF8A02DA7365E798B80F548139EE59833A9DF3CC5528744

Function 000001EF426C6B2C Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 000001EF426C6E8B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 47307880288f6578f87132817073c4c2bb16437997dd627ef4aa9327bb89f433
Instruction ID: 4cf311156e45e6ea15e0da4039cfcafb4c1d09d1989621a92fc7e849b4bb8d7b
Opcode Fuzzy Hash: 47307880288f6578f87132817073c4c2bb16437997dd627ef4aa9327bb89f433
Instruction Fuzzy Hash: E3A120B67086C486FB21DB2BE4147EE7BA1E794B84F04813ADE8A477C5DA3DD506C701

Function 000001EF426BDABC Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 000001EF426BDCA2

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 3fac53d13e13ef411f149e61d5ad2ea6a8a0273fbc02724b4dee553905c8a803
Instruction ID: 5070f39fac3ff87026f8490ee193fe1173375783c13bca8e3f730b7b150a4f1e
Opcode Fuzzy Hash: 3fac53d13e13ef411f149e61d5ad2ea6a8a0273fbc02724b4dee553905c8a803
Instruction Fuzzy Hash: 45B15C7A2057A486F7658F29C0543AE3FA4E34AF48F28113DCE8A8B3D5CB75C452D745

Function 000001EF42646770 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18da238b07a0ebc974b164faf5863a0583fbf0d292bd4026ef9776cb3d9bdbc8
Instruction ID: e65f3d16e217d1e8079468945ea700cd468ab84d687dda86827d7f011d42fa5b
Opcode Fuzzy Hash: 18da238b07a0ebc974b164faf5863a0583fbf0d292bd4026ef9776cb3d9bdbc8
Instruction Fuzzy Hash: 93A2E676915FC88AE7718F25E8412DEB7A4F799788F105325EECC16B59EB38C290CB04

Function 000001EF42649760 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b80ee918309789f27c25cf6667dc3834edfa87cdd98f09b5f7e8a02fcdc8cc6
Instruction ID: 40debc8afc121689d8b84a58511e48587e18b972ec4fb8f2552cbf9cd2c4e570
Opcode Fuzzy Hash: 4b80ee918309789f27c25cf6667dc3834edfa87cdd98f09b5f7e8a02fcdc8cc6
Instruction Fuzzy Hash: D6B24C36505FC88AD7768F29EC813DA73A8F359B8CF105229EB8C5AB1DEB7483549344

Function 000001EF426DE980 Relevance: .6, Instructions: 634COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ab6b828ca45922997960b2700f7132280dcbffacc02f99c9a46b6be60a2307
Instruction ID: ba6eb10e6fc05dfc52548820011b25d9b152fe726b2c183dcc8cce1df07894a0
Opcode Fuzzy Hash: c4ab6b828ca45922997960b2700f7132280dcbffacc02f99c9a46b6be60a2307
Instruction Fuzzy Hash: 89629539561ED485F6538F75F8217DF2364BB52BC4F81933BEC0AA76D2DB6886478200

Function 000001EF42626900 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec697646bdb82ce0403ce05b3763589ae77f0ad4dbd104229c740a268aa344e
Instruction ID: b8a52801dcf3c4f333b9f16decf08bf4edb253f2134aa309e86f11c5fb06441f
Opcode Fuzzy Hash: 5ec697646bdb82ce0403ce05b3763589ae77f0ad4dbd104229c740a268aa344e
Instruction Fuzzy Hash: 5F12D736515FC88AE7618F29E84129EB3A4F39D788F505329EECC57B59EB38C251CB04

Function 000001EF426477B0 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82b60d2afc0accdeaa57018255e3df9322a0691b3dde4f10bd752856509a6d9
Instruction ID: 75a13f3a3800a197ab3137c7ac68f4d418b5037e1dd9147471b0017dd7e4c272
Opcode Fuzzy Hash: e82b60d2afc0accdeaa57018255e3df9322a0691b3dde4f10bd752856509a6d9
Instruction Fuzzy Hash: 1202C036915BC88DE7228F79EC513D977A4F799788F105229EF9C2AB59EB308291C340

Function 000001EF426C14C4 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: c66ea7107ae49125be2e0e859b5531f8e6a5d4408c1d7c3fffd7cbe2f594ebe3
Instruction ID: b336458bcaa2c7582deb9a6149b2549fd472b6744f4f496c558a26e32ca48869
Opcode Fuzzy Hash: c66ea7107ae49125be2e0e859b5531f8e6a5d4408c1d7c3fffd7cbe2f594ebe3
Instruction Fuzzy Hash: B5C1717A6046C085FB64AB6BD4107EF67A0F794F88F54407ADF8A87AD9DB38C546CB00

Function 000001EF426BDE4C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe90b98dee0fbd136a3e0445fcca9a6cf415a7f82714603e19f90025ae666bb
Instruction ID: 02cddba2f47493b944ab390cecd7e4c631136179683e8cfd2743c12bcabeea96
Opcode Fuzzy Hash: abe90b98dee0fbd136a3e0445fcca9a6cf415a7f82714603e19f90025ae666bb
Instruction Fuzzy Hash: 39B1697A218BE486F7698F29C4546AE3FA4E31AF48F68413DCE4A4B3D5CB35C452C744

