Edit tour

Windows Analysis Report
siveria.exe

Overview

General Information

Sample name:	siveria.exe
Analysis ID:	1565462
MD5:	684b14726c07f5bb3ce6f89cad9a7a76
SHA1:	9589893a3ccc46d6457422a9dfe4994388ac47a6
SHA256:	8ddc8621f32587bf05d1f5e82c9a0fb0f61866596a67263cd4331639891025ff
Tags:	exeuser-joju29
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

siveria.exe (PID: 7536 cmdline: "C:\Users\user\Desktop\siveria.exe" MD5: 684B14726C07F5BB3CE6F89CAD9A7A76)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "Mazti", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: siveria.exe PID: 7536	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: siveria.exe PID: 7536	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.siveria.exe.257413e0000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.siveria.exe.257413e0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T00:04:05.945323+0100	2049441	1	A Network Trojan was detected	192.168.2.9	49712	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T00:04:05.945323+0100	2050806	1	A Network Trojan was detected	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:06.065547+0100	2050806	1	A Network Trojan was detected	192.168.2.9	49712	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T00:04:05.945323+0100	2050807	1	A Network Trojan was detected	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:06.065547+0100	2050807	1	A Network Trojan was detected	192.168.2.9	49712	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.siveria.exe.257413e0000.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "Mazti", "links": "", "port": 15666}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741457BA0 CryptUnprotectData,LocalFree,	0_2_0000025741457BA0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741413A30 BCryptDestroyKey,	0_2_0000025741413A30
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741417C20 CryptUnprotectData,LocalFree,	0_2_0000025741417C20
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741457EC0 CryptProtectData,LocalFree,	0_2_0000025741457EC0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B5098 CryptProtectData,	0_2_00000257414B5098
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B5060 OpenProcessToken,CryptProtectData,BitBlt,	0_2_00000257414B5060
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741458020 BCryptDecrypt,BCryptDecrypt,	0_2_0000025741458020
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414583C0 BCryptCloseAlgorithmProvider,	0_2_00000257414583C0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741458440 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,Concurrency::cancel_current_task,	0_2_0000025741458440
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B5688 BCryptSetProperty,	0_2_00000257414B5688
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B5668 BCryptOpenAlgorithmProvider,	0_2_00000257414B5668

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49713 version: TLS 1.2

Source: siveria.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149B500 FindClose,FindFirstFileExW,GetLastError,		0_2_000002574149B500
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002574149B5B0

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_00000257414673F0 GetLogicalDriveStringsW,

0_2_00000257414673F0

Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.9:49712 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.9:49712 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.9:49712 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.9:49712 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741464A30 recv,recv,closesocket,WSACleanup,

0_2_0000025741464A30

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: siveria.exe, 00000000.00000003.1562034882.0000025741C90000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1372912460.0000025741C81000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1562133641.0000025741C94000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1562071430.0000025741C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: siveria.exe, 00000000.00000003.1373594803.000002573F99E000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000002.1562505384.000002573F9A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: siveria.exe, 00000000.00000003.1373594803.000002573F99E000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000002.1562505384.000002573F9A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/X
Source: siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: siveria.exe, 00000000.00000003.1386201147.000002573F9F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: siveria.exe, 00000000.00000003.1386201147.000002573F9F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.corU
Source: siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: siveria.exe, 00000000.00000003.1379901735.0000025742492000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574248A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741608000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1381952772.0000025742C73000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379357422.000002573FA4D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.0000025742509000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379249955.00000257416C0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742435000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416C8000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742511000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574243D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379456014.000002574130D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: siveria.exe, 00000000.00000003.1379901735.0000025742492000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574248A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741608000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1381952772.0000025742C73000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379357422.000002573FA4D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.0000025742509000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379249955.00000257416C0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742435000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416C8000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742511000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574243D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379456014.000002574130D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: siveria.exe, 00000000.00000003.1381952772.0000025742C7A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742519000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741610000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416D0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.000002574249A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: siveria.exe, 00000000.00000003.1381952772.0000025742C7A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742519000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741610000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416D0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.000002574249A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: siveria.exe, 00000000.00000003.1381952772.0000025742C7A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742519000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741610000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416D0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.000002574249A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.9:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741465B70 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_0000025741465B70

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741469D30 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_0000025741469D30
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574146A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_000002574146A430
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B56F8 NtQuerySystemInformation,	0_2_00000257414B56F8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414B5720 NtQueryObject,	0_2_00000257414B5720
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564034C0 NtQueryVirtualMemory,NtProtectVirtualMemory,	0_2_00007FF7564034C0

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741445970	0_2_0000025741445970
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741466860	0_2_0000025741466860
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741414B70	0_2_0000025741414B70
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741465B70	0_2_0000025741465B70
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141CA10	0_2_000002574141CA10
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741412CA0	0_2_0000025741412CA0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141ECB0	0_2_000002574141ECB0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741411B90	0_2_0000025741411B90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741482E3C	0_2_0000025741482E3C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574140FE20	0_2_000002574140FE20
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574144D080	0_2_000002574144D080
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414120B0	0_2_00000257414120B0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741429F80	0_2_0000025741429F80
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574146D050	0_2_000002574146D050
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574145F020	0_2_000002574145F020
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741468030	0_2_0000025741468030
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741446350	0_2_0000025741446350
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741425310	0_2_0000025741425310
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147918C	0_2_000002574147918C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741465240	0_2_0000025741465240
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141D570	0_2_000002574141D570
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741410450	0_2_0000025741410450
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414676A0	0_2_00000257414676A0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574140F730	0_2_000002574140F730
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574146C5CB	0_2_000002574146C5CB
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149B5B0	0_2_000002574149B5B0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414A0658	0_2_00000257414A0658
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141E610	0_2_000002574141E610
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414198CD	0_2_00000257414198CD
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574145C8E0	0_2_000002574145C8E0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147A924	0_2_000002574147A924
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147F7E6	0_2_000002574147F7E6
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143B780	0_2_000002574143B780
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574146A780	0_2_000002574146A780
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147579C	0_2_000002574147579C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741440AC0	0_2_0000025741440AC0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741431AF0	0_2_0000025741431AF0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741410A80	0_2_0000025741410A80
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741455AB0	0_2_0000025741455AB0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143BAB0	0_2_000002574143BAB0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741458B00	0_2_0000025741458B00
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741486A68	0_2_0000025741486A68
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741413A30	0_2_0000025741413A30
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741437CEB	0_2_0000025741437CEB
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741454D40	0_2_0000025741454D40
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741478D50	0_2_0000025741478D50
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741470D14	0_2_0000025741470D14
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574148BB90	0_2_000002574148BB90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741455EF0	0_2_0000025741455EF0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741410E80	0_2_0000025741410E80
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741460E90	0_2_0000025741460E90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141BF40	0_2_000002574141BF40
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257413E5DB0	0_2_00000257413E5DB0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574141ADD0	0_2_000002574141ADD0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143BDD0	0_2_000002574143BDD0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741417E70	0_2_0000025741417E70
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414830B8	0_2_00000257414830B8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147F0D8	0_2_000002574147F0D8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143C0F0	0_2_000002574143C0F0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257413E70E0	0_2_00000257413E70E0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741473150	0_2_0000025741473150
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741476164	0_2_0000025741476164
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574148C128	0_2_000002574148C128
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149FFBC	0_2_000002574149FFBC
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414502C0	0_2_00000257414502C0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574145E2F0	0_2_000002574145E2F0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414871D8	0_2_00000257414871D8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257413E6180	0_2_00000257413E6180
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741471220	0_2_0000025741471220
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414814E4	0_2_00000257414814E4
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143B480	0_2_000002574143B480
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741466540	0_2_0000025741466540
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741406510	0_2_0000025741406510
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741405520	0_2_0000025741405520
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414083D0	0_2_00000257414083D0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574148A3C8	0_2_000002574148A3C8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741475394	0_2_0000025741475394
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414563A6	0_2_00000257414563A6
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574148A44F	0_2_000002574148A44F
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574145B420	0_2_000002574145B420
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574143C420	0_2_000002574143C420
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574146A430	0_2_000002574146A430
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414846E4	0_2_00000257414846E4
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257414836A8	0_2_00000257414836A8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741442750	0_2_0000025741442750
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741434720	0_2_0000025741434720
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741475598	0_2_0000025741475598
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00000257413E6610	0_2_00000257413E6610
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574147666C	0_2_000002574147666C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741488674	0_2_0000025741488674
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756448758	0_2_00007FF756448758
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756416730	0_2_00007FF756416730
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643F7EC	0_2_00007FF75643F7EC
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564227B0	0_2_00007FF7564227B0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564407B4	0_2_00007FF7564407B4
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756446844	0_2_00007FF756446844
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75644C8B4	0_2_00007FF75644C8B4
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564528CC	0_2_00007FF7564528CC
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643C550	0_2_00007FF75643C550
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564166E0	0_2_00007FF7564166E0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756447358	0_2_00007FF756447358
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564423EC	0_2_00007FF7564423EC
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75644A448	0_2_00007FF75644A448
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643A140	0_2_00007FF75643A140
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564381D0	0_2_00007FF7564381D0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564322E8	0_2_00007FF7564322E8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564402A8	0_2_00007FF7564402A8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756437F90	0_2_00007FF756437F90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75644FF2C	0_2_00007FF75644FF2C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643AF56	0_2_00007FF75643AF56
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643CFA0	0_2_00007FF75643CFA0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756444110	0_2_00007FF756444110
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564230B0	0_2_00007FF7564230B0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75645209C	0_2_00007FF75645209C
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756463DA0	0_2_00007FF756463DA0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643CEB2	0_2_00007FF75643CEB2
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643FBF4	0_2_00007FF75643FBF4
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756439C10	0_2_00007FF756439C10
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756432B97	0_2_00007FF756432B97
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756438C30	0_2_00007FF756438C30
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756434C30	0_2_00007FF756434C30
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756446CD8	0_2_00007FF756446CD8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756449CD8	0_2_00007FF756449CD8
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643F9F0	0_2_00007FF75643F9F0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF7564139E0	0_2_00007FF7564139E0
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75644FA90	0_2_00007FF75644FA90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643CA20	0_2_00007FF75643CA20

Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 0000025741416940 appears 41 times
Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 000002574140E1D0 appears 33 times
Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 0000025741478254 appears 34 times
Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 00007FF7564151F0 appears 69 times
Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 000002574140BA80 appears 32 times
Source: C:\Users\user\Desktop\siveria.exe	Code function: String function: 00000257414286B0 appears 54 times

Source: classification engine

Classification label: mal92.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574146B9B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_000002574146B9B0

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574141E610 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000002574141E610

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741454D40 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

0_2_0000025741454D40

Source: C:\Users\user\Desktop\siveria.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69634A500445

Source: siveria.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\siveria.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: siveria.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: siveria.exe

Static file information: File size 3341824 > 1048576

Source: siveria.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2bd800

Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: siveria.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: siveria.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: siveria.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: siveria.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: siveria.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: siveria.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: siveria.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: siveria.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574141D570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002574141D570

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574142CAB2 push rdi; retf 0004h	0_2_000002574142CAB5
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643D8A1 push rdi; ret	0_2_00007FF75643D8A5
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643D2C0 push rcx; iretd	0_2_00007FF75643D2C1
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643DB8C push rdi; ret	0_2_00007FF75643DB90
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF75643DB93 push rcx; iretd	0_2_00007FF75643DB94

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574145C600 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_000002574145C600

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149B500 FindClose,FindFirstFileExW,GetLastError,		0_2_000002574149B500
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_000002574149B5B0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002574149B5B0

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_00000257414673F0 GetLogicalDriveStringsW,

0_2_00000257414673F0

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741479038 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_0000025741479038

Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: siveria.exe, 00000000.00000002.1562505384.000002573F9B6000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000002.1562865457.0000025741249000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1373594803.000002573F9B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: siveria.exe, 00000000.00000003.1376733365.0000025741779000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\siveria.exe	API call chain: ExitProcess graph end node			graph_0-93294
Source: C:\Users\user\Desktop\siveria.exe	API call chain: ExitProcess graph end node			graph_0-93289

Source: C:\Users\user\Desktop\siveria.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574146A430 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_000002574146A430

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574149D804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000002574149D804

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574149D804 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000002574149D804

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574141D570 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002574141D570

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741489EEC GetProcessHeap,

0_2_0000025741489EEC

Source: C:\Users\user\Desktop\siveria.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_0000025741477F68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000025741477F68
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756441E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF756441E68
Source: C:\Users\user\Desktop\siveria.exe	Code function: 0_2_00007FF756455AC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF756455AC0

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574145B420 ShellExecuteW,

0_2_000002574145B420

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_00007FF756449AA0 cpuid

0_2_00007FF756449AA0

Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_000002574147DAE0
Source: C:\Users\user\Desktop\siveria.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0000025741488C04
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_0000025741488F60
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00000257414890C8
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_000002574149B170
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_000002574147E020
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_0000025741489030
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_0000025741489310
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_0000025741489518
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0000025741489468
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000002574148964C
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_00007FF75644D758
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF75644D88C
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_00007FF75644D550
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF75644D6A8
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,	0_2_00007FF7564491E0
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_00007FF75644D1A0
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_00007FF75644D270
Source: C:\Users\user\Desktop\siveria.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF75644D308
Source: C:\Users\user\Desktop\siveria.exe	Code function: EnumSystemLocalesW,	0_2_00007FF756448E4C
Source: C:\Users\user\Desktop\siveria.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF75644CE44

Source: C:\Users\user\Desktop\siveria.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_000002574148F908 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000002574148F908