Function 000001EF4269EFD0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9e994aed22eaa20e0b7beffa745376c50195056a54465cab9adc9d408399e5
Instruction ID: 4620c2af9aa6db16bda975d9382b6f3be7af282a8928090f8346b1bb7a0ee227
Opcode Fuzzy Hash: 4b9e994aed22eaa20e0b7beffa745376c50195056a54465cab9adc9d408399e5
Instruction Fuzzy Hash: 44A1BF3A614BC482FB04CB15E1583AE67A1F395B84F468139EF8D06AD6EFB8D0D28740

Function 000001EF4268FE50 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94abd17858a29da6604f084abc8ede15cb37ad89f40817780fbb3ade52cfd43
Instruction ID: 18665d141066e4becd30eae3fb6a8e25bb9e0a18719d31e35f7ad566e1282d0a
Opcode Fuzzy Hash: b94abd17858a29da6604f084abc8ede15cb37ad89f40817780fbb3ade52cfd43
Instruction Fuzzy Hash: 279192B76246809FD354CF19E440A8ABBA4F3D8B48F51E615EF8593B14E739DA06CF40

Function 000001EF426DE500 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d8b6e9948bf886046abce2ca807a3885450278668685c356ff6ac48f71ed769f
Instruction ID: 3414908f039a36131e0d9ea24919a496a61aa2fe0db715e5db3e39a9fcceaf5a
Opcode Fuzzy Hash: d8b6e9948bf886046abce2ca807a3885450278668685c356ff6ac48f71ed769f
Instruction Fuzzy Hash: CA819D7A210A9486FB64DE29C4813EE27A0F788F98F14463AEE1E877C5DF34C452C740

Function 000001EF426C765C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832f80e29b9e7b1fab9976971e49bf3aecb105820688ae36005b75dbd0afb97c
Instruction ID: a20469049e7b909a87b19813d367d9e6f153796bec4df2c15253d7b62c12ae2c
Opcode Fuzzy Hash: 832f80e29b9e7b1fab9976971e49bf3aecb105820688ae36005b75dbd0afb97c
Instruction Fuzzy Hash: D881B17A2087C446FB65EB2ED4403AF6A95F38AB94F544279EE8943BD9DA39C5018B00

Function 000001EF4266CB90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction ID: f9b8e8c1065e58090f9cd4b3fb158b265d657794b2f6f67e3f510ad8476461bd
Opcode Fuzzy Hash: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction Fuzzy Hash: 1761E0B6711EC882FE208F69D0496EE6361FB58B94F458239DF5E477D4EA38D182CB00

Function 000001EF426A0CA0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5476a5d4dfa7c17c5a822486a56d63c0ddaf429a2d9320a3bc2b5e34af6aecf
Instruction ID: 28e03d96b9c1577171363d530e427ef576276680d0fc83b210de248b5c0c1864
Opcode Fuzzy Hash: d5476a5d4dfa7c17c5a822486a56d63c0ddaf429a2d9320a3bc2b5e34af6aecf
Instruction Fuzzy Hash: 4E51E6B3B056C443DB248B49F842796F7A5FB987C5F00A12AEE8D57B59EB3CD5818700

Function 000001EF426BD474 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction ID: 57e8005d213dc1c36d2aa36d9c5d3d1bedcc2d97eed7383f977d0eb9ddf63b17
Opcode Fuzzy Hash: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction Fuzzy Hash: 2751567B6046A082F72C8F28C1543AE2BA1E755F58F254139DF4A9B7D9CB21EC82C780

Function 000001EF426BD28C Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a4a0272fcb28be4f4c2347f47eb615663c13edcd1074745415d1c72bb9a049
Instruction ID: f283b974de0f84a19f96528b8da9ec347a2441229b5f4f95398ddc0f1079d054
Opcode Fuzzy Hash: 09a4a0272fcb28be4f4c2347f47eb615663c13edcd1074745415d1c72bb9a049
Instruction Fuzzy Hash: 04516C7AA146E086F76C8F28C0943AE2BA0E755F58F154139CF499B7D9CB35DC82C780

Function 000001EF426C7D88 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 5b78d8d41b5d0f6e4f08b9d114e760a48ea03ae90982f10338adbf08b6b3b369
Instruction ID: ebe782fd9aaa52a3aa18c8b63c61254cf28e5363f2eb6a6292d4625c340e79a1
Opcode Fuzzy Hash: 5b78d8d41b5d0f6e4f08b9d114e760a48ea03ae90982f10338adbf08b6b3b369
Instruction Fuzzy Hash: 2B41A47A310A9442FF44CF2AD96429EB395B758FD4F49903AEE0D97BA8DB3CC5428740

Function 000001EF426F86B0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fcce673cd0a5fe32b887e6096d7c87d3475f82e3d1c1d883b21b78ca9552aee
Instruction ID: 1c7aca147cf2cf1a31c837e5f3a58b000dab152a03c68341e60d10681b59d833
Opcode Fuzzy Hash: 0fcce673cd0a5fe32b887e6096d7c87d3475f82e3d1c1d883b21b78ca9552aee
Instruction Fuzzy Hash: 5431D86B65E7C50FE7535E75886518D3FB1A392E60B9B80ABCB90C32C3E54D0D4A8722

Function 000001EF426F86D8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d55f541aef7e377e73f53204a08f3786d46aea4defc0619dd5cb7b2e9a8d50
Instruction ID: c828a4054535c82f210c04a89ee1046c32317209d91b2fdf55b0c7a939b1ef43
Opcode Fuzzy Hash: b3d55f541aef7e377e73f53204a08f3786d46aea4defc0619dd5cb7b2e9a8d50
Instruction Fuzzy Hash: BA31C56B65E3C60FE7535F75886518D3FB1A392E6079B80ABC780C32C3E58D0D5A8722

Function 000001EF426F86B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction ID: 3fa8b755852ecd939852fbd8be88f905bb1568a3c9008cffb4e5a33634bf9e22
Opcode Fuzzy Hash: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction Fuzzy Hash: A301966F60E6C80BFB524A25886968E2F60A756F00F5F80FEDF94872C3E54909164716

Function 000001EF426F86A8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction ID: 55ed9d1c91be1ae06d0bfe43e5daa911adfb33d6bacd42cf801c5c2d0780270d
Opcode Fuzzy Hash: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction Fuzzy Hash: DCC08C9F60A4C803F571420848192CC1B909722E10A5904ADCEA442182A00004030A13

Function 000001EF426C0A8C Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF426C0A9B
FlsGetValue.KERNEL32 ref: 000001EF426C0AB0
FlsSetValue.KERNEL32 ref: 000001EF426C0AD1
FlsSetValue.KERNEL32 ref: 000001EF426C0AFE
FlsSetValue.KERNEL32 ref: 000001EF426C0B0F
FlsSetValue.KERNEL32 ref: 000001EF426C0B20
SetLastError.KERNEL32 ref: 000001EF426C0B3B
FlsGetValue.KERNEL32 ref: 000001EF426C0B71
FlsSetValue.KERNEL32 ref: 000001EF426C0B90

Part of subcall function 000001EF426C446C: HeapAlloc.KERNEL32 ref: 000001EF426C44C1

FlsSetValue.KERNEL32 ref: 000001EF426C0BB8

Part of subcall function 000001EF426C3E04: HeapFree.KERNEL32 ref: 000001EF426C3E1A
Part of subcall function 000001EF426C3E04: GetLastError.KERNEL32 ref: 000001EF426C3E24

FlsSetValue.KERNEL32 ref: 000001EF426C0BC9
FlsSetValue.KERNEL32 ref: 000001EF426C0BDA

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: dfcad310d852e31f33dd7f73df7f72617e44ec87b78e0b9db9e9057294b51c51
Instruction ID: 53b3ec7c44b846db634156934cd5269f2c9cabf767d7ad96e87a362229dbf071
Opcode Fuzzy Hash: dfcad310d852e31f33dd7f73df7f72617e44ec87b78e0b9db9e9057294b51c51
Instruction Fuzzy Hash: 75415C3C3452D046F969F36FDA623EF62425B98FB4F14473D9C3A076D6EE2A98038601

Function 000001EF4266FD10 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 213COMMON

Download Yara Rule

Strings

No closed word, xrefs: 000001EF426713E7, 000001EF4267140A
key opened, but never closed, xrefs: 000001EF4267147F
word wasnt properly ended, xrefs: 000001EF4267142D, 000001EF426714A8
key declared, but no value, xrefs: 000001EF42671337, 000001EF4267135A, 000001EF4267145C
quote was opened but not closed., xrefs: 000001EF42671314, 000001EF4267137D
object is not closed with '}', xrefs: 000001EF426712F1
unexpected '}', xrefs: 000001EF426714CB
unexpected key without object, xrefs: 000001EF426713BE

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: b203209c9a410fa3c9e7ebc25e85301b2d3c69517f250810da7f4034c69ff5f7
Instruction ID: 279ba9ef9793e599b21417be98efd64ecb43b521e8a4d335e9be4a8b4aa5accf
Opcode Fuzzy Hash: b203209c9a410fa3c9e7ebc25e85301b2d3c69517f250810da7f4034c69ff5f7
Instruction Fuzzy Hash: 44A1FC39610AC5A4FA50DF24E8803DF3764FB90788F905539AE49479EAEF78C79AC700

Function 000001EF4269C530 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4269C5AE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF4269C5F7
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4269C773
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4269C786
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4269C78C

Strings

bad locale name, xrefs: 000001EF4269C779
false, xrefs: 000001EF4269C67E
true, xrefs: 000001EF4269C6AB

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 11e8d511a48e08ce90acd3636057277e2d5df9c77179402747f8573727488067
Instruction ID: ba07c83639619a45e642351be4dee059de4fdcd6a61bf8adc45b8a27eab2048b
Opcode Fuzzy Hash: 11e8d511a48e08ce90acd3636057277e2d5df9c77179402747f8573727488067
Instruction Fuzzy Hash: EE71483A601B808AFB15DF70E8503EE37A5AB88B48F140539AE4967AEADF34D516D344

Function 000001EF426BBD74 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426BBDB8
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426BC190
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426BC43B

Strings

0, xrefs: 000001EF426BC1E0
p, xrefs: 000001EF426BBEE2
f, xrefs: 000001EF426BBEDA
p, xrefs: 000001EF426BBE6A

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 20a17dcc54312a4719634567cfff119de1b0c98f105182ac0e8ea3c8a1e1f82e
Instruction ID: 1283b3b1e6263e913399a819a79b61735602b988cf5340dd3ef0b798124f2b7a
Opcode Fuzzy Hash: 20a17dcc54312a4719634567cfff119de1b0c98f105182ac0e8ea3c8a1e1f82e
Instruction Fuzzy Hash: E312E23AA042E28AFB245E14D0547FF7A95FB90F54FC4413AEEA2476C4D738C7928B54

Function 000001EF4267BAF0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 251COMMON