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741466150 GetUserNameW,

0_2_0000025741466150

Source: C:\Users\user\Desktop\siveria.exe

Code function: 0_2_0000025741482E3C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_0000025741482E3C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: siveria.exe PID: 7536, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.siveria.exe.257413e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.siveria.exe.257413e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: siveria.exe PID: 7536, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: siveria.exe, 00000000.00000002.1562865457.0000025741249000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: siveria.exe, 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\siveria.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\siveria.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\siveria.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: siveria.exe PID: 7536, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.siveria.exe.257413e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.siveria.exe.257413e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: siveria.exe PID: 7536, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://go.microsoft.corU	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.co	siveria.exe, 00000000.00000003.1386201147.000002573F9F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/X	siveria.exe, 00000000.00000003.1373594803.000002573F99E000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000002.1562505384.000002573F9A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	siveria.exe, 00000000.00000003.1374864253.00000257412C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	siveria.exe, 00000000.00000003.1379901735.0000025742492000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574248A000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.0000025741608000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1381952772.0000025742C73000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379357422.000002573FA4D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379901735.0000025742509000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379249955.00000257416C0000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.0000025742435000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378544150.00000257416C8000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1380447917.0000025742511000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1378962971.000002574243D000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1379456014.000002574130D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	siveria.exe, 00000000.00000003.1386314860.000002573F9C1000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	siveria.exe, 00000000.00000003.1562034882.0000025741C90000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1372912460.0000025741C81000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1562133641.0000025741C94000.00000004.00000020.00020000.00000000.sdmp, siveria.exe, 00000000.00000003.1562071430.0000025741C90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	siveria.exe, 00000000.00000003.1378962971.0000025742445000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	siveria.exe, 00000000.00000003.1384405385.00000257417A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.corU	siveria.exe, 00000000.00000003.1386201147.000002573F9F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565462
Start date and time:	2024-11-30 00:03:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	siveria.exe
Detection:	MAL
Classification:	mal92.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 105 Number of non-executed functions: 134
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: siveria.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	weWHT1b7JO.dll	Get hash	malicious	Unknown	Browse	104.26.13.205
	Employee_Secure_Doc.pdf	Get hash	malicious	Unknown	Browse	172.67.74.152
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==	Get hash	malicious	Unknown	Browse	104.26.12.205
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	104.26.12.205
	9arEd0o4IZ.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	IwSa5fjMWm.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	051qAVqlq9.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	rkGw58sHF5.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.167.249
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://protect.checkpoint.com/v2/r01/___https://clickeu.actmkt.com/xd5/7-ai55b68h-a5f~-96gf-biba-/k~6/~c/kjha?jsw=sffmnfizfgDff9Dfmnfh~fgufgwvf8ffs9fmpfijfgvvfDDfrrflpfiyfgEvfrnflffixfgxffCff9nftzflxfiBfgCvf8ffsjfl9fikffCff9vftzfh~fimff8vf/vfqjfiffgufg~ff8nfrjfl9figfgyvfEnftnfjffinfgzvf8ffsvfmlfiofgxffEnfszflhfitfgCvf9vfszflvfgtfgwvf8DfszfmDfgDfg~ffafflffipfgxffBvfsDfrvfiffgvff9ffrnflrfllfgsff8vfrffrjfirfgsff7ffrnfrnflhfgsff9ffEffmffitfgsff7vfEvflDfihfgAff8fftnflzflrfikfgwvfsDfuvfiffgAff9vfqnfrnfihfiiff9ffsfflDflpfgBffBvftnflDfitfgyffBvfsfflzflrfikffBvftfflnflpfgCffBvfEvfmfflpfilfgxvfsffrzflrfihff8vfrvflrfmDfgvffDffrnfkzfllfgxfgwffrvfl9flpfgAfgwffqnfmjfipfiiff7vfqnflvfllfiiff8vfqnfmffllfgwfgwffqnflDfilfgDffEffDDfmffinfgxfgxvfsvfmffijfi9fg~ffvnfuvff====___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOjczN2NjZDA5MTMxODVlMzdkYWUzNjFjZjM4Yzg3Y2ZlOjc6ZjRkNToxN2E5YzZkNWIxZGY2MjgxODRlOTdhNmI5MDkxMDNmY2VkOTNmZGVmZWNhODNlZDEwNTdjNGFkZGY2ZGVlMDc5Omg6VDpU	Get hash	malicious	Unknown	Browse	162.159.140.160
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-DD0015830773-D0002973415	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
ASBAXETNRU	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	m2.exe	Get hash	malicious	Xmrig	Browse	194.87.31.45
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.26.13.205
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	104.26.13.205
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	pPLD6OSn7O.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	0b3SUiWz3y.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	ww7Oxm9pwx.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Vidar	Browse	104.26.13.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.2279903870873
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	siveria.exe
File size:	3'341'824 bytes
MD5:	684b14726c07f5bb3ce6f89cad9a7a76
SHA1:	9589893a3ccc46d6457422a9dfe4994388ac47a6
SHA256:	8ddc8621f32587bf05d1f5e82c9a0fb0f61866596a67263cd4331639891025ff
SHA512:	a6cfecead47b0f062e6fcfbed54db6d88fc901c5a0b592d6c249ab813471d87001313ddb6aa3086960cfd984f1be276de529f17cab383efa405db389664447a6
SSDEEP:	49152:KfrmzI7OXBGuJYiMKEJCPrFIltns9QAZi:yM4uKiMZCPrsnbA
TLSH:	0AF5AD6BEE5064F3D874D13488A3036BBA7A7481C37183875798672A5F527E42F3AF84
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..f...5...5...5.x.4...5.x.4...5.x.4V..5A..4...5A..4...5A..4...52\|.4$..52\|.4...5By.4...5A..4...5...5...5Ay.4...5AyH5...5Ay.4...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140055a30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67451F50 [Tue Nov 26 01:07:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de1751741e7d5e07ce98493d3f0130fc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F5C747C4BBCh
dec eax
add esp, 28h
jmp 00007F5C747C3F3Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F5C747C40D2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F5C747C40D5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F5C747C40CDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F5C747C3B06h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001563Fh]
dec eax
mov ecx, ebx
call dword ptr [0001562Eh]
call dword ptr [000155B0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00015624h]
dec eax
mov dword ptr [esp+00h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x327b9c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x332000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x32c000	0x57e4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x333000	0x1d38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x320ef0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x321100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x320db0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b000	0x330	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x692f0	0x69400	201d673c76ad9fae647f8cd6a278e333	False	0.4342200489904988	data	6.181155425260236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6b000	0x2bd696	0x2bd800	300000ebaf95e282a84dafb6aa5f647e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x329000	0x2f1c	0x1600	8e0cf2168d43982c322bc34eed94de2b	False	0.18980823863636365	data	3.2059756111359152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x32c000	0x57e4	0x5800	4c0d14150dd6a4ac35b35408d7a8233d	False	0.47767223011363635	data	5.711183919097264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x332000	0x1e0	0x200	0c1ab865bc43ec75ebd479502575ccef	False	0.525390625	data	4.700456763479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x333000	0x1d38	0x1e00	3d9cd06dc9d02c11c130514ad02ec0c5	False	0.6712239583333334	data	6.471011674882192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x332060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, FindNextFileW, FindFirstFileExW, FindClose, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, VirtualQuery, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, MultiByteToWideChar, ExitProcess, WideCharToMultiByte, GetLastError, DeleteCriticalSection, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, FreeEnvironmentStringsW, RaiseException, HeapReAlloc, HeapSize, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, GetCPInfo, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetModuleHandleExW, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, GetProcessHeap, SetStdHandle, ReadConsoleW, FlushFileBuffers, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetUserDefaultLCID, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx
USER32.dll	LoadAcceleratorsA, LoadAcceleratorsW
ADVAPI32.dll	GetTokenInformation, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T00:04:05.945323+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:05.945323+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:05.945323+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:06.065547+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.9	49712	45.130.145.152	15666	TCP
2024-11-30T00:04:06.065547+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.9	49712	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 00:04:00.294437885 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:00.414400101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:00.414504051 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:01.123876095 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:01.123904943 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:01.124007940 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:01.145174026 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:01.145200014 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.410986900 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.411067963 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.487564087 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.487581968 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.487960100 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.488030910 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.489217043 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.535322905 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.866399050 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.866465092 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:02.866482019 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.866580009 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.866864920 CET	49713	443	192.168.2.9	104.26.13.205
Nov 30, 2024 00:04:02.866878986 CET	443	49713	104.26.13.205	192.168.2.9
Nov 30, 2024 00:04:05.945322990 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.065357924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065377951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065454006 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.065485954 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065546036 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065546989 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.065552950 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065617085 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.065685987 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065706968 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065802097 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.065864086 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065870047 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065923929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.065963030 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.066004992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185472012 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185547113 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185566902 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185626030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185628891 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185631990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185704947 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185719967 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185725927 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185789108 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185858965 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185914993 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.185920000 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.185981989 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.186005116 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.186065912 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.186074972 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.186115026 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.186124086 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.186132908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.186197042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.305819988 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.305896044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.305927992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.305989981 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306128025 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306240082 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306269884 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306339025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306456089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306534052 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306600094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306653023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306667089 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306718111 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306786060 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306909084 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.306926012 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.306982994 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307020903 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307121038 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307122946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307218075 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307271957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307279110 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307344913 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307410955 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307418108 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307490110 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307590008 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307595968 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307671070 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307687044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307693005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307756901 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307827950 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307833910 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307919025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.307965994 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.307991028 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.308065891 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.308116913 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.308124065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.308130980 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.308192968 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.308289051 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.308295012 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.308367968 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426033020 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426076889 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426084042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426163912 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426171064 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426230907 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426294088 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426311016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426378012 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426465988 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426501036 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426548958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426619053 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426655054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426691055 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426762104 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426815033 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426868916 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426928997 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.426947117 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.426980019 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427042007 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427047968 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427097082 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427103043 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427155972 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427182913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427223921 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427284002 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427331924 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427395105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427411079 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427490950 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427510023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427544117 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427589893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427664042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427670002 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427722931 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427777052 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427818060 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427906990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.427910089 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.427962065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428030014 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428056955 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428065062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428128004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428183079 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428273916 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428361893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428365946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428401947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428479910 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428553104 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428561926 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428618908 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428683043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428689957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428755999 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428808928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428814888 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428879976 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.428949118 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.428956032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429022074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429104090 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429111958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429209948 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429225922 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429241896 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429306030 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429362059 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429368019 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429430008 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429519892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429526091 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429565907 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429570913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429580927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429619074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429662943 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429668903 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429735899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429738998 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429742098 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429811001 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429828882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429835081 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429889917 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429891109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429894924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429963112 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.429975986 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.429981947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430042982 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.430078030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430084944 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430125952 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430162907 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430177927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.430203915 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.430243015 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430249929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.430254936 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.430308104 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546191931 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546199083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546282053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546317101 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546329975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546375990 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546422005 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546643019 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546705961 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546804905 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546808958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546818972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546823025 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546828032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546888113 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.546900034 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.546962976 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547044992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547079086 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547084093 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547142029 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547198057 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547204018 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547270060 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547367096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547373056 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547460079 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547523022 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547667027 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547704935 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547769070 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547776937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547830105 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.547986984 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.547991991 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548068047 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548068047 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.548149109 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548223972 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.548376083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548433065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548487902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548496962 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.548543930 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548607111 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.548683882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548687935 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548768997 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.548849106 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548854113 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.548913956 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549074888 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549196005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549268007 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549313068 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549323082 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549354076 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549355984 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549386024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549429893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549431086 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549489975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549559116 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549561024 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549626112 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549690008 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.549751043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549928904 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549978971 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.549988985 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550041914 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550086975 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550317049 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550335884 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550348043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550368071 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550405979 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550421953 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550441027 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550492048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550538063 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550542116 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550550938 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550612926 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550616026 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550620079 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550693989 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550733089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550740004 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550755978 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550798893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550808907 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550826073 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550867081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.550951004 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.550990105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551002979 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551012993 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551062107 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551104069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551109076 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551129103 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551167965 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551172972 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551268101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551273108 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551337004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551413059 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551455975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551460981 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551470995 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551476955 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551496029 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551529884 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551578045 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551585913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551592112 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551600933 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551646948 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551666975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551671982 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551706076 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551742077 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551745892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551786900 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551815987 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551821947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551827908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551857948 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551887035 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.551917076 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.551919937 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552028894 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552063942 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552131891 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552136898 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552171946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552197933 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552232027 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552258968 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552275896 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552309990 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552329063 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552355051 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552371979 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552412987 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552463055 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552500010 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552604914 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552668095 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552673101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552746058 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552748919 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552752972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552813053 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552843094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552848101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552910089 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.552939892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.552944899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553000927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553067923 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553253889 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553263903 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553267956 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553318024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553345919 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553350925 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553360939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553364992 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553407907 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553436041 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553441048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553443909 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553487062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553502083 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553502083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553544998 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553579092 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553599119 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553603888 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553675890 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553675890 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553680897 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553741932 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553746939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553750038 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553838968 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553843975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553849936 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553889990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553920984 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.553936005 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553957939 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.553976059 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.554001093 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554007053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554084063 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.554102898 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554107904 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554172993 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.554267883 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554332972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554337978 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554347038 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554394960 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.554423094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554428101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.554497957 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.666408062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666426897 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666511059 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666548967 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.666554928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666651964 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666663885 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666666985 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.666724920 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.666805983 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666832924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.666937113 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667010069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667016029 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667089939 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667130947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667164087 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667223930 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667331934 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667336941 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667418003 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667433023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667465925 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667555094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667572975 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667596102 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667685032 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667701960 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667762995 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667819977 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.667879105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667912960 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.667975903 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668000937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668028116 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668102026 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668102980 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668142080 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668203115 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668262005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668308973 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668401957 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668409109 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668422937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668509960 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668517113 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668546915 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668665886 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668709040 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668714046 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668790102 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.668823957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668869972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668922901 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.668925047 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669004917 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669048071 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669151068 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669157028 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669214964 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669261932 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669267893 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669318914 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669415951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669421911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669518948 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669590950 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669610977 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669656992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669713020 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669718027 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669778109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669784069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669863939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669945002 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.669981003 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.669986963 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670049906 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670079947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670114994 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670161963 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670195103 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670243979 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670316935 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670344114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670388937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670449972 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670483112 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670519114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670583010 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670625925 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670679092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670736074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.670800924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670905113 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.670978069 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671000957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671008110 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671061993 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671144962 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671149969 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671216011 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671307087 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671318054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671438932 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671452045 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671457052 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671513081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671533108 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671555996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671633005 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671658993 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671693087 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671729088 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671752930 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671808004 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671879053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.671941042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.671982050 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672055960 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672096014 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672106981 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672141075 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.672184944 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.672219038 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672354937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672358990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672425985 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.672456980 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672561884 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672579050 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672640085 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.672738075 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672791958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672863960 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.672895908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.672921896 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673011065 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673064947 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673069954 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673136950 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673161030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673201084 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673276901 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673341990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673389912 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673460960 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673500061 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673567057 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673620939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673645020 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673692942 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673713923 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673758030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673764944 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673826933 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.673888922 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673893929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.673986912 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674057007 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674062014 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674110889 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674182892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674187899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674247026 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674259901 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674293995 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674375057 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674376965 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674390078 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674447060 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674505949 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674550056 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674619913 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674653053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674681902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674742937 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674796104 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674801111 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674860954 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.674894094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674943924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.674989939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675018072 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675024986 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675057888 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675095081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675163031 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675187111 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675244093 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675327063 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675332069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675410986 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675456047 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675461054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675523996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675529003 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675556898 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675622940 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675658941 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675664902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675726891 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675785065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675796032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675864935 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.675925016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675929070 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675987959 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.675991058 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676100016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676112890 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676129103 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676170111 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676187992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676282883 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676287889 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676358938 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676361084 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676397085 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676464081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676538944 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676543951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676611900 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676613092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676656961 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676759958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676772118 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676773071 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676841021 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.676899910 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676904917 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.676983118 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677016973 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677045107 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677139044 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677160978 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677165031 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677242041 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677265882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677272081 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677335024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677423000 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677489996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677536011 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677563906 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677573919 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677623987 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677647114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677716017 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677727938 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677772999 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677824974 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677829981 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677906036 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.677947044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.677952051 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678041935 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678042889 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678061008 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678128004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678158045 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678163052 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678276062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678303957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678333998 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678365946 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678425074 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678441048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678498983 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678529978 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678572893 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678658009 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678704977 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678710938 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678783894 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678802013 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678816080 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678878069 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.678921938 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678926945 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.678982973 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679044962 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679049969 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679105043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679111004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679142952 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679203987 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679214954 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679254055 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679362059 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679414034 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679419041 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679483891 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679486990 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679488897 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679555893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679613113 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679616928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679703951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679708004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679709911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679766893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679826975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679831982 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679902077 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.679928064 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.679939032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680002928 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680035114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680038929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680110931 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680126905 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680134058 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680193901 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680232048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680253029 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680346012 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680363894 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680370092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680427074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680505037 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680584908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680589914 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680608034 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680660963 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680721998 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680727005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680784941 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680804014 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680855036 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680912018 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680922985 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.680952072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.680960894 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681015015 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681066990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681071997 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681163073 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681168079 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681173086 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681233883 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681261063 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681272984 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681330919 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681375980 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681392908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681487083 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681493998 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681499958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681580067 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681632042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681637049 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681668043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.681710958 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.681739092 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.717637062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.717889071 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.786664009 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.786679983 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.786787033 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.786848068 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.786854029 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.786928892 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787048101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787101984 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787180901 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787205935 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787230015 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787293911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787328959 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787354946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787430048 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787501097 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787506104 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787559032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787564993 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787636995 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787648916 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787653923 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787674904 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787717104 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787736893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787785053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787790060 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787812948 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787848949 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787883043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.787920952 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787986040 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.787991047 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788028002 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788096905 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.788136959 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788187981 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788242102 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.788310051 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788425922 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788491964 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.788552046 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788593054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788655996 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.788703918 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788846970 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.788908958 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.789124012 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789211035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789271116 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.789321899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789371967 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789427042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.789515972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789556980 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789634943 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.789684057 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789798021 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789853096 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.789858103 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.789974928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790024042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.790049076 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790154934 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790209055 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.790219069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790381908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790438890 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.790452003 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790597916 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790663004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.790764093 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790911913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790957928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.790975094 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791130066 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791199923 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791295052 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791388988 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791496992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791538954 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791661024 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791707039 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791719913 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791768074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791819096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.791878939 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.791882038 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792009115 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792061090 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792113066 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.792248964 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792282104 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792331934 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.792335033 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792427063 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792510986 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792557001 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.792656898 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792726040 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.792756081 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792886019 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792917967 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.792942047 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.792989969 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793111086 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793169975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793174028 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793193102 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793226957 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793358088 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793361902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793431044 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793483973 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793518066 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793572903 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793598890 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793603897 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793677092 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793732882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793737888 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793798923 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793803930 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793823957 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793899059 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.793986082 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.793991089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794039965 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794071913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794078112 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794132948 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794202089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794208050 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794260025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794323921 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794328928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794384956 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794389009 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794470072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794512987 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794521093 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794548035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794564962 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794605970 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794655085 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794841051 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794863939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794867992 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794887066 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794919968 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794924021 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.794941902 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.794996977 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795038939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795052052 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795104980 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795181036 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795186043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795243979 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795278072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795360088 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795442104 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795445919 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795448065 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795497894 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795571089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795576096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795635939 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795727015 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795732975 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795782089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795787096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795815945 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795836926 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.795948982 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.795954943 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796003103 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796099901 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796104908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796173096 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796216011 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796277046 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796281099 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796343088 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796367884 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796425104 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796591997 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796622992 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796726942 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796813965 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796865940 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.796947002 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.796948910 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797025919 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797072887 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.797323942 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797343969 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797420025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.797626972 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797638893 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797693014 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.797715902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797720909 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797795057 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.797841072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797890902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.797981024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.797985077 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798032045 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798089027 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798099995 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798122883 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798150063 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798255920 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798260927 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798322916 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798373938 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798377991 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798453093 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798516035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798521042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798583984 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798625946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798666954 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798742056 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798791885 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798798084 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798824072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798844099 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798871994 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798877001 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.798954010 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.798959017 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799009085 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799060106 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799091101 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799169064 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799216032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799263954 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799325943 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799359083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799381018 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799407959 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799510956 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799515963 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799570084 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799582005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799613953 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799695015 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799745083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799758911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799833059 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.799873114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799911022 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.799963951 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800044060 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800101042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800132990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800162077 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800213099 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800261974 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800292969 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800370932 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800421953 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800431967 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800494909 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800508976 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800514936 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800584078 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800642014 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800647020 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800712109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.800878048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800883055 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.800951004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801157951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801178932 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801258087 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801273108 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801316023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801350117 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801382065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801403046 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801466942 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801484108 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801491022 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801539898 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801639080 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801676035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801729918 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801785946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801860094 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801867008 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801892042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.801927090 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801945925 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.801994085 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802022934 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802073002 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802073956 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802109957 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802187920 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802192926 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802201033 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802261114 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802287102 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802292109 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802355051 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802376032 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802381039 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802436113 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802438021 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802440882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802520037 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802536011 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802548885 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802596092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802598000 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802634001 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802699089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802700996 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802704096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802764893 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802788019 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802793026 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802836895 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.802889109 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802894115 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802939892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802946091 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.802977085 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803005934 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803076982 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803081989 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803128004 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803128958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803134918 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803177118 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803235054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803246021 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803277016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803283930 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803334951 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803378105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803391933 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803423882 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803452969 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803512096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803520918 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803528070 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803564072 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803565025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803653955 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803672075 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803687096 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803704977 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803709030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803731918 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803750992 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803797960 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803802013 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803848982 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803853035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803859949 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803908110 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.803982019 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803992033 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.803997993 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804019928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804038048 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804064035 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804071903 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804090977 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804099083 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804127932 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804145098 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804188967 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804239035 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804243088 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804282904 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804287910 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804301023 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804336071 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804354906 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804450989 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804455996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804506063 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804562092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804570913 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804622889 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804629087 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804635048 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804723978 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804723978 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804737091 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804842949 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804856062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804867029 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804884911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804889917 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804924011 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804925919 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804966927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.804975986 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.804986954 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805059910 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805063009 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805109978 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805195093 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805212021 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805229902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805233002 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805249929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805253983 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805289984 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805290937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805315971 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805329084 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805381060 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805404902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805409908 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805457115 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805461884 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805475950 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805510044 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805545092 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805548906 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805602074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805615902 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805620909 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805670977 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805713892 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805718899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805764914 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805768967 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805774927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805821896 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805881977 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805886030 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805896044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805898905 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805933952 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.805979013 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805984974 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.805986881 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806018114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806036949 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806056976 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806088924 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806113958 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806119919 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806163073 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806169033 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806183100 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806261063 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806266069 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806271076 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806318998 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806327105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806333065 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806407928 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806436062 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806444883 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806464911 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806468964 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806520939 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806610107 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806615114 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806632042 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806644917 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806663990 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806668043 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806696892 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806751013 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806751966 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806756973 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806819916 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806823969 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806864977 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.806866884 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806915998 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806982994 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.806988001 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807019949 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807025909 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807090044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807090998 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807178020 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807215929 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807229996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807301044 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807318926 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807324886 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807398081 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807398081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807403088 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807454109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807472944 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807478905 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807523966 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807549953 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807554007 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807600021 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807631016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807636023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807661057 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807691097 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807692051 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807733059 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807758093 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807776928 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807837009 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807841063 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807842016 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807895899 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.807939053 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807944059 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.807976007 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808010101 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808068037 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808068991 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808074951 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808140039 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808160067 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808165073 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808173895 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808226109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808238983 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808245897 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808257103 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808260918 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808316946 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808357000 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808362007 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808371067 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808376074 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808424950 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808454037 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808459044 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808492899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808515072 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808527946 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808538914 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808549881 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808592081 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808662891 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808693886 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808697939 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808732033 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808753014 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808779001 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808816910 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.808878899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.808934927 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.837999105 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.839134932 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.839230061 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.881014109 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.881299019 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.881386995 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.935600996 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.935627937 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.936089993 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936186075 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936249018 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936299086 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936362028 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936413050 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936470985 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936522961 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936570883 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936630011 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936681032 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936753035 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936808109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936865091 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936917067 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.936975002 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937026024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937092066 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937140942 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937197924 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937251091 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937318087 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.937349081 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.938643932 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.938746929 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.970431089 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:06.970700979 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.970788956 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:06.970839024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.001488924 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.001873970 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.001996040 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.002037048 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.045084953 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.045259953 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.045341969 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.076891899 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.077161074 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077238083 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077300072 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077380896 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077436924 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077493906 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077555895 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077611923 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077665091 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077730894 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077785969 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077860117 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077917099 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.077975035 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.090805054 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.093687057 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.093780994 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.093831062 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.093890905 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.093956947 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.094027042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.094082117 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.094146013 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.094202042 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.094266891 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.122149944 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.122512102 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.122601986 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.122664928 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.165100098 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.167932987 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.168035030 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.168071032 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.197386026 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.199743032 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.209743023 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.210707903 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.211033106 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211102009 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211162090 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211239100 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211288929 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211354971 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211411953 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211461067 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211518049 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211580038 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211627007 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211699963 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211752892 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211816072 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211867094 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211929083 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.211956024 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.213807106 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.215670109 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.257061005 CET	15666	49712	45.130.145.152	192.168.2.9
Nov 30, 2024 00:04:07.259955883 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.260046005 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.260106087 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.260174990 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.260236025 CET	49712	15666	192.168.2.9	45.130.145.152
Nov 30, 2024 00:04:07.260315895 CET	49712	15666	192.168.2.9	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2024 00:04:00.974044085 CET	192.168.2.9	1.1.1.1	0x3b21	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2024 00:03:56.133637905 CET	1.1.1.1	192.168.2.9	0xfd44	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2024 00:03:56.133637905 CET	1.1.1.1	192.168.2.9	0xfd44	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 30, 2024 00:04:01.111845970 CET	1.1.1.1	192.168.2.9	0x3b21	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 30, 2024 00:04:01.111845970 CET	1.1.1.1	192.168.2.9	0x3b21	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 30, 2024 00:04:01.111845970 CET	1.1.1.1	192.168.2.9	0x3b21	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49713	104.26.13.205	443	7536	C:\Users\user\Desktop\siveria.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 23:04:02 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-29 23:04:02 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 23:04:02 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ea63c08db618c53-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1844&min_rtt=1836&rtt_var=705&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1532808&cwnd=213&unsent_bytes=0&cid=ad9d49e5816f4a77&ts=466&x=0"
2024-11-29 23:04:02 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	18:03:59
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\siveria.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\siveria.exe"
Imagebase:	0x7ff756400000
File size:	3'341'824 bytes
MD5 hash:	684B14726C07F5BB3CE6F89CAD9A7A76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1562865457.000002574121F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	88.6%
Signature Coverage:	23.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 0000025741465B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 0000025741465BB1
GetSystemMetrics.USER32 ref: 0000025741465BBF
GetSystemMetrics.USER32 ref: 0000025741465BCD
GetSystemMetrics.USER32 ref: 0000025741465BDB
GetDC.USER32 ref: 0000025741465BE5
GetDeviceCaps.GDI32 ref: 0000025741465BFB
GetDeviceCaps.GDI32 ref: 0000025741465C0B
CreateCompatibleDC.GDI32 ref: 0000025741465C18
CreateCompatibleBitmap.GDI32 ref: 0000025741465C30
SelectObject.GDI32 ref: 0000025741465C46
BitBlt.GDI32 ref: 0000025741465C7C
SHCreateMemStream.SHLWAPI ref: 0000025741465CB2
SelectObject.GDI32 ref: 0000025741465CC8
DeleteDC.GDI32 ref: 0000025741465CD1
ReleaseDC.USER32 ref: 0000025741465CDC
DeleteObject.GDI32 ref: 0000025741465CE5
EnterCriticalSection.KERNEL32 ref: 0000025741465DDC
LeaveCriticalSection.KERNEL32 ref: 0000025741465DEE
IStream_Size.SHLWAPI ref: 0000025741465E25
IStream_Reset.SHLWAPI ref: 0000025741465E36
IStream_Read.SHLWAPI ref: 0000025741465EBB
SelectObject.GDI32 ref: 0000025741465F15
DeleteDC.GDI32 ref: 0000025741465F1E
ReleaseDC.USER32 ref: 0000025741465F2B
DeleteObject.GDI32 ref: 0000025741465F34