Download Yara Rule

Strings

exists, xrefs: 000001EF4267E2B0, 000001EF4267E300, 000001EF4267E3DA, 000001EF4267E4BA
recursive_directory_iterator::operator++, xrefs: 000001EF4267E3A6, 000001EF4267E486
cannot use push_back() with , xrefs: 000001EF4267E34D, 000001EF4267E42D
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000001EF4267E3BD, 000001EF4267E49D
status, xrefs: 000001EF4267E2D7, 000001EF4267E31C, 000001EF4267E3FC

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-2518929327
Opcode ID: 6d40cf0fafc68378ddb55865f0b434e7a9f2ec20f6690fe2a727b709993f393c
Instruction ID: bfb81222150722de00d5a065a0f59fcb021676ec0b750d4abba2365ba604d332
Opcode Fuzzy Hash: 6d40cf0fafc68378ddb55865f0b434e7a9f2ec20f6690fe2a727b709993f393c
Instruction Fuzzy Hash: 79B16076155BC591F620AB24E4513DFA360F7C5B40F501939AECC43AEAEF38C646CB44

Function 000001EF426C4594 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000001EF426C4713
GetProcAddress.KERNEL32 ref: 000001EF426C471F

Strings

api-ms-, xrefs: 000001EF426C465D
ext-ms-, xrefs: 000001EF426C4670

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: fe487ba48e8b98e8da8f078ca9b00621851933d19320e8d2a4f77f7db0a80c87
Instruction ID: f5cdcd081e94650451bd5d4cf10e48755a7e2daab80bc5672967ce575c29828e
Opcode Fuzzy Hash: fe487ba48e8b98e8da8f078ca9b00621851933d19320e8d2a4f77f7db0a80c87
Instruction Fuzzy Hash: C941AC7A311A8081FE16EB1BE8147DF23A6BB55FE0F59413D9D1A8B7D8EA3CC4468350

Function 000001EF42691BD0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 000001EF42691C39
InternetOpenUrlA.WININET ref: 000001EF42691C6E
InternetReadFile.WININET ref: 000001EF42691C8F
InternetReadFile.WININET ref: 000001EF42691CCF
InternetCloseHandle.WININET ref: 000001EF42691CDC
InternetCloseHandle.WININET ref: 000001EF42691CE5

Strings

File Downloader, xrefs: 000001EF42691C32

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: b944f4b1975896e8d6ea4effe49ac60efb5815a951b87509e772666f8471c573
Instruction ID: c3320be0569a26dc619c0b9fa65e3df33f04391aa6839a17c5060afd3dc607af
Opcode Fuzzy Hash: b944f4b1975896e8d6ea4effe49ac60efb5815a951b87509e772666f8471c573
Instruction Fuzzy Hash: AF31383A214BC486FB208F25E45079EB365F789FC4F544039EE8947B98EF78C6968B00

Function 000001EF426D2814 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001EF426D2845
GetLastError.KERNEL32 ref: 000001EF426D2851
CloseHandle.KERNEL32 ref: 000001EF426D2869
CreateFileW.KERNEL32 ref: 000001EF426D2894
WriteConsoleW.KERNEL32 ref: 000001EF426D28B3

Strings

CONOUT$, xrefs: 000001EF426D2875

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 48b56def838186f0977933ffc9ee02d4886a42ddb0d3b73b1937c479b359ff6f
Instruction ID: 0c85944f9da6b1902b3d6839d26ddc58f6b69b7b9e7db780625767da6ac8be77
Opcode Fuzzy Hash: 48b56def838186f0977933ffc9ee02d4886a42ddb0d3b73b1937c479b359ff6f
Instruction Fuzzy Hash: 26118139310A8486F7508B56E85435E62A0F398FE4F010238EE1D877E4DF38C5058744

Function 000001EF426DD894 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000001EF426DD93D
MultiByteToWideChar.KERNEL32 ref: 000001EF426DD9E0
MultiByteToWideChar.KERNEL32 ref: 000001EF426DDA81
MultiByteToWideChar.KERNEL32 ref: 000001EF426DDACB
MultiByteToWideChar.KERNEL32 ref: 000001EF426DDB62
CompareStringEx.KERNEL32 ref: 000001EF426DDB95

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 3955fb30bc94266dc4cd1d3543ea9ea2f756c7d7753af11a763aa4490015b2c4
Instruction ID: 6dd7a8979cc3c92e6c9298bf384574d24a86acbe2bbd05f52b4a7bb84958ed84
Opcode Fuzzy Hash: 3955fb30bc94266dc4cd1d3543ea9ea2f756c7d7753af11a763aa4490015b2c4
Instruction Fuzzy Hash: 6DA1DD7B3246C846FB30AB65C4407EF6691E744FE8F4942399E698BBC9DF79C9068300

Function 000001EF426DD538 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000001EF426DD5AA
MultiByteToWideChar.KERNEL32 ref: 000001EF426DD652
LCMapStringEx.KERNEL32 ref: 000001EF426DD689
LCMapStringEx.KERNEL32 ref: 000001EF426DD6E2
LCMapStringEx.KERNEL32 ref: 000001EF426DD78F
WideCharToMultiByte.KERNEL32 ref: 000001EF426DD7D1

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e4fa22a710c47188b55bda09a09fdc9265209128699d57c18ff63feec2b297ff
Instruction ID: 392eea6862e3bb8a27fe746d07f98b2c2049153d761083197b8d1c9cfed05e7b
Opcode Fuzzy Hash: e4fa22a710c47188b55bda09a09fdc9265209128699d57c18ff63feec2b297ff
Instruction Fuzzy Hash: B2815D3B2217C486FB609F25E4407AF66A5F784BA8F144639EE5997BD4DF38C4468700