Strings

, xrefs: 0000025741465C51

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 7f29424d3ead8c8ab7e32e0c66aef27a74aa28fe3180dede61f6c59901bdf73b
Instruction ID: ee7a60c1de5b07f8e8bafa29eb776f1eea6e2bb05774d9853d578f701bb94cc8
Opcode Fuzzy Hash: 7f29424d3ead8c8ab7e32e0c66aef27a74aa28fe3180dede61f6c59901bdf73b
Instruction Fuzzy Hash: D1B16E72248BC086E760EB25F8583AAB3B1F799B81F408515DA8E57B69DF3CC085CB44

Function 000002574149B5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 000002574149B65D
GetLastError.KERNEL32 ref: 000002574149B667
FindFirstFileW.KERNEL32 ref: 000002574149B67E
GetLastError.KERNEL32 ref: 000002574149B68A
FindClose.KERNEL32 ref: 000002574149B698
__std_fs_open_handle.LIBCPMT ref: 000002574149B72B
CloseHandle.KERNEL32 ref: 000002574149B741
CloseHandle.KERNEL32 ref: 000002574149B8B4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction ID: a83ee46e8b188c2301f07777c7b4243fa98c96d2a92db2c9d58c3f1506fe1701
Opcode Fuzzy Hash: ae06ef96b620ec177ea6819a3a1ac38214177ad565b87e13f1ccf53398ca1eb7
Instruction Fuzzy Hash: CA91B5317A8E0146F774EB7DBC08F6962B0A74A7B6F184714D9B66B6D4DB38C804874C

Function 0000025741468030 Relevance: 22.6, APIs: 3, Strings: 9, Instructions: 1600COMMON

Download Yara Rule

APIs

Part of subcall function 0000025741466C70: GetCurrentHwProfileW.ADVAPI32 ref: 0000025741466CAC