Function 000001EF426C0C04 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001EF426C0C13
FlsSetValue.KERNEL32(?,?,8000000000000000,000001EF426BCB85,?,?,?,?,000001EF426C67F4,?,?,?,000001EF426D6B53), ref: 000001EF426C0C49
FlsSetValue.KERNEL32(?,?,8000000000000000,000001EF426BCB85,?,?,?,?,000001EF426C67F4,?,?,?,000001EF426D6B53), ref: 000001EF426C0C76
FlsSetValue.KERNEL32(?,?,8000000000000000,000001EF426BCB85,?,?,?,?,000001EF426C67F4,?,?,?,000001EF426D6B53), ref: 000001EF426C0C87
FlsSetValue.KERNEL32(?,?,8000000000000000,000001EF426BCB85,?,?,?,?,000001EF426C67F4,?,?,?,000001EF426D6B53), ref: 000001EF426C0C98
SetLastError.KERNEL32 ref: 000001EF426C0CB3

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8826d2629091de77db15be1ae3b0f3568e5c0d82c15fea4c05d72b80d9df665a
Instruction ID: 9b680fd7122b0c2615a2594c61bc7b3e6dd71f6c01508da156d39bed290a00fb
Opcode Fuzzy Hash: 8826d2629091de77db15be1ae3b0f3568e5c0d82c15fea4c05d72b80d9df665a
Instruction Fuzzy Hash: ED112C3C3056D081FA69B32BDA513EF62926B98FB0F54473C9D7A077DADE3988478640

Function 000001EF4264F690 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000001EF4264F6EF

Part of subcall function 000001EF426DB798: AreFileApisANSI.KERNEL32 ref: 000001EF426DB7AA

__std_exception_destroy.LIBVCRUNTIME ref: 000001EF4264F987

Strings

", ", xrefs: 000001EF4264F7CB
: ", xrefs: 000001EF4264F798

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ApisFile__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 376971205-747220369
Opcode ID: e49b0ff812a51a131bf6e7ec927ea696224be31f76157b7d022b3a4b77e14190
Instruction ID: 64ebd11e34b71cc1038385c79c03abdae577a54187f8feff891f078dd02de1f6
Opcode Fuzzy Hash: e49b0ff812a51a131bf6e7ec927ea696224be31f76157b7d022b3a4b77e14190
Instruction Fuzzy Hash: D0A1787A210A8099FB00DF69E4543EE2362E744F88F508539EE9C0BBDADF79C496C344

Function 000001EF426D3B64 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001EF426D3B8C
_set_statfp.LIBCMT ref: 000001EF426D3BA7
_set_statfp.LIBCMT ref: 000001EF426D3BC3
_set_statfp.LIBCMT ref: 000001EF426D3BFF

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 025d23688907853b564ca8c27b0d165eda471880a57ba5485be5edd5abf68226
Instruction ID: 6394fb57c76166ddfd280d5ec4db56dc96e88628421d601ca14143039b06e33d
Opcode Fuzzy Hash: 025d23688907853b564ca8c27b0d165eda471880a57ba5485be5edd5abf68226
Instruction Fuzzy Hash: 2A11063EA25BDD45F764322DD4863EFA040AB74B74F440A3CED7A562D68E7C88538900

Function 000001EF426C0CCC Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000001EF426B8377,?,?,00000000,000001EF426B8612,?,?,?,?,8000000000000000,000001EF426B859E), ref: 000001EF426C0CEB
FlsSetValue.KERNEL32(?,?,?,000001EF426B8377,?,?,00000000,000001EF426B8612,?,?,?,?,8000000000000000,000001EF426B859E), ref: 000001EF426C0D0A
FlsSetValue.KERNEL32(?,?,?,000001EF426B8377,?,?,00000000,000001EF426B8612,?,?,?,?,8000000000000000,000001EF426B859E), ref: 000001EF426C0D32
FlsSetValue.KERNEL32(?,?,?,000001EF426B8377,?,?,00000000,000001EF426B8612,?,?,?,?,8000000000000000,000001EF426B859E), ref: 000001EF426C0D43
FlsSetValue.KERNEL32(?,?,?,000001EF426B8377,?,?,00000000,000001EF426B8612,?,?,?,?,8000000000000000,000001EF426B859E), ref: 000001EF426C0D54

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8f85cace48c52951f1dcc08f57255da1073724a629f29329f6a2f3b6055e36a1
Instruction ID: f5f2f637ea0eb8b17d581cc8a480e5aac900c444e70aca85f7708714aab250db
Opcode Fuzzy Hash: 8f85cace48c52951f1dcc08f57255da1073724a629f29329f6a2f3b6055e36a1
Instruction Fuzzy Hash: 341182383086D041FA68B72FEA523FF62415B94FB0F44473DAC39467DADE2AE9038600

Function 000001EF4264E510 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4264E57E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF4264E5C6
_Getctype.LIBCPMT ref: 000001EF4264E604

Strings

bad locale name, xrefs: 000001EF4264E6BD

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 11107d12fc0cbe8dbda57febae9b03af86836eda871c970791bd1f04446f032a
Instruction ID: afb5cc0c207d351d0454f17257c575dba8bdb185109086950359997b1e9f124e
Opcode Fuzzy Hash: 11107d12fc0cbe8dbda57febae9b03af86836eda871c970791bd1f04446f032a
Instruction Fuzzy Hash: 30515A3A701B809AFB05DF70D9903EE33A5AB44B48F5844399E8926AD6DF34C566C348