Part of subcall function 0000025741466540: EnumDisplayDevicesW.USER32 ref: 0000025741466657
Part of subcall function 0000025741466540: EnumDisplayDevicesW.USER32 ref: 00000257414666FB

Part of subcall function 0000025741466460: RegGetValueA.ADVAPI32 ref: 00000257414664C9

Part of subcall function 0000025741466150: GetUserNameW.ADVAPI32 ref: 0000025741466195

Part of subcall function 00000257414661F0: GetComputerNameW.KERNEL32 ref: 0000025741466235

GlobalMemoryStatusEx.KERNEL32 ref: 00000257414687BC
wcsftime.LIBCMT ref: 0000025741468FB2
GetModuleFileNameA.KERNEL32 ref: 0000025741469146

Strings

system, xrefs: 0000025741468424, 0000025741468513, 0000025741468609, 0000025741468703, 000002574146884B, 0000025741468945, 0000025741468A38, 0000025741468BBF, 0000025741468DB0, 0000025741469031, 00000257414691F4, 000002574146940E, 00000257414695AD, 0000025741469757, 000002574146981D
timezone, xrefs: 0000025741469454
time, xrefs: 0000025741469081
%d-%m-%Y, %H:%M:%S, xrefs: 0000025741468F9F
ram, xrefs: 000002574146889B
computer_name, xrefs: 0000025741468994
user_name, xrefs: 000002574146846F
cpu, xrefs: 0000025741468658
gpu, xrefs: 0000025741468562

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: 83b68417b8bc51af44e4411a1981e3471f5f661200eb30e4b38870ee685f36e4
Instruction ID: 6807714679e32ded52f105391bd3af06f910480d0d803bafa700863c28130d39
Opcode Fuzzy Hash: 83b68417b8bc51af44e4411a1981e3471f5f661200eb30e4b38870ee685f36e4
Instruction Fuzzy Hash: 7FF29E72658FC185EB20DF68E8843DD77B1F789799F409215EA8D27BA9DB78C280C704

Function 000002574141D570 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000002574141D65C
GetProcAddress.KERNEL32 ref: 000002574141D767
GetProcAddress.KERNEL32 ref: 000002574141D829
GetProcAddress.KERNEL32 ref: 000002574141D8A3
GetProcAddress.KERNEL32 ref: 000002574141D925
GetProcAddress.KERNEL32 ref: 000002574141D99F
GetProcAddress.KERNEL32 ref: 000002574141DA23
FreeLibrary.KERNEL32 ref: 000002574141E551

Strings

system, xrefs: 000002574141E35D
cannot use push_back() with , xrefs: 000002574141E59F
vault, xrefs: 000002574141E3B3

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: bcc85765481068b8fd945525afbc24a0629afffb76e85141ea71ca942364fe08
Instruction ID: f9a55391575fb44af5d223b017cd8e2cdda7e948a51d357cf33b7fc54c410383
Opcode Fuzzy Hash: bcc85765481068b8fd945525afbc24a0629afffb76e85141ea71ca942364fe08
Instruction Fuzzy Hash: DF924972249FC489DB619F69E8883DD73B4F749798F204215EA9C6BB99EF74C284C304

Function 0000025741445970 Relevance: 17.8, Strings: 14, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

key, xrefs: 000002574144C60E, 000002574144C740
@, xrefs: 0000025741449B9B
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000002574144A68F, 000002574144A6C9, 000002574144A81F
cannot use push_back() with , xrefs: 000002574144A625, 000002574144A6FE, 000002574144A7B5, 000002574144DDD5
@, xrefs: 000002574144A32B
chrome_key, xrefs: 000002574144C851, 000002574144C97F
directory_iterator::directory_iterator, xrefs: 000002574144A5A5, 000002574144A853, 000002574144A875, 000002574144A8AD, 000002574144CA83, 000002574144DE23, 000002574144F4A4, 000002574144F78C
status, xrefs: 000002574144A5B5, 000002574144A600, 000002574144A6D9, 000002574144A790, 000002574144A863, 000002574144A885, 000002574144A89B, 000002574144A8BD, 000002574144CA99, 000002574144DE11, 000002574144DE33, 000002574144DE5B, 000002574144DE83, 000002574144F764
recursive_directory_iterator::operator++, xrefs: 000002574144A678, 000002574144A745, 000002574144A808
filename, xrefs: 0000025741446D9C, 00000257414478E3, 0000025741448376, 0000025741448E23, 0000025741449793, 0000025741449F35, 000002574144D5FC, 000002574144DAE0
., xrefs: 0000025741445C70
content, xrefs: 0000025741446EB7, 00000257414479CA, 000002574144845D, 0000025741448F0A, 00000257414498AE, 000002574144A03E, 000002574144D6B3, 000002574144DB94
exists, xrefs: 0000025741445F90, 000002574144A58E, 000002574144A5DE, 000002574144A6AC, 000002574144A76E, 000002574144A83C, 000002574144CA70, 000002574144D060, 000002574144F48D, 000002574144F779
prefs.js, xrefs: 000002574144E5E2

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: .$@$@$cannot use push_back() with $chrome_key$content$directory_iterator::directory_iterator$exists$filename$key$prefs.js$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-4287193513
Opcode ID: d85864b6336acd62be5f7280330fa91da0aadc80efc30bd9caf6eb99ab158536
Instruction ID: 31f8243a5a921b379815dabb12b18e25c5001da9b325cd48dad4067bd1860240
Opcode Fuzzy Hash: d85864b6336acd62be5f7280330fa91da0aadc80efc30bd9caf6eb99ab158536
Instruction Fuzzy Hash: F1C1A3326C8F8486EF60AF2DE84836D63B1F745B99F544221EB996B794DF34C841C748

Function 000002574145C600 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002574145F820: GetCurrentProcess.KERNEL32 ref: 000002574145F85B
Part of subcall function 000002574145F820: OpenProcessToken.ADVAPI32 ref: 000002574145F86E
Part of subcall function 000002574145F820: GetTokenInformation.ADVAPI32 ref: 000002574145F8AA

ExitProcess.KERNEL32 ref: 000002574145C647
OpenMutexA.KERNEL32 ref: 000002574145C762
ExitProcess.KERNEL32 ref: 000002574145C772
CreateMutexA.KERNEL32 ref: 000002574145C791
ExitProcess.KERNEL32 ref: 000002574145C7B7

Part of subcall function 000002574145FB60: GetModuleFileNameW.KERNEL32 ref: 000002574145FBAA

Part of subcall function 000002574146A780: CoInitializeEx.OLE32 ref: 000002574146A7EA

Strings

SeDebugPrivilege, xrefs: 000002574145C64E
SeImpersonatePrivilege, xrefs: 000002574145C65A

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 8fc456fc9e2cb3d1df6ff90fb808432f92b3fc1d1a0525f9aef9fe2426dfab3f
Instruction ID: 7fecae28817705dcf3f8b06d1cb4bcccfc9a5f9a0d91e3ce80384b4dce5647f2
Opcode Fuzzy Hash: 8fc456fc9e2cb3d1df6ff90fb808432f92b3fc1d1a0525f9aef9fe2426dfab3f
Instruction Fuzzy Hash: 7361C36169CE8041EA10BB6CFC5D3AEA3B4FB85396F510511EB8D66AD6DF38C0448B08

Function 0000025741414B70 Relevance: 15.3, APIs: 3, Strings: 5, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002574141509B
RegQueryValueExA.ADVAPI32 ref: 00000257414150E9
RegCloseKey.ADVAPI32 ref: 0000025741415186

Strings

directory_iterator::directory_iterator, xrefs: 0000025741416441
status, xrefs: 0000025741416403, 0000025741416413
filename, xrefs: 000002574141549A, 0000025741415A28, 0000025741415F59
content, xrefs: 00000257414155A3, 0000025741415BF6, 0000025741416120
exists, xrefs: 0000025741416398, 00000257414163E3, 000002574141647A

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-3429737954
Opcode ID: 472e3ad5d3f6a61d744a71a03de640d67c750eb007932b83e436428a4ad86246
Instruction ID: ae2975e35501073c8e533adae43d0551a0e4be30182d2acd634e9305af150787
Opcode Fuzzy Hash: 472e3ad5d3f6a61d744a71a03de640d67c750eb007932b83e436428a4ad86246
Instruction Fuzzy Hash: A2E27C72658FC089EB61AF28EC883DD33B5F785799F504216EA5C2BA99DF74C684C304

Function 0000025741412CA0 Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000025741413022
RegQueryValueExA.ADVAPI32 ref: 000002574141306A
RegCloseKey.ADVAPI32 ref: 00000257414130F7

Strings

directory_iterator::directory_iterator, xrefs: 00000257414139DD
status, xrefs: 00000257414139F9
filename, xrefs: 0000025741413500
content, xrefs: 0000025741413694
exists, xrefs: 00000257414139BE

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-3429737954
Opcode ID: 20b0abc57c6f6c76ae53fbfa68efc0c9fdaf881e402e06b3d89e769f3233422e
Instruction ID: eb1bdc7456b4fbd3623fbc37245ed742a3eff774915524c0f23220a85fd3369d
Opcode Fuzzy Hash: 20b0abc57c6f6c76ae53fbfa68efc0c9fdaf881e402e06b3d89e769f3233422e
Instruction Fuzzy Hash: 1F827A72654FC48AEB20AF29EC883DD73B1F7897A9F115211EA9D27B99DB34C584C304

Function 0000025741482E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 0000025741482E81

Part of subcall function 00000257414824E8: _invalid_parameter_noinfo.LIBCMT ref: 00000257414824FC

Part of subcall function 000002574147D3C8: HeapFree.KERNEL32 ref: 000002574147D3DE
Part of subcall function 000002574147D3C8: GetLastError.KERNEL32 ref: 000002574147D3E8

Part of subcall function 000002574148BA84: _invalid_parameter_noinfo.LIBCMT ref: 000002574148B9CF

_get_daylight.LIBCMT ref: 0000025741482E70

Part of subcall function 0000025741482548: _invalid_parameter_noinfo.LIBCMT ref: 000002574148255C

_get_daylight.LIBCMT ref: 00000257414830E6
_get_daylight.LIBCMT ref: 00000257414830F7
_get_daylight.LIBCMT ref: 0000025741483108
GetTimeZoneInformation.KERNEL32 ref: 000002574148312F

Strings

Eastern Summer Time, xrefs: 00000257414831ED
Eastern Standard Time, xrefs: 00000257414831D5

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction ID: 65e055bc4aac660322d32144e1db58e3d7a274e38b970e09ad7967c94e31a6a4
Opcode Fuzzy Hash: d27e707e32a7a668b79f18f39980f86f66c1361dc0c94ac41fd5faca01788e5a
Instruction Fuzzy Hash: 02D1157A788A4086E720FF2AFD587A963B1F784B96F455025EE1963EC6DB38C441C348

Function 0000025741465240 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000002574146540B
InternetOpenUrlA.WININET ref: 00000257414654E8
HttpQueryInfoW.WININET ref: 0000025741465549
HttpQueryInfoW.WININET ref: 00000257414655E2
InternetQueryDataAvailable.WININET ref: 0000025741465626
InternetReadFile.WININET ref: 00000257414656E9
InternetQueryDataAvailable.WININET ref: 00000257414657B4
InternetCloseHandle.WININET ref: 000002574146585E
Concurrency::cancel_current_task.LIBCPMT ref: 00000257414658BB

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: 22cc0de2f830c730963fd45c5dceac6d0a861e7d35ac65e13c62ef2f343c9383
Instruction ID: 31c40a8130fffc7fa48f93eed7ca3c981909fa68f18204d04eb99e1a46354662
Opcode Fuzzy Hash: 22cc0de2f830c730963fd45c5dceac6d0a861e7d35ac65e13c62ef2f343c9383
Instruction Fuzzy Hash: CD026A72A58F9486EB10DB69F84439EB7B5F795799F200215EE9C67BA8DF38C080C704

Function 00000257414A0658 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257414A023C: _invalid_parameter_noinfo.LIBCMT ref: 00000257414A027D
Part of subcall function 00000257414A023C: _invalid_parameter_noinfo.LIBCMT ref: 00000257414A02FB
Part of subcall function 00000257414A023C: _invalid_parameter_noinfo.LIBCMT ref: 00000257414A034C

CreateFileW.KERNEL32 ref: 00000257414A075E
CreateFileW.KERNEL32 ref: 00000257414A07AE
GetLastError.KERNEL32 ref: 00000257414A07DE
GetFileType.KERNEL32 ref: 00000257414A07F3
GetLastError.KERNEL32 ref: 00000257414A07FD
CloseHandle.KERNEL32 ref: 00000257414A0830
CloseHandle.KERNEL32 ref: 00000257414A0993
CreateFileW.KERNEL32 ref: 00000257414A09C8
GetLastError.KERNEL32 ref: 00000257414A09D7

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction ID: a0f9595786dd8caf4f3b3a592d6a2918f8323a6091b92067a1ffc94ca63f90d5
Opcode Fuzzy Hash: 9219a76bbf5b0a68fd8075754a2c2160bfaa822f6e476498c8a23ea95eed312f
Instruction Fuzzy Hash: 6DC1D137728E4086EB10EFA9E8947AC3771F349BA9F120305DE2AAB394CB34C451C344

Function 0000025741446350 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

directory_iterator::directory_iterator, xrefs: 000002574144A853, 000002574144A875, 000002574144A8AD
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000002574144A68F, 000002574144A6C9, 000002574144A81F
status, xrefs: 000002574144A600, 000002574144A6D9, 000002574144A790, 000002574144A863, 000002574144A885, 000002574144A89B, 000002574144A8BD
cannot use push_back() with , xrefs: 000002574144A625, 000002574144A6FE, 000002574144A7B5
recursive_directory_iterator::operator++, xrefs: 000002574144A678, 000002574144A745, 000002574144A808
exists, xrefs: 000002574144A5DE, 000002574144A6AC, 000002574144A76E, 000002574144A83C

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction ID: 79dc4effc579e9a2adbb1512dd7c863efc2313b3c057a27046b968809f40a6ff
Opcode Fuzzy Hash: de5a621f2f067d1123de94e788919e3c44fbe91b6b887da37095cf4d544f4034
Instruction Fuzzy Hash: F5D20272659FC886D6709B19F88139BB3A0F7D8784F505225EACC63B59EB7CC254CB08

Function 00000257414120B0 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000025741412409
RegQueryValueExA.ADVAPI32 ref: 000002574141244E
RegCloseKey.ADVAPI32 ref: 00000257414124F7

Strings

directory_iterator::directory_iterator, xrefs: 0000025741412C64
filename, xrefs: 0000025741412787
content, xrefs: 0000025741412915
exists, xrefs: 0000025741412C42