Function 000001EF426AA000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000001EF426AA08B

Strings

?, xrefs: 000001EF426AA040

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 3280a03fed16e4f21889a2867479104cb7301a0e7e290c7520675327bce34fcf
Instruction ID: ff3c984d15d321d67794b897ccfafdd626068825b985b99495f96322a8dd7ffe
Opcode Fuzzy Hash: 3280a03fed16e4f21889a2867479104cb7301a0e7e290c7520675327bce34fcf
Instruction Fuzzy Hash: 2B419C36618BC482FB108B25F4843AFA360F799B94F50523AFE9D42BD9DF78C5958B40

Function 000001EF426DB748 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000001EF426DB75E
GetProcAddress.KERNEL32 ref: 000001EF426DB76E

Strings

GetTempPath2W, xrefs: 000001EF426DB767
kernel32.dll, xrefs: 000001EF426DB757

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: c3f39c1016d9644655c5748e6247c669a6b28aee860c03fb307b0288e1ef9cb8
Instruction ID: 2b9b7153f752e55ffb6af7ba1bdf03acbca312c44c6ad3595f4a86706a885983
Opcode Fuzzy Hash: c3f39c1016d9644655c5748e6247c669a6b28aee860c03fb307b0288e1ef9cb8
Instruction Fuzzy Hash: 06E0ED7A314A8581FE058B05E98529E2261E748FC0F495039DE0D473B4EE38CA468700

Function 000001EF426C3AF4 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000001EF426C3C17
GetLastError.KERNEL32 ref: 000001EF426C3CA1

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a5824d7a27ccc4b9e07a47654372d492b8262273bd0045a7ecfe35f5860d5740
Instruction ID: 53c591f3f1ee710faeb4f5ebde5cf13347f31404c6de13bca51f62adc4a244de
Opcode Fuzzy Hash: a5824d7a27ccc4b9e07a47654372d492b8262273bd0045a7ecfe35f5860d5740
Instruction Fuzzy Hash: 1A91B276610A9485FB60EB6ED4807EEBBA0B745F88F44413AEE0A576D5DB34C493C710

Function 000001EF426E37E8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001EF426E3829
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426E38A9
_invalid_parameter_noinfo.LIBCMT ref: 000001EF426E38FD
_get_daylight.LIBCMT ref: 000001EF426E3955

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: cf49e0592d0c650ec1e2f0b893b1cf8e88f8ffad24bae71d226c790b617eba14
Instruction ID: 36c3a52a07dc6035a1d1b7a7572f0ffa3d4ab8db1727420669f8f1235db8273c
Opcode Fuzzy Hash: cf49e0592d0c650ec1e2f0b893b1cf8e88f8ffad24bae71d226c790b617eba14
Instruction Fuzzy Hash: B551023E6046D086F7685A2CE5053FFEA80E360F14F59803EDE5E4B2D6E378C8628742

Function 000001EF4266DD8E Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10242012109e4a86be69ed677377350650b74420802c6f08f205f6a982363824
Instruction ID: 8616b2bc60522e4513cd8ffc341302959945b38fc2c45bb72e4aa4fb44483a33
Opcode Fuzzy Hash: 10242012109e4a86be69ed677377350650b74420802c6f08f205f6a982363824
Instruction Fuzzy Hash: 0E4125367107C446FA249F66E5403DFA295BB91FA4F080A38AF9947BD6DF38C0938740

Function 000001EF426AD530 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000001EF426AD550
FreeEnvironmentStringsW.KERNEL32 ref: 000001EF426AD64B
RtlInitUnicodeString.NTDLL ref: 000001EF426AD6BE
RtlInitUnicodeString.NTDLL ref: 000001EF426AD6CB

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: b4ef9784d45fc8e6b89b3098b2c10cc5929096e8aef1ce82f37efd62700d8fa1
Instruction ID: a17a93f7dddbc0f6b28361edfae2f3e3bd1b018315e7409e403f60f77bda17cc
Opcode Fuzzy Hash: b4ef9784d45fc8e6b89b3098b2c10cc5929096e8aef1ce82f37efd62700d8fa1
Instruction Fuzzy Hash: CB515A36A14BC482EB108F19E44039E7760F795F98F549229EF9D03B95DFB8D5E28704

Function 000001EF42661D90 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF426DCA40: std::_Lockit::_Lockit.LIBCPMT ref: 000001EF426DCA5D
Part of subcall function 000001EF426DCA40: std::locale::_Setgloballocale.LIBCPMT ref: 000001EF426DCA80

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF42661DD1
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF42661DF6
std::_Facet_Register.LIBCPMT ref: 000001EF42661EA2
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42661F04

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 00cab222c791a3c13cb5de85ece3b48c5de49e60c55163303306dd4995681967
Instruction ID: c3fd9c414e33669fab9fca28ea626ed8d5f75848df80f2e32249064c4129d932
Opcode Fuzzy Hash: 00cab222c791a3c13cb5de85ece3b48c5de49e60c55163303306dd4995681967
Instruction Fuzzy Hash: E441353A210B8481FA10DB11E85139F77A4F758F90F98163AEE9D437E6DF38C5568B40

Function 000001EF42675750 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4267577B
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF426757A0

Part of subcall function 000001EF42676390: std::_Lockit::_Lockit.LIBCPMT ref: 000001EF426763FE
Part of subcall function 000001EF42676390: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF42676446

std::_Facet_Register.LIBCPMT ref: 000001EF4267584B
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42675896