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 3677997916-1400943384
Opcode ID: 68768bc645ac95e4c95eb440dc93f8c540b607143ad5665fe4d970794abdf418
Instruction ID: f36318809a494d7a90203699e0dac56f9221c3b041e9da9cee520c0a18dd5e7c
Opcode Fuzzy Hash: 68768bc645ac95e4c95eb440dc93f8c540b607143ad5665fe4d970794abdf418
Instruction Fuzzy Hash: 11724B72654FC489EB209F39E8843DD77B0F789799F209215EA9C6BB99DB34C680C344

Function 000002574145F020 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000002574145F261
SetFilePointer.KERNEL32 ref: 000002574145F314
ReadFile.KERNEL32 ref: 000002574145F343

Strings

ios_base::badbit set, xrefs: 000002574145F771, 000002574145F7EF
ios_base::failbit set, xrefs: 000002574145F77D
ios_base::eofbit set, xrefs: 000002574145F784
exists, xrefs: 000002574145F7CA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 8a6d885830327671914bb6c3149c98cc56e027b430994eaa85517cbf64ee3189
Instruction ID: 77b27332112121020a95218ff5df254ff699ca081c15ae9a860f089a473e8d69
Opcode Fuzzy Hash: 8a6d885830327671914bb6c3149c98cc56e027b430994eaa85517cbf64ee3189
Instruction Fuzzy Hash: 09323322658BC489EB20DF28EC943DD37B1F785B89F408216DB4D6BB99EB74C645C305

Function 00000257414830B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000257414830E6

Part of subcall function 0000025741482548: _invalid_parameter_noinfo.LIBCMT ref: 000002574148255C

_get_daylight.LIBCMT ref: 00000257414830F7

Part of subcall function 00000257414824E8: _invalid_parameter_noinfo.LIBCMT ref: 00000257414824FC

_get_daylight.LIBCMT ref: 0000025741483108

Part of subcall function 0000025741482518: _invalid_parameter_noinfo.LIBCMT ref: 000002574148252C

Part of subcall function 000002574147D3C8: HeapFree.KERNEL32 ref: 000002574147D3DE
Part of subcall function 000002574147D3C8: GetLastError.KERNEL32 ref: 000002574147D3E8

GetTimeZoneInformation.KERNEL32 ref: 000002574148312F

Strings

Eastern Summer Time, xrefs: 00000257414831ED
Eastern Standard Time, xrefs: 00000257414831D5

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction ID: 5ff00438f95f5bedb3acb8fc371d11c080caa19486d6339ad68a4d01251f7fcc
Opcode Fuzzy Hash: a0b2f147c5ed72e73a9ba99eccd64d774068bd057930b9dd808764ab5dc4e304
Instruction Fuzzy Hash: 6F51B63A698E4086E710FF2AFD88799B770F748786F455125EA4D63F96DB38C440C748

Function 000002574147918C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257414791AE
_get_daylight.LIBCMT ref: 000002574147920E
_get_daylight.LIBCMT ref: 000002574147921F
_get_daylight.LIBCMT ref: 0000025741479230
_isindst.LIBCMT ref: 0000025741479281
_isindst.LIBCMT ref: 00000257414792D4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction ID: f988c5f103ea1d132d13c465a34da973818dcc0e9908966f5ec3f6b9fb665f60
Opcode Fuzzy Hash: cd6fea744430340711cd49b3e9bdbfdb1b852b0eb5a7692198664b91c055b650
Instruction Fuzzy Hash: 92812DB3744B454BEB58AF7CED093A833B5E754B9AF049139DA099BB89EB38D400C744

Function 0000025741429F80 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002574142A134
__std_exception_destroy.LIBVCRUNTIME ref: 000002574142A142
__std_exception_destroy.LIBVCRUNTIME ref: 000002574142A3C5
__std_exception_destroy.LIBVCRUNTIME ref: 000002574142A3D3

Strings

value, xrefs: 000002574142A05A, 000002574142A2F3

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: a2a9cf4f55d7cd52c19a97d3e34afe1538980acb87aee68f786d4bc6a835557a
Instruction ID: 18553227906a875220e42a2d626c875b595c8a3adb6cfd4ce7e9e751ab0eb58f
Opcode Fuzzy Hash: a2a9cf4f55d7cd52c19a97d3e34afe1538980acb87aee68f786d4bc6a835557a
Instruction Fuzzy Hash: DC029062668FC085EB00EB78E8883AD6771E7857E5F205251FA9D23BDADB78C1C5C704

Function 000002574141E610 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002574141E65A
Process32FirstW.KERNEL32 ref: 000002574141E69C
Process32NextW.KERNEL32 ref: 000002574141E893
CloseHandle.KERNEL32 ref: 000002574141EB0A

Strings

[PID: , xrefs: 000002574141E6DE

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 12e82fd6f53b6948c2f59faf1b5c19f0e0070b98848420f9bfaf1ad188466b2a
Instruction ID: 412e6812f6556b0d12a4651896a62227108a54a4b60712acc6d583698fc3435b
Opcode Fuzzy Hash: 12e82fd6f53b6948c2f59faf1b5c19f0e0070b98848420f9bfaf1ad188466b2a
Instruction Fuzzy Hash: 53E1AF72658FC085EB21EB29E8883DD77B5F3897A5F504215EA9D27B99DF38C280C704

Function 000002574146B9B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002574146B9FE
OpenProcessToken.ADVAPI32 ref: 000002574146BA11
LookupPrivilegeValueW.ADVAPI32 ref: 000002574146BA32
AdjustTokenPrivileges.ADVAPI32 ref: 000002574146BA78
CloseHandle.KERNEL32 ref: 000002574146BA98

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction ID: 1971dc1cd83cc6f7422aa258ba63001fc0bfeb27cc71006e026f1733ef61cb79
Opcode Fuzzy Hash: d2de06470b4ed8e39d37734a47601b9eff7cf65b32299141bc4bcc42cf026e17
Instruction Fuzzy Hash: 5821AD72218F8082E760DF66F84835AB3B0F788B85F998125EA8967B58DF7CC544CB44

Function 000002574144D080 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000002574144DE23, 000002574144F4A4
status, xrefs: 000002574144DE11, 000002574144DE33, 000002574144DE5B, 000002574144DE83
cannot use push_back() with , xrefs: 000002574144DDD5
exists, xrefs: 000002574144F48D
prefs.js, xrefs: 000002574144E5E2

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 530093359433c2104b27cd2024875a0caaa98504d8860aec8f3fc6e35a1c616a
Instruction ID: e7dd2b128ec14d938aaad85d24a6048a4b01bfd0016a22e3d17164b162946242
Opcode Fuzzy Hash: 530093359433c2104b27cd2024875a0caaa98504d8860aec8f3fc6e35a1c616a
Instruction Fuzzy Hash: C3524532689FC484E6B1AB19F8853DAB3A4F7C9791F505225DACC63B59EF38C194CB04

Function 0000025741464A30 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000025741464C0C
recv.WS2_32 ref: 00000257414650EC
closesocket.WS2_32 ref: 00000257414650FE
WSACleanup.WS2_32 ref: 0000025741465104

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 291ab67ec37c4886968f7cfee0b6914d163485efd4581897f4bc263c6bc3d4b3
Instruction ID: 42fd6cd965f22a1e0906bfa82e25397faf3513e4eb32994c8f801e01eb1c4c7e
Opcode Fuzzy Hash: 291ab67ec37c4886968f7cfee0b6914d163485efd4581897f4bc263c6bc3d4b3
Instruction Fuzzy Hash: 951283B265CFC081EA21AB19F8583DEA771F7997A5F104601EAAD17ADADF7CC480C704

Function 000002574141CA10 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000002574141CA72
CredFree.ADVAPI32 ref: 000002574141D496

Strings

cannot use push_back() with , xrefs: 000002574141D4E4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 0331d4039e2689bd0f1e0fe0fb631d56562d39c931422b286e1f31765caf7a05
Instruction ID: 3f238d6fe2ce27e48d92303ccc074bf41cfa052ac11387bbd696bb0e9649acba
Opcode Fuzzy Hash: 0331d4039e2689bd0f1e0fe0fb631d56562d39c931422b286e1f31765caf7a05
Instruction Fuzzy Hash: BA626E72654FC489EB209F69EC883DD7771F7897A8F504215EAAC27B99DB34C284C704

Function 00007FF7564034C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF756403527
NtProtectVirtualMemory.NTDLL ref: 00007FF756403591

Strings

0, xrefs: 00007FF756403507

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction ID: 6820346bdfd82e4e1cea10727c1ef5c488e19b3f490b334caa01c14313cc03f2
Opcode Fuzzy Hash: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction Fuzzy Hash: 3F215136A18B8586E750DB14F85031BB7A5FB887A4F940335EAAD03BA8DF7DD144CB10

Function 00000257414676A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00000257414679D0

Strings

[UTC, xrefs: 00000257414679A3

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: d9464a4284bb91225a1d7d0a54c87c35ecca44aa388f45f9a5593c8af6dcd576
Instruction ID: c706ff1620a8311c11e38328446ba55ce744b331f7b97ae15aeaeb58f10dea1a
Opcode Fuzzy Hash: d9464a4284bb91225a1d7d0a54c87c35ecca44aa388f45f9a5593c8af6dcd576
Instruction Fuzzy Hash: 9CB16B32619FC88AD7718F29E84029AB7A4F79C788F105315EBCC57B59EB78C290CB44

Function 0000025741457BA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000025741457BF8
LocalFree.KERNEL32 ref: 0000025741457C8A

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction ID: 28192617d250184835470b82a20a2054be1aa038fb92f8b091ebbea280a543f7
Opcode Fuzzy Hash: 3f0d2640eba4d0f7871c2ec703edcb503dbe0d7ea7d03094cd3af9045bbe76bf
Instruction Fuzzy Hash: 28416932658B80CEE3209F78E8543DD37B4F75878CF454229EB8816E8ADB79C1A4C748

Function 00000257414673F0 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000025741467461

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 8e3b062baa65b3adcedbfaa3c8c3a2baafa25a4fda972cf0885935351d305318
Instruction ID: 9f45f730cdb132153591f3f39d5ba2b313ae35c4dc4c9153a63d8955a3965fb4
Opcode Fuzzy Hash: 8e3b062baa65b3adcedbfaa3c8c3a2baafa25a4fda972cf0885935351d305318
Instruction Fuzzy Hash: B351D272A58F8082E710DF28F88439EB7B1F7847A8F105205EA9C23AA9DB7CD591D744

Function 0000025741466150 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000025741466195

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: abf913a544c6f9fdd308559da787f240108ca61f3614bb29fccc85bbbd2848d6
Instruction ID: b55e2cd147f5c7ed129d740369b7ccb031bf4ef7bf7b24737440e2354acdb035
Opcode Fuzzy Hash: abf913a544c6f9fdd308559da787f240108ca61f3614bb29fccc85bbbd2848d6
Instruction Fuzzy Hash: 6801807265CB8082E761DF25FC4439EB3B0F798788F440221EA8D52A59DBBCC194CB48

Function 0000025741466860 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 0000025741466ABE

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: fe515266003fe55dfc7e8ae5ee8a2d40e19cf9c944be5782509e409a5110e389
Instruction ID: 6d0bd90e7233971dcf4de18ba805bf910e68486792d47b1ef887af45403ac4a2
Opcode Fuzzy Hash: fe515266003fe55dfc7e8ae5ee8a2d40e19cf9c944be5782509e409a5110e389
Instruction Fuzzy Hash: 6CC1E5A3E58F808AF710DF78E84439D7771E3997A8F105305EE9826A9ADB78C185C344

Function 000002574146D050 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000002574146D242

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 9ac3e7affe24433a80f30ef63aa62ecbe97607ee0ab98c7cb77dcaf1733d29dc
Instruction ID: 451dac307cbfc6356c049f0e47986e72f127d056f9615f6441e9ffdf29cba163
Opcode Fuzzy Hash: 9ac3e7affe24433a80f30ef63aa62ecbe97607ee0ab98c7cb77dcaf1733d29dc
Instruction Fuzzy Hash: 2D8128A2748E8481EB50EB6AF9587AE6770F785B89F448022DF8E23795DF3CC515C308

Function 000002574146C5CB Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 000002574146C6B1, 000002574146C75E

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: b93e25f0a904a3fdb20e69b3e425758cacba5d6e5c85d4380c12b44ffc6d98ea
Instruction ID: 307e01f57ebefe760250583a68274248110135103fdc878b207e5bbe763adf07
Opcode Fuzzy Hash: b93e25f0a904a3fdb20e69b3e425758cacba5d6e5c85d4380c12b44ffc6d98ea
Instruction Fuzzy Hash: 8D9102B6308A8581DB20AF2AE59879E77B1F789FC9F449002CB9E17B64CF39C559C704

Function 0000025741425310 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0000025741425399

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction ID: 53f2927d84f294f9b32bc2df0907f719b80bf6dac084cf4aff7c4c020972eeb4
Opcode Fuzzy Hash: a7242879f608aa47813c865fc74e262a7c273f84777ad565790803f492419e94
Instruction Fuzzy Hash: 1D41D26361DAE04AD702CB39941137DBFB2E366B89F1C8192EBD49B746D63DC246CB10

Function 000002574141ECB0 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16929085a2809700f7e6120af2448b151afb213f61650590a721622a5fc3bec1
Instruction ID: 7db7ce65c4c9e4e1eebb8d249f8a9a370016a14f5ca96b6ae3601b7396a5d4da
Opcode Fuzzy Hash: 16929085a2809700f7e6120af2448b151afb213f61650590a721622a5fc3bec1
Instruction Fuzzy Hash: 3E727972A58FC489EB20DB69E88439D73B1F789798F504315EE9C27B99DB38C285C704

Function 000002574140F730 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36858761d405c8643adca0cf25a5f486efcbae373011479bc70ee2842979bacb
Instruction ID: 23d9b5ac648052cea429ca508ced331c6bc103f92d222c8fb36d98ea53e11372
Opcode Fuzzy Hash: 36858761d405c8643adca0cf25a5f486efcbae373011479bc70ee2842979bacb
Instruction Fuzzy Hash: 71F16072A59F848AEB209B69F84535D77B0F78C7A8F104315EEDC57B99EB38C1908B04

Function 000002574140FE20 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c8e505c1d7a2333d561fde428fcf7b6707646c04ef95b1d6c81df208e18fc9
Instruction ID: 78137c0dbb64bdb356f99147aece4ebdae2d92aa0cfc23f9f7e0436e25a3af48
Opcode Fuzzy Hash: d5c8e505c1d7a2333d561fde428fcf7b6707646c04ef95b1d6c81df208e18fc9
Instruction Fuzzy Hash: E2F15072659F888AEB208B69F84435D77B0F388798F204315EEDC67B99EB38C180C744

Function 0000025741410450 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f4003e368775a12f3e26b8bcd7a19ab426d4c5a44f7e389710894b07600909
Instruction ID: b90badb3e4f92195de6ac3ec3b8a25ccb247c4e0aa4dff5d68dd8b4f7139cdba
Opcode Fuzzy Hash: a4f4003e368775a12f3e26b8bcd7a19ab426d4c5a44f7e389710894b07600909
Instruction Fuzzy Hash: D7F16172A59F848AEB208B69F84535D77B4F38C7A8F100315EEDC57B99EB38C1908744

Function 0000025741411B90 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12017943797bcc216a0679c74680cc699fdba263cc3b3351d69ab3b0d2667b8
Instruction ID: a0e1673bbc8b8cbe3bcdf10efeff0fba0e890bbdb56f3ec8ad3fabaad5e83ca5
Opcode Fuzzy Hash: d12017943797bcc216a0679c74680cc699fdba263cc3b3351d69ab3b0d2667b8
Instruction Fuzzy Hash: 33D19032B98F8089F710DBB8E8483EC37B2E75579CF115255EA4C36B9ADB349195C388

Function 000002574145EBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002574145E970: InitializeCriticalSectionEx.KERNEL32 ref: 000002574145E9C1
Part of subcall function 000002574145E970: GetLastError.KERNEL32 ref: 000002574145E9CB

EnterCriticalSection.KERNEL32 ref: 000002574145EC31
GdiplusStartup.GDIPLUS ref: 000002574145EC58
LeaveCriticalSection.KERNEL32 ref: 000002574145EC66
LeaveCriticalSection.KERNEL32 ref: 000002574145EC94
GdipGetImageEncodersSize.GDIPLUS ref: 000002574145ECA2
GdipGetImageEncoders.GDIPLUS ref: 000002574145ED36
GdipCreateBitmapFromScan0.GDIPLUS ref: 000002574145EE00
GdipSaveImageToStream.GDIPLUS ref: 000002574145EE1E
GdipDisposeImage.GDIPLUS ref: 000002574145EE83
GdipDisposeImage.GDIPLUS ref: 000002574145EE97

Strings

&, xrefs: 000002574145EDFA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction ID: fe862fda0a3d46b00af2d4ddaa428d116d8ac163e2f1c58a2f1f9da9499c80e8
Opcode Fuzzy Hash: dd964381881d80bb3d13f7f21f812b9ad7ab8c9b9795b3d442a88d8ae0dd4017
Instruction Fuzzy Hash: 3B917C32344E418AEB20EF28FC18798B7B0F7587AAF564615EF096BA94DB34C645C348

Function 000002574145FCA0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000257414658D0: GetUserGeoID.KERNEL32 ref: 00000257414658F7
Part of subcall function 00000257414658D0: GetGeoInfoA.KERNEL32 ref: 0000025741465911
Part of subcall function 00000257414658D0: GetGeoInfoA.KERNEL32 ref: 0000025741465961

WSAStartup.WS2_32 ref: 000002574145FDBE
socket.WS2_32 ref: 000002574145FDDB
htons.WS2_32 ref: 000002574145FE00
inet_pton.WS2_32 ref: 000002574145FE42
connect.WS2_32 ref: 000002574145FE5C
closesocket.WS2_32 ref: 000002574145FE7B
WSACleanup.WS2_32 ref: 000002574145FE81

Strings

system, xrefs: 000002574145FD2A
geo, xrefs: 000002574145FD6B

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: dd839d3d8d5df49058ab2b6196a7efd16563513751f89a78c1e98554545a861d
Instruction ID: 55c02581eb6822a0610e36e894131dfa59c3724fd1a488d8051e8ea2f438c191
Opcode Fuzzy Hash: dd839d3d8d5df49058ab2b6196a7efd16563513751f89a78c1e98554545a861d
Instruction Fuzzy Hash: 68B1B062B98E8085FB00EBB9FC583DC3372A7447AAF415216DE1D37AE9DA34C546C348

Function 000002574148092C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000025741480D59

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction ID: 5d46f80895b03e57a5109b90d46ebc7d28f7253444c641acb137db4b2bad9e6b
Opcode Fuzzy Hash: f3fc50aa6c1617f97820c214b6f357f8593fa625a947542fe4ec2dfdbb2d532b
Instruction Fuzzy Hash: F5C1F5362ACF8481F761AF5DBC083AD77B4F781B92F550111DA5927B91CB78C845C329

Function 000002574145EA50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000002574145EA93
EnterCriticalSection.KERNEL32 ref: 000002574145EAA5
EnterCriticalSection.KERNEL32 ref: 000002574145EAB5
GdiplusShutdown.GDIPLUS ref: 000002574145EAC3
LeaveCriticalSection.KERNEL32 ref: 000002574145EAD0
LeaveCriticalSection.KERNEL32 ref: 000002574145EADA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction ID: 615b0224bbcb6efcef1cd6bc261929fe564cc91eba6fa37679f2696cb9bf7263
Opcode Fuzzy Hash: f5a1ecfcc53808b035d0d15b7c47fae7049546fa7d089acffeffd9e0bb2d86bb
Instruction Fuzzy Hash: 1B116A32206F4081EB14EF69FC58118B374FB48FA6B684615EA6D262A4CF38C996C744

Function 00007FF756417980 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF756417C00: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF756417C0E

Part of subcall function 00007FF756406610: char_traits.LIBCPMTD ref: 00007FF75640663D

Part of subcall function 00007FF756417DC0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF756417ED5

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF756417AFA

Strings

EnterCriticalSection, xrefs: 00007FF7564179FC
LeaveCriticalSection, xrefs: 00007FF7564179C5
LoadAcceleratorsW, xrefs: 00007FF756417A33
LoadAcceleratorsA, xrefs: 00007FF756417A73

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ProcessorReentrantScoped_lockScoped_lock::~_Virtual$Concurrency::RootRoot::char_traits
String ID: EnterCriticalSection$LeaveCriticalSection$LoadAcceleratorsA$LoadAcceleratorsW
API String ID: 2378420206-1394853731
Opcode ID: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction ID: 3b80584d0220ed13193e1f06b005b3302c4ee2dbde85209324ff3ed4758f539f
Opcode Fuzzy Hash: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction Fuzzy Hash: 46511F7255D98691EA30FB54E8513EBE360FBD0344F941432E28D47AAADF3CD649CB90

Function 00007FF756417FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7564180EF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF756418197

Part of subcall function 00007FF7564577D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457824
Part of subcall function 00007FF7564577D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457865

Strings

1.3.1.zlib-ng, xrefs: 00007FF75641802D

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ExceptionFileHeaderRaise
String ID: 1.3.1.zlib-ng
API String ID: 543713560-992988628
Opcode ID: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction ID: fa8cb291644f783f04d6f5a02c65c63794f89817b46dce4c15ac0cdd018262e5
Opcode Fuzzy Hash: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction Fuzzy Hash: BF61383261CA818AD670EB14E8513EBB3A0FBC8344F940135E6CD87A99DF3CD644CB50

Function 0000025741466460 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00000257414664C9

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00000257414664BB
ProductName, xrefs: 00000257414664B4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction ID: 60db4164e4336c056875d81abc1d3b01af12673285799154366cd8bd9ce0e473
Opcode Fuzzy Hash: ca02e5c3ed8e0fc6be14c1ad152ff79eaac3ff22c286f7938fb5c96ca43ff221
Instruction Fuzzy Hash: 4B115E32648B8082EB20DF25F84939AB3B4F799788F504216EA9C57B59DFBCC155CB44

Function 0000025741464DB7 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000257414650EC
closesocket.WS2_32 ref: 00000257414650FE
WSACleanup.WS2_32 ref: 0000025741465104

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: b571f2713da83870eaa957895cad21978606f6aafd953b6e90a0d736581c1e0c
Instruction ID: 4f3910d715327e626c8411f9b6af413c10e43baeb3f67ee01df79655f163ba1b
Opcode Fuzzy Hash: b571f2713da83870eaa957895cad21978606f6aafd953b6e90a0d736581c1e0c
Instruction Fuzzy Hash: 709193B3A58FC081EA21AB19F85839E6771E7997E5F105301EAAC27AD9DF7CC481C704

Function 0000025741467151 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000025741467169
RegEnumKeyExA.ADVAPI32 ref: 00000257414671AE
RegCloseKey.ADVAPI32 ref: 00000257414673A4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 8e5eb19068908a0246fe692763bd47c61a41966e209536983c2467e7175155ec
Instruction ID: dbb06d4b97d4decff6aeb5363460bfb726acf6481f0e6bce437afc9c73e36d92
Opcode Fuzzy Hash: 8e5eb19068908a0246fe692763bd47c61a41966e209536983c2467e7175155ec
Instruction Fuzzy Hash: 247180B2A48F8585EB10EB69F84839D6770F7857A9F104206EFA927AD9DB78C0C1C704

Function 00007FF75640D7F0 Relevance: 4.6, APIs: 3, Instructions: 112COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF75640D8DD
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF75640D9C0
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75640D9E9

Part of subcall function 00007FF756406610: char_traits.LIBCPMTD ref: 00007FF75640663D

Part of subcall function 00007FF75640DAA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75640DAB8

Part of subcall function 00007FF75640DB00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75640DB13

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue$char_traits
String ID:
API String ID: 2573577243-0
Opcode ID: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction ID: d099b7c617f92339ad0338b12db1df866f84b52e712c214622ae3dcf87087ba9
Opcode Fuzzy Hash: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction Fuzzy Hash: 6151296660CBD291DA20BB15E8513EBB360FBC4790F844032E6CD4BB6ADF2CD649CB50

Function 00000257414670E0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000025741467169
RegEnumKeyExA.ADVAPI32 ref: 00000257414671AE

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction ID: 024a5d60880309542e65d1b5a9e64f63eba62b26249ca43d12bf0bac85a4179c
Opcode Fuzzy Hash: d80f14cf87453080268adb68deae75d6ba4fc3d7dfc0e44dc0fd8621660a0c44
Instruction Fuzzy Hash: 7F318D72654B8586E720DFA9FC4879E7374F78479DF200215EE9927B54DB38C192C704

Function 00007FF7564117D0 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CallMemberFunction0.LIBCPMTD ref: 00007FF756411850
_CallMemberFunction0.LIBCPMTD ref: 00007FF7564118CD
_CallMemberFunction0.LIBCPMTD ref: 00007FF756411928

Part of subcall function 00007FF75640A560: char_traits.LIBCPMTD ref: 00007FF75640A593

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: CallFunction0Member$char_traits
String ID:
API String ID: 1927575840-0
Opcode ID: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction ID: 413dd22e5bdb739aa61dd4a93082f20f2406d78c114ceada7c64da171f8bcbc0
Opcode Fuzzy Hash: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction Fuzzy Hash: 5A318275A0DA4285E620FB21EC5017BF7A1FB85784F984135E2CD47696EF7CE600CBA0

Function 0000025741466E1B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000025741466E37
RegQueryValueExA.ADVAPI32 ref: 0000025741466E76
RegCloseKey.ADVAPI32 ref: 0000025741466F14

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8656d0007ab639087827527d9889e82898aae9a570ea373c7e4ee7fdbf52c9ac
Instruction ID: 4f91431576de9b5c5275ea8d8f775fdead016812a0c28b0dba70c6b1a11223b1
Opcode Fuzzy Hash: 8656d0007ab639087827527d9889e82898aae9a570ea373c7e4ee7fdbf52c9ac
Instruction Fuzzy Hash: 8621D4B2758F8081EE60EB29F85436EA370F7C57E9F405211FA8D52A99DE3CC084CB04

Function 00007FF7564182A0 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7564182DB
OpenProcessToken.ADVAPI32 ref: 00007FF7564182EE
GetTokenInformation.KERNELBASE ref: 00007FF756418336

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction ID: ead7d553596cced532dcdbd6529b6e0cc69d6aa5ac8d006a689631e7f641646f
Opcode Fuzzy Hash: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction Fuzzy Hash: 49214A6262C68185EB40EB10E8543AFBB60FB82344FD81035F68E47A99DF3DD609CB60

Function 00000257414658D0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00000257414658F7
GetGeoInfoA.KERNEL32 ref: 0000025741465911
GetGeoInfoA.KERNEL32 ref: 0000025741465961

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction ID: 03fa9d2b828edda5407fab165a55d261d6b4fed1ad038842f8aada1490b28fec
Opcode Fuzzy Hash: 877c1b4e073b3a87c3d7ac6068cbd316133fc0437c9f32c249d117db553f0db1
Instruction Fuzzy Hash: 73119D32A18B8182D7509F65F81471EB7A2F780BC9F045125EB8517B59DF7CD490CB48

Function 000002574145F820 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002574145F85B
OpenProcessToken.ADVAPI32 ref: 000002574145F86E
GetTokenInformation.ADVAPI32 ref: 000002574145F8AA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction ID: ca6f3401c362c69ef0b8434207f87e25cf6c6c1a04665562aa4400909c8d8400
Opcode Fuzzy Hash: 1c225c442ed3ae12c114120d81f2afce391d37106ff629cfd40a7a8c2f449ed4
Instruction Fuzzy Hash: 7A112B32658F8082E750AF1AF85435BB3B0F788B81F559125EB99A7B68CF3CC405CB44

Function 0000025741484F60 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000025741484F71
TerminateProcess.KERNEL32 ref: 0000025741484F7C
ExitProcess.KERNEL32 ref: 0000025741484F8B

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3909df8ddc6717e2b276abcc8b7868d121cee5230461283d2778d4ce90183b93
Instruction ID: 99e6124b0dcb84396436d418f7844054df69cd408a6556b6a86bd571e11f9180
Opcode Fuzzy Hash: 3909df8ddc6717e2b276abcc8b7868d121cee5230461283d2778d4ce90183b93
Instruction Fuzzy Hash: 00D09E14798F0452EB59BBB8BCAD36C52795B99717F48142C9A032A793CD3984494208

Function 0000025741421EB0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574142209C

Strings

, xrefs: 0000025741421F33

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: 447391518ede7914d4c29b4a62a83f77a5c4a6751e45bdb10a96ec0dd38cbb10
Instruction ID: d668009f79587e8e03dfdeb64ad9c0c04aa43858da235ceca3add72948d24f15
Opcode Fuzzy Hash: 447391518ede7914d4c29b4a62a83f77a5c4a6751e45bdb10a96ec0dd38cbb10
Instruction Fuzzy Hash: 3B516872248F4496EA159F2AE89835C33B1F388BD5F554622CB5D63BA4CF79C0A1C304

Function 0000025741466C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 0000025741466CAC

Strings

Unknown, xrefs: 0000025741466D66

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 9620c529eb467c2ec69f9554772d2bcda9f57316b6868f94ab05b6f1bde0fce9
Instruction ID: 956675653dddadfe0e5eb2ae5cae39dfabbf51d9d71077e2cfa9389577d17f92
Opcode Fuzzy Hash: 9620c529eb467c2ec69f9554772d2bcda9f57316b6868f94ab05b6f1bde0fce9
Instruction Fuzzy Hash: AC31ED2362CFC086E710DF29F84439AA770F799B88F541215FBC922A0ACB7CC695CB04

Function 00007FF75640FAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_CRT_INIT.LIBCMTD ref: 00007FF75640FB9A

Strings

@, xrefs: 00007FF75640FB6E

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction ID: 1287d972d62093bed46ef9ef29e3f01374857592c87ad9a97f8e4cf56997c84c
Opcode Fuzzy Hash: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction Fuzzy Hash: 1631C73661CB918AD7A0EB25E85062BBBE1F788794F540535FA8D87B58DF3CD6408F10

Function 0000025741428560 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000257414286A0
Concurrency::cancel_current_task.LIBCPMT ref: 000002574142879F

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: ab78ee7b280dee4b339cfacbdd5f4efef219837c15ca3b66dc2c74eeaae5e93f
Instruction ID: 6162c231d2561c6e01ff7abdca4e03f7d8798b372805bb1a9476e900c664cf0c
Opcode Fuzzy Hash: ab78ee7b280dee4b339cfacbdd5f4efef219837c15ca3b66dc2c74eeaae5e93f
Instruction Fuzzy Hash: C0512A623C9F4185FE24BB19BD0839C62B1E744BF6F5806209E6D2B7D6DE78C1D28308

Function 000002574145EED0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000002574145EF29
CoTaskMemFree.OLE32 ref: 000002574145EFEA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: ae204a587ab0ef826eab955bf18b5cfd079d10c08874d19813b769850f893d30
Instruction ID: 365932dd2a0d031efcd143ca1572c5ca80e404d63b6825eafa7aeae71da45275
Opcode Fuzzy Hash: ae204a587ab0ef826eab955bf18b5cfd079d10c08874d19813b769850f893d30
Instruction Fuzzy Hash: 86317272A58B8081E620DF29F89435EB771F7997F4F205315FAAC23A99DB7CC1818B44

Function 0000025741474648 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002574147466F

Part of subcall function 0000025741474604: _invalid_parameter_noinfo.LIBCMT ref: 000002574147461B

_invalid_parameter_noinfo.LIBCMT ref: 0000025741474723

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction ID: 66318e1ffa8d42be2c33b1da68342f95810bfdeaeebc34313f7ec7345797f21e
Opcode Fuzzy Hash: 77ff38050bbf038ec147631c291faae903e00292372ea36fba1d268a897535c6
Instruction Fuzzy Hash: 3031C132299E4482EE51FB18FC597BD7371E795B92F590111E62E673D2EB38C501C308

Function 000002574145D510 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002574145D561
RegCloseKey.ADVAPI32 ref: 000002574145D573

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction ID: e7175152095e1c2c6b487f3f809073c3e39700480df718b98bbc46c3d0d91d93
Opcode Fuzzy Hash: f1dca321947a1367f0d55f51290a78f41f5e328790fa86022a41bb21031095aa
Instruction Fuzzy Hash: 29212961758E8441EE50EB2AFC5839AA370EB88BC9F094121FE4D27B99DF38C081C708

Function 000002574145C7CC Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000002574141E610: CreateToolhelp32Snapshot.KERNEL32 ref: 000002574141E65A
Part of subcall function 000002574141E610: Process32FirstW.KERNEL32 ref: 000002574141E69C

Part of subcall function 000002574141CA10: CredEnumerateA.ADVAPI32 ref: 000002574141CA72

Part of subcall function 0000025741464A30: recv.WS2_32 ref: 0000025741464C0C

ReleaseMutex.KERNEL32 ref: 000002574145C83B
CloseHandle.KERNEL32 ref: 000002574145C844

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: bece3b694530cfbeca66faa9e7e0d6adff72bc4c5de40ce38d1c4fa0504811a1
Instruction ID: c798633d720528393ab3cb6f9a8f2775db45729044b78ccb6405f083855d1df3
Opcode Fuzzy Hash: bece3b694530cfbeca66faa9e7e0d6adff72bc4c5de40ce38d1c4fa0504811a1
Instruction Fuzzy Hash: 4A21E661ACCE8041F911B7BCBC2F3ED5274AF853A3F265A10EA59355D79E388040952D

Function 000002574145C7FD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000025741464A30: recv.WS2_32 ref: 0000025741464C0C

ReleaseMutex.KERNEL32 ref: 000002574145C83B
CloseHandle.KERNEL32 ref: 000002574145C844

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: dd2cc705cdbd18044620e585c3dda16eabb8828c2173ec8563691370528ef67d
Instruction ID: 064675dea1a61902c573278f63bc9c8ada83d8d6e8859623fad9cf465103147c
Opcode Fuzzy Hash: dd2cc705cdbd18044620e585c3dda16eabb8828c2173ec8563691370528ef67d
Instruction Fuzzy Hash: B311E562ACCE8041F911B77CFC2E39D52B0AB857A3F155600EEA9766D79E38C080D61D

Function 0000025741480E9C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 0000025741480EE8
GetLastError.KERNEL32 ref: 0000025741480EF2

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction ID: c58437a8a4d4c519177b78fc0e2aba4442f7c95cefec4c499d54aa1eb85cf7e6
Opcode Fuzzy Hash: 85342b8448b5f83962e520861b5040a532baca975cc467821ece28218af4e603
Instruction Fuzzy Hash: C9119166228F8081DB50EB29B81826AA3B1E745BF5F584311EE792BBD9CF78C451C744

Function 00007FF75640D750 Relevance: 3.0, APIs: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF75640D768
GetProcAddress.KERNEL32 ref: 00007FF75640D789

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction ID: a9173f560edd53e05a0ee093795054bce0d4fc00625b62c743bc88fa1361cea1
Opcode Fuzzy Hash: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction Fuzzy Hash: 3601277A51CB9585D760AB11E88032BBBA0F7887A4F541535E6CE46B68CF3CC2988B14

Function 000002574148E888 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574148E8B8

Part of subcall function 000002574148F8DC: std::bad_alloc::bad_alloc.LIBCMT ref: 000002574148F8E5

Concurrency::cancel_current_task.LIBCPMT ref: 000002574148E8BE

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction ID: 58ec4745b2c2bef0a437be6cf9e0a96dab75869725da3b1c63a7fa45bd80a546
Opcode Fuzzy Hash: ad7fb39d7d0572768195cdb96d88edf57c93c5d00d8eaa663e4c704e5b7bea2c
Instruction Fuzzy Hash: 4CE01208BE9D0945FD2932BE3D1D37901700F89373E1C1B2059757AAD3AA348691825C

Function 00007FF756445810 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00007FF756445929,00007FF75644ACD6,?,?,?,00007FF75644B053,?,?,00000000,00007FF75644B9B9,?,?,?,00007FF75644B8EB), ref: 00007FF756445826
GetLastError.KERNEL32(?,?,00007FF756445929,00007FF75644ACD6,?,?,?,00007FF75644B053,?,?,00000000,00007FF75644B9B9,?,?,?,00007FF75644B8EB), ref: 00007FF756445830

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction ID: 8672d995eaa1d690921cf5001f774aa0af2a7f1b02c50ddf6cdf718f5bb3ca78
Opcode Fuzzy Hash: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction Fuzzy Hash: 3EE08690F1868242FF0C7BB2AC5707796515F85742FCC4430CC0D42291FE6C66614730

Function 000002574147D3C8 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000002574147D3DE
GetLastError.KERNEL32 ref: 000002574147D3E8

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction ID: 8884740e962e5c1a52af35c2ed9b38e8189730c34be2b2e4c87f8c4bdf84ed34
Opcode Fuzzy Hash: b7253a55b1276d1b57d670979138b52c86c30a15e8b70f9b8b054cc625f4c6ce
Instruction Fuzzy Hash: 1FE02B40F9EE0082FF0CB7FAFC0C37402B15F84703F4844208825B6252ED384881C308

Function 000002574146F150 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574146F3A0

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d63ebc105d5abc37252f6722bce4805a7eacf3ede7e52188f506b751404bdf16
Instruction ID: 9f281c768b4845a970f0772fc8cdcdf6ffec8435da24b2b81b62a89b3e050528
Opcode Fuzzy Hash: d63ebc105d5abc37252f6722bce4805a7eacf3ede7e52188f506b751404bdf16
Instruction Fuzzy Hash: C761DDA6348E8084EA14EF1AE96836D27B1E305FDDF548511CEAD277D5DB3DC886C328

Function 000002574140E2A0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000002574140E3D3

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 78e5213647ace45075edf6087831abaa0f8ba198e697805de991843f31cd1620
Instruction ID: ea26a1ac5ac51f1483ff74b14ffc14abcde3455ff1964fd25c256d99bbb298c0
Opcode Fuzzy Hash: 78e5213647ace45075edf6087831abaa0f8ba198e697805de991843f31cd1620
Instruction Fuzzy Hash: 8F61E562B98F50C5FB10EF6EE8883AC27B1E7447A9F014621DE1937BD5DA34C6A18348

Function 0000025741428E80 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741429015

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a8aacd0e09e70c30a057030473103bdc4b4d673ec162f3d824773e17bae67f6b
Instruction ID: 0ebe2574289135ab38377224e9dcc27640f86c128dcdc2b1a42454c96f55de1a
Opcode Fuzzy Hash: a8aacd0e09e70c30a057030473103bdc4b4d673ec162f3d824773e17bae67f6b
Instruction Fuzzy Hash: F841C466388F8485EA10AF19F90839D67B2F749BE5F540625DF6D1B785DF38C1819308

Function 0000025741439FB0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574143A157

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 80ccde4e7c2d8776a33b8b5ec777cda77ddfdc7c818af9bd46593884588d75f0
Instruction ID: 976777a4bd36ea94de88a179ad438e653af3ee4fa56fae4f86668079a245cea3
Opcode Fuzzy Hash: 80ccde4e7c2d8776a33b8b5ec777cda77ddfdc7c818af9bd46593884588d75f0
Instruction Fuzzy Hash: B7418466398F8886DA14EF59F94826EA3B4F745BD1F608615ABAD63BC5DF38C0408304

Function 0000025741429030 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000257414291AC

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 12c4cc18f2389066702bc8e6ef1789d8670b28c52f417b9bd8ae0a600ec8364e
Instruction ID: 59d1571bb2a49d8d5c1ea049d3ec3fb548b4f2aa8e272b33de1226f50d14a52c
Opcode Fuzzy Hash: 12c4cc18f2389066702bc8e6ef1789d8670b28c52f417b9bd8ae0a600ec8364e
Instruction Fuzzy Hash: 1F412362348F5485FE10BB5AFC0C3ADA361B304BD5F584625AF6D2B7C6DE78C1818308

Function 0000025741424600 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741424751

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: dc511a26a12705d76694ff1619be8eba9153e3b67eb34daa764a6c8bc34486a7
Instruction ID: 8626275312d4bc30cea0a47545b12e3ea7972e0a35d5cbdd91608fe5e85a1d66
Opcode Fuzzy Hash: dc511a26a12705d76694ff1619be8eba9153e3b67eb34daa764a6c8bc34486a7
Instruction Fuzzy Hash: 51312822389E5488FE25BF1AFD083AC12B1D345FE6F5846219E2D27BC5DE78C5C19348

Function 000002574147D8C8 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002574147D8F0

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction ID: c495930f84346b8eec37f94b9b93d83a0ce29399ad01c50cdef203dcdff981de
Opcode Fuzzy Hash: 506399ceb7efd258d9ee9312528a7fb0108d3bcc24f039aa6e7519c78468f3b6
Instruction Fuzzy Hash: 6D412672168B4083FB74AB1CF84836D73B0F756B92F100202DAAAA37D0CB38C402C759

Function 000002574146EF10 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574146F070

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a3953ac7336e44fab3f50ac145ac912ae4d0ac3cf29e2fc59394371e0dce0deb
Instruction ID: 415983a04de71713b995b3c5c397a27e6cfec210aadc6ac37f7dd3ccb3994a27
Opcode Fuzzy Hash: a3953ac7336e44fab3f50ac145ac912ae4d0ac3cf29e2fc59394371e0dce0deb
Instruction Fuzzy Hash: 4F3191B2349F8095EA24EF19F8583AEA3B0A344BD5F6446259BAD27785DF3CC1518308

Function 0000025741428D10 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741428E6B

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 27f586df748ef508ccb615be2881a253bd13044cfe7f89549f543d09785045d6
Instruction ID: e03d9d52c0df24ba3c8c9373e095d3eb0b78702a2662beb6e862b25e7c713372
Opcode Fuzzy Hash: 27f586df748ef508ccb615be2881a253bd13044cfe7f89549f543d09785045d6
Instruction Fuzzy Hash: 7A312B72399F8185EE14BB19BD4835DA2B1E314BF5F5846219E6D2B7D5DA38C082C308

Function 0000025741466290 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000025741466320

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 9b54662dfc31b99104d5a64d46f481d5e14be556eb9875cdf2309875b13e82c8
Instruction ID: 1c34d08bfd18eec895577fb967f554c115e0b66dd121edbea4cd1a7a46b678c4
Opcode Fuzzy Hash: 9b54662dfc31b99104d5a64d46f481d5e14be556eb9875cdf2309875b13e82c8
Instruction Fuzzy Hash: DD519E32A58F808AE710DF68E84839D7770F389798F504211EB9C63A99DF78C684CB44

Function 00007FF756417DC0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75641B970: _Byte_length.LIBCPMTD ref: 00007FF75641B9F6

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF756417ED5

Part of subcall function 00007FF75641BA40: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF75641BA6A

Part of subcall function 00007FF75641BAA0: _Byte_length.LIBCPMTD ref: 00007FF75641BB26

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2675252387-0
Opcode ID: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction ID: 64368a94a9516d8adc78cfe862368c20c085449e7ff9ced7e8ce8e41a0a62307
Opcode Fuzzy Hash: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction Fuzzy Hash: 8851197261DA8591DA60FB15E8503EBB3A1FBC8780FC44032EA8D47B69DE3CD649CB50

Function 00007FF75640BA90 Relevance: 1.6, APIs: 1, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF75640C520: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75640C53D
Part of subcall function 00007FF75640C520: _Max_value.LIBCPMTD ref: 00007FF75640C562
Part of subcall function 00007FF75640C520: _Min_value.LIBCPMTD ref: 00007FF75640C590