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 4181401918-0
Opcode ID: 0ef2616fcc5399cb645ad342650983371f86b31a6cf8c916be02572b1d7a6817
Instruction ID: 71bbd855c7d9c41fcfe8a33ca84de4dcd23b274b521434a8aff435f1470c2384
Opcode Fuzzy Hash: 0ef2616fcc5399cb645ad342650983371f86b31a6cf8c916be02572b1d7a6817
Instruction Fuzzy Hash: 9241593A210B8481FA20DB15E8603EF67A1F798FE4F581639EE99076E9DF38D5438700

Function 000001EF42663BC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF42663BEB
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF42663C10
std::_Facet_Register.LIBCPMT ref: 000001EF42663CBB
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF42663D06

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d73785c31b51268aaaa81e722761cd05a3bd9e846c840b8156701ed2f3cb5d06
Instruction ID: 55e015bd58483d51d4e47b1efc856211b02c0b19a446f9c1f27503ae59b8ae0e
Opcode Fuzzy Hash: d73785c31b51268aaaa81e722761cd05a3bd9e846c840b8156701ed2f3cb5d06
Instruction Fuzzy Hash: 2441493A214A8480FA149B19E49039FA7A1F788F94F481639EE89077E5DF38D5938710

Function 000001EF4269BF50 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4269BF7B
std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4269BFA0
std::_Facet_Register.LIBCPMT ref: 000001EF4269C04B
Concurrency::cancel_current_task.LIBCPMT ref: 000001EF4269C096

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 868a9b32fd753d78733ea2833454119bc0e391c7d390d353236399543fd0b28d
Instruction ID: b3377161edb6ee31f057365869f4e5c950e235b780234055ee30e34fb32a6d5b
Opcode Fuzzy Hash: 868a9b32fd753d78733ea2833454119bc0e391c7d390d353236399543fd0b28d
Instruction Fuzzy Hash: 57415B3A214AC481FA24DB15E5503EF6760FB98FA4F481639EE8D476E5DF38D5438710

Function 000001EF426DB92C Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000001EF426DB975
GetLastError.KERNEL32 ref: 000001EF426DB983
WideCharToMultiByte.KERNEL32 ref: 000001EF426DB9B8
GetLastError.KERNEL32 ref: 000001EF426DB9C6

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9a4dc4f044481010f46556346e16a03dcc3346a8b305f7bba19c8a1af1585fcb
Instruction ID: 8d2611fc24a71fd02f87db9a725c5273fa1130a667d7c877ce3e5de0c85bf047
Opcode Fuzzy Hash: 9a4dc4f044481010f46556346e16a03dcc3346a8b305f7bba19c8a1af1585fcb
Instruction Fuzzy Hash: C7213E7A624B8487F7508F12E44435FB6B4F789F94F240139DF8957B98DB39C5128B40

Function 000001EF426DBE18 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000001EF426DB748: GetModuleHandleW.KERNEL32 ref: 000001EF426DB75E
Part of subcall function 000001EF426DB748: GetProcAddress.KERNEL32 ref: 000001EF426DB76E

GetLastError.KERNEL32 ref: 000001EF426DBE3C
GetFileAttributesW.KERNEL32 ref: 000001EF426DBE4B
__std_fs_open_handle.LIBCPMT ref: 000001EF426DBE74
CloseHandle.KERNEL32 ref: 000001EF426DBE86

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFileLastModuleProc__std_fs_open_handle
String ID:
API String ID: 3095436882-0
Opcode ID: b892b94bb0f9948f35957b13800629a7d60fe04165c7a3af998c2c5d416c0c70
Instruction ID: 590aec95c5d76c56e7439cbb6462fc4999bf3894b995b47c7bfa8e3e6d5dbd84
Opcode Fuzzy Hash: b892b94bb0f9948f35957b13800629a7d60fe04165c7a3af998c2c5d416c0c70
Instruction Fuzzy Hash: 09114F3922868845FBE05736E4843AFA669D784FF0F101638FF7647AE9DE38C4468B40

Function 000001EF426504B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000001EF426505EB

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: bd876ea6d1e42bbe0a1f5ca26025b82a8b71e9070b20895373b2cb38fbf8e9d1
Instruction ID: ff9f7a2032a9a65b254311a9e0ef647f7230481289f1957f7794a7c446b5948e
Opcode Fuzzy Hash: bd876ea6d1e42bbe0a1f5ca26025b82a8b71e9070b20895373b2cb38fbf8e9d1
Instruction Fuzzy Hash: 3F71CD7AB10BD085FB00CF69E8513DE27A1E799B94F604239EE5917BDADB78C1928340

Function 000001EF426A2670 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__std_fs_get_current_path.LIBCPMT ref: 000001EF426A26E8

Part of subcall function 000001EF426DBAAC: GetCurrentDirectoryW.KERNEL32 ref: 000001EF426DBAB4

Part of subcall function 000001EF4264FA60: __std_exception_copy.LIBVCRUNTIME ref: 000001EF4264FAED