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75640BB3C

Part of subcall function 00007FF756404310: std::_Xinvalid_argument.LIBCPMT ref: 00007FF75640431B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valueXinvalid_argumentstd::_
String ID:
API String ID: 142707115-0
Opcode ID: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction ID: 3e3b4ea532709d9182dd65a7b41780b09875aa57eb6dc5db90b0722742e71bdc
Opcode Fuzzy Hash: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction Fuzzy Hash: 2951C33662DB8581DA50EB16F89026BB7A0F7C9B90F501026EACE47B2ACF3CD1508B40

Function 00000257414229B0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741422AB8

Part of subcall function 000002574140B820: __std_exception_copy.LIBVCRUNTIME ref: 000002574140B868

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: 69cb05f06bfac6c23d9b563a1144b6f5c1505051c04b41afb44361278751c17a
Instruction ID: f9c22a921d83c1fbf52c95eb4b3c79245043afcbe0ef7049813fd281187df01e
Opcode Fuzzy Hash: 69cb05f06bfac6c23d9b563a1144b6f5c1505051c04b41afb44361278751c17a
Instruction Fuzzy Hash: 7821F722749F4045EA28BB19B9043A963A0E754BE5F244B219A7C23FD1EA78C5D3C344

Function 000002574148080C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000025741480892

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction ID: bf82ad9d1990dfb13bdc3371fdda8c1c0a259a78dea227bb9b819b22b9a9507f
Opcode Fuzzy Hash: a24f7c79d48368e33d7deb9d4eeecb52ce7ec7a6106812cc151fd4020b53ad0d
Instruction Fuzzy Hash: 5531B12667CE4085F7917B5EFC4936C26B0B780BB2F460605EA25377D2CB78C481C769

Function 00007FF75640F580 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction ID: 0ecac6312384b89b59ca225130406da6048890a3d71b33103a6eff9b7c4187ff
Opcode Fuzzy Hash: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction Fuzzy Hash: EF313C6262CB9181DA90BB52E84036BE7A0FBC47E0F445435FECD4BB69DF6CD2018B50

Function 0000025741484E91 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000025741484EBF

Part of subcall function 0000025741484FB8: GetModuleHandleExW.KERNEL32 ref: 0000025741484FDD
Part of subcall function 0000025741484FB8: GetProcAddress.KERNEL32 ref: 0000025741484FF3
Part of subcall function 0000025741484FB8: FreeLibrary.KERNEL32 ref: 000002574148501A

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction ID: 2b681c19fda7cf2bd36145c47888cfafd98e555ed55600198d16ea2f3b9ff2d7
Opcode Fuzzy Hash: 9e03c0276b42d0bae273c9ceb8b8abd1e24865752fa8da44abca3c0ffcb1668a
Instruction Fuzzy Hash: C4219036A44B408AEB64AF68E8583EC37F0F35471DF580629E72966ED5DB34C484CB44

Function 000002574149FEF8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002574149FF1B

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction ID: 6da4a3411949c6e50d46776b403bb0c3016997e32b2b2e4c7de98dab9eae7a94
Opcode Fuzzy Hash: 4bdd7c7df9abbb715da046ae302baf4d590079e7e30464498c50f0bf6b7ea38d
Instruction Fuzzy Hash: 3421C632228E8087DB61AF2CF85476977B0F786B95F684215EB5D576D9DB38C4008B04

Function 000002574149E200 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002574149E15D

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: 7f408c823b055e9bd268fc0b16d1635be1e516cc1a1a4946ad315a4af25f49c8
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 03118B7236DE4081EA60BF69FC057AFA370B786F91F484411EB8477796CB38C5008749

Function 00007FF75640E170 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction ID: 79b7064b38db9da7c1cd24940db7fe12ae62ddf253a6610c21f5e5c44ef3d13c
Opcode Fuzzy Hash: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction Fuzzy Hash: BE21412251CAD181DAB0FB10E8513ABE7A1FB84394F988535E6CD87A99CF2CD254CB10

Function 00007FF75641BBF0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75641BC1C

Part of subcall function 00007FF75641F7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF75641F846
Part of subcall function 00007FF75641F7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF75641F855

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2595383736-0
Opcode ID: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction ID: ce7bc9fbe8961d173b65119d6bc668d81e3e6fcb66375b0d4baba1d0f38b870c
Opcode Fuzzy Hash: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction Fuzzy Hash: BA21F876618F8881DA10EB15F89125BB7A0F7C9BC4F941126EACD43B69DF3CD250CB40

Function 00007FF756418750 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75641875E

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction ID: d0c93fccecff99e74d7e922dca84e8f6088b92393486627aa10e46875b38a180
Opcode Fuzzy Hash: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction Fuzzy Hash: 00117436619F8885DB609F1AE88035EB7A0F7C8B94F545126EBCD47B69CF3CC5508B50

Function 00007FF75641B970 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_Byte_length.LIBCPMTD ref: 00007FF75641B9F6

Part of subcall function 00007FF75641BBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75641BC1C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2180140624-0
Opcode ID: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction ID: e57f4037c40b15b2d87cfb752bc74c41fe3c5937f47f446c5581730f72a4de9f
Opcode Fuzzy Hash: 3d721e314f6597f4f5539cc87ca23b51fab7460f1361a429639f5c59ef1ee461
Instruction Fuzzy Hash: 09112436518A8182DA50EB25F89119BB7A0FBC9790FA41126EBCD47B29DF3CC211CB40

Function 00007FF75641BAA0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75641BB70: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF75641BB7E

_Byte_length.LIBCPMTD ref: 00007FF75641BB26

Part of subcall function 00007FF75641BBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75641BC1C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID:
API String ID: 3730899627-0
Opcode ID: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction ID: e92309d7a68b23325420f411fb8a7d47b6c5351cc39cb094f63491073b2ae723
Opcode Fuzzy Hash: 44c7796c75c25c5c7709d50e7aab81eaeec602659a9d168cd4e954b65d0e7a9e
Instruction Fuzzy Hash: E911F476518A8582DA50EB25F89119BB7A0FBC9780FA40126EBCD43B69DF3CC6518B40

Function 00007FF756407E40 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF756407E74

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction ID: a23069213d9632c64d65346da9fd7e292dca4b0efdb526c2986aa61a30f5bf66
Opcode Fuzzy Hash: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction Fuzzy Hash: 0C112E26619B4181DA20FB16E44036FB7A0FBC8BE4F481135EA8D47B65CF7CC6408B50

Function 00007FF75640F6A0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF75640F721

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID:
API String ID: 3713626258-0
Opcode ID: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction ID: a18c03271c92c477980dbd22613467224ca4eda1a1a93e3972fb35c68c3a007f
Opcode Fuzzy Hash: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction Fuzzy Hash: 53010C7662CB9681D690BB16F84026BA3A0FB84BD4F846431FECE4B759DF2CD2108B50

Function 0000025741460E00 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000025741460E48

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction ID: 2ef4bb5a7c94888490619d7418f0768198b5615e43ac1985cbe5e978d44228eb
Opcode Fuzzy Hash: 10723b900c3d3fb221c2729e0f2ab508e71a113b43aaaf7fd55bda6ca2804ccb
Instruction Fuzzy Hash: 4501AD71718A9485EB509F1AFD44619A7B0F788FE4F485231EE5D13B48EB38C8818704

Function 00007FF75640CD80 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75640CDC2

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction ID: 48bef7e39d27d4f303bc6dc25a1c26c65723d957b84fb6b8f298990ac7939872
Opcode Fuzzy Hash: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction Fuzzy Hash: CA014062619B5681DA60BB28E88131BE7D4FF887A4F840231E69D86BD4DF3CC6508714

Function 00007FF75641C9F0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF75641CA33

Part of subcall function 00007FF75640A910: allocator.LIBCONCRTD ref: 00007FF75640A92B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID:
API String ID: 1755220593-0
Opcode ID: e9dd5059331e962bb0aad71984c047b5081c9f2cc64489ca351a57fb079b81be
Instruction ID: 88417fb65a6f583388827e135e5517aa063559b141057bd270b997a1b62895ae
Opcode Fuzzy Hash: e9dd5059331e962bb0aad71984c047b5081c9f2cc64489ca351a57fb079b81be
Instruction Fuzzy Hash: D2016036619F8482CA60DB0AF89011EB7A4F7C9B94F504125FBCD87B29DF3CD2618B00

Function 0000025741417633 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000025741417676

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction ID: e22c290b51a62c26cbc860cc76c04906938e6d5154f57ae9b7ab5cde03269c62
Opcode Fuzzy Hash: 752fe5805e453647425062ce64daa4e53c54a82ad0d646f83825288564bb7983
Instruction Fuzzy Hash: D601122625CEC085EA70DB56F89839AB374F7C8B95F544022DE8D53B59DE39C886CB04

Function 0000025741477374 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000025741477393

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: 2daa678991f72d87ee94d4b8c80524e68267695af988058a3c5981ba1fc2085d
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: A8E0923226DE4181EB647BADB94E26C61706B447F6F944321AA34126C6DB3484608719

Function 00007FF756455554 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF756455584

Part of subcall function 00007FF7564564DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7564564E5

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction ID: c981bb0658e24542b20557aae1b95346aa0369144abb6048522e8796d100a383
Opcode Fuzzy Hash: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction Fuzzy Hash: D1E0EC40E1918F06FE6C31A59C2617B81450F697B0EAC1B30DD3E486DFAD1CB6918534

Function 00007FF75641BA40 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF75641BA6A

Part of subcall function 00007FF756417FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7564180EF
Part of subcall function 00007FF756417FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF756418197

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2443641946-0
Opcode ID: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction ID: 6c0980d7a46f97c7c5ea4d831ad810f14ac907aa8d69e944dc9b8f583c108337
Opcode Fuzzy Hash: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction Fuzzy Hash: 86F0D4B2518A8086C660EB55E84111FF7A0F7C8794F541125FACD87B2ADF7CC2508F44

Function 000002574149B4C0 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000002574149B4C4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4c4c8cee82cd6a4053d517c558a7f02c966df0e611948d3254852e902a6fda01
Instruction ID: fa47dc26e21525833f9e9c739e0addd92346db8ebf835a4a68fb4c6e1b4a459f
Opcode Fuzzy Hash: 4c4c8cee82cd6a4053d517c558a7f02c966df0e611948d3254852e902a6fda01
Instruction Fuzzy Hash: 75C09B15F9DD41D1E6947BBB7C8A79251F0D759723F4C0030C50494150DE3C85D7D719

Function 00007FF75640A910 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF75640A92B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction ID: 7fb9af1e08adcd37f9e2e8e1315d079769af651253580d2d5cd6bc1e050db599
Opcode Fuzzy Hash: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction Fuzzy Hash: 27C0C96AA29B84C1CA04EB12F88100AB760F7C8BC0F809421EA8E03729DF38C1518B00

Function 000002574149D0B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 000002574149D0BD

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction ID: cc47b7edc34319ad9bfaa5be88fafb39ea33c9042e6d1f47c7d46443515cb448
Opcode Fuzzy Hash: ebb3c2d15c06801dfe805b6087078b0f501a5fe9f8c446694f4975735c5f9cad
Instruction Fuzzy Hash: F3B09236B18CC0C3C612FB08EC86119B331F794B0AFD00010E28E42624CE2CCA2A8E04

Function 00007FF7564464BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000028,00007FF756455573,?,?,?,00007FF7564010A8), ref: 00007FF7564464FA

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction ID: 0462984f2cd68e575ad227088a3a36d3ff23d95eaa8fee37fb0f4de9b30b621c
Opcode Fuzzy Hash: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction Fuzzy Hash: A2F0FE90F0924755FF547A61AD1267BD1805F847B6F8C4630D92E856C6DE2CE680C630

Function 000002574147E8BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000002574147E8FA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction ID: 956f471839f1229cc56ecdb38634f994c4f5ecd92ee54dd4debcf03b3bef9879
Opcode Fuzzy Hash: eba47d0c810211a009f984e3ce810decee2d7cb9fb39a7e87e15bbee8ef19542
Instruction Fuzzy Hash: DCF0A04238DE4944FE9977BABC1C3B592B05B887B6F4D0B209D36B62C2DA3CC5808318

Function 00007FF7564026C0 Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7564026F3

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction ID: 365ecd8dd157b6ddb33ae9855c14901a15bef9a7124941e18c3858051ec674cc
Opcode Fuzzy Hash: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction Fuzzy Hash: ADE03232A1CB8582C620AB05E84031BBBA0F789784F600524EACC46B68CF7DD6648B00

Non-executed Functions

Function 0000025741437CEB Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741439311
Concurrency::cancel_current_task.LIBCPMT ref: 00000257414393E6

Part of subcall function 000002574140BA80: __std_exception_copy.LIBVCRUNTIME ref: 000002574140BAC3

Part of subcall function 0000025741490E88: RtlPcToFileHeader.KERNEL32 ref: 0000025741490ED8
Part of subcall function 0000025741490E88: RaiseException.KERNEL32 ref: 0000025741490F19

Strings

*, xrefs: 0000025741437EFE
quote was opened but not closed., xrefs: 0000025741439236, 00000257414392AB
#include, xrefs: 000002574143866A
unexpected '}', xrefs: 0000025741439413
object is not closed with '}', xrefs: 000002574143920F
#base, xrefs: 0000025741438696
No closed word, xrefs: 0000025741439317, 000002574143933E
/, xrefs: 0000025741437ED3
Unexpected eof, xrefs: 00000257414391E2
key declared, but no value, xrefs: 000002574143925D, 0000025741439284, 0000025741439398
", xrefs: 00000257414380D3
word wasnt properly ended, xrefs: 0000025741439365, 00000257414393EC
key opened, but never closed, xrefs: 00000257414393BF
unexpected key without object, xrefs: 00000257414392EA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 9a2298355cdf98c0c19ce5257dcc77b7fb2469bb566b3b47b8d8a959356f52cd
Instruction ID: f91ef93b8ea7749c889b052c633c11c0781661f51eb2a4d53cd8e2776241ea7d
Opcode Fuzzy Hash: 9a2298355cdf98c0c19ce5257dcc77b7fb2469bb566b3b47b8d8a959356f52cd
Instruction Fuzzy Hash: B3D28F72389EC986EB70AF29EC483EC63B1E7457D9F444211CA5D2BA99DF74C685C308

Function 00007FF75644FF2C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF75644FF7A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7564505E6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75645075C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF756450A1A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF756450C3A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF756450E77
memcpy_s.LIBCPMT ref: 00007FF756450F52
memcpy_s.LIBCPMT ref: 00007FF756450FFD
memcpy_s.LIBCPMT ref: 00007FF7