Strings

current_path(), xrefs: 000001EF426A2890
--type, xrefs: 000001EF426A267B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: CurrentDirectory__std_exception_copy__std_fs_get_current_path
String ID: --type$current_path()
API String ID: 754703233-584980331
Opcode ID: 3e99e5e2f62bcead0021fbcf32d1687a8c25d9aa33b4f481b9a15244544d2971
Instruction ID: f4e99b414fd96e876630be754262e41e088f165d942e1cff2ef0e3b794e50fcf
Opcode Fuzzy Hash: 3e99e5e2f62bcead0021fbcf32d1687a8c25d9aa33b4f481b9a15244544d2971
Instruction Fuzzy Hash: F5518F76B20B9089FB10CBB5D8407DD37B1F749B98F60423AEE5967B98DB389582C310

Function 000001EF4269C7A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000001EF4269C80E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000001EF4269C856

Strings

bad locale name, xrefs: 000001EF4269C92B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ddb86738149835a0c2b36053b231cb08c5497e5d546fef63a7f7fbd4a990c4ba
Instruction ID: 425f1ef9ce96c9dc07cec31fd9ad27f204dfba2952804fa12bbeefb98105b013
Opcode Fuzzy Hash: ddb86738149835a0c2b36053b231cb08c5497e5d546fef63a7f7fbd4a990c4ba
Instruction Fuzzy Hash: D7514B7A302A809AFB55DF70E8903EE37A4EF48B48F080439EE4A67AD5DE34C556D344

Function 000001EF426C95D4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001EF426CE65C: _invalid_parameter_noinfo.LIBCMT ref: 000001EF426CE68F

_get_daylight.LIBCMT ref: 000001EF426C96EC
_get_daylight.LIBCMT ref: 000001EF426C96FD

Strings

?, xrefs: 000001EF426C967D

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f7c1b1b25115e9b3c7ae2db4b32114d52d42d17202fbd29d9737d5dcaa57baad
Instruction ID: 7624f3cb8bc8f4369f44d07858708027491cc1e2e40e7cbf2f82c0b12e9a5269
Opcode Fuzzy Hash: f7c1b1b25115e9b3c7ae2db4b32114d52d42d17202fbd29d9737d5dcaa57baad
Instruction Fuzzy Hash: C741053A2056C046FB25BF2BD5017FF66A4E791FA4F244239EE5847AD5DB38C482CB04

Function 000001EF426C37C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001EF426C38DB
GetLastError.KERNEL32 ref: 000001EF426C38FD

Strings

U, xrefs: 000001EF426C3887

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 3efb29d34a756b785a65299427448dbee74b57ff388e52a10932dd82dc16598c
Instruction ID: bf158f2bedbe3889507b8ca582f4cd299425ac86c00f49f9369640facd83e2a1
Opcode Fuzzy Hash: 3efb29d34a756b785a65299427448dbee74b57ff388e52a10932dd82dc16598c
Instruction Fuzzy Hash: B341C336719A8481EB20DF2AE4443EEB7A0F798B94F854039EE4D87798DB3CC556C750

Function 000001EF426C8948 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 000001EF426C899C
_set_errno_from_matherr.LIBCMT ref: 000001EF426C8A09

Strings

exp, xrefs: 000001EF426C8977

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 49f0d078269b54412d4ab26495e5ae6b104b468a2a1f1e9b5f5a5d1d2e07f27f
Instruction ID: dd4fd4b1ef4c51f5820f8807f15999e8feef3fa2a97d3ac5d00e4d3d32403029
Opcode Fuzzy Hash: 49f0d078269b54412d4ab26495e5ae6b104b468a2a1f1e9b5f5a5d1d2e07f27f
Instruction Fuzzy Hash: 7A21153AA10A548EF761DF79D4406EE33B4F748B48F401539EE0E92B8ADA38D5428B40

Function 000001EF426D7DB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 000001EF426D7DF8
RaiseException.KERNEL32 ref: 000001EF426D7E3E

Strings

csm, xrefs: 000001EF426D7E2B

Memory Dump Source

Source File: 00000000.00000002.2258637729.000001EF42620000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001EF42620000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ef42620000_bv2DbIiZeK.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 848e313ef3a32520056cfaa423b1a70fa28512a6fbe932c015b17c9c41edf620
Instruction ID: fbf675e2a2ea1877aaf6ec687939a9cb05184469645611217680323d6a275ee4
Opcode Fuzzy Hash: 848e313ef3a32520056cfaa423b1a70fa28512a6fbe932c015b17c9c41edf620
Instruction Fuzzy Hash: 0A111C36214B8482EB618F25E44039EB7A5F788F94F584675DF8D07BA8EF38C952CB40

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bv2DbIiZeK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

Windows Analysis Report
bv2DbIiZeK.exe

Function 000001EF426A8CC0 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 374
windowCOMMON

Function 000001EF426DBAE8 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000001EF426AB410 Relevance: 22.4, APIs: 3, Strings: 9, Instructions: 1387
COMMON

Function 000001EF426971A0 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 596
COMMON

Function 000001EF4267E4E0 Relevance: 20.2, APIs: 2, Strings: 9, Instructions: 954
COMMON

Function 000001EF4265D510 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 864
libraryloaderCOMMON

Function 000001EF4267B5BD Relevance: 19.9, APIs: 2, Strings: 8, Instructions: 2437
COMMON

Function 000001EF426C96B8 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 000001EF426A8400 Relevance: 13.9, APIs: 9, Instructions: 377
networkfileCOMMON

Function 00007FF64ABACE40 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 371
COMMON

Function 000001EF426A14B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Function 000001EF4269783A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 192
synchronizationCOMMON

Function 000001EF426A29E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 193
networkCOMMON

Function 000001EF426E3C08 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000001EF426ACDC0 Relevance: 13.6, APIs: 9, Instructions: 127
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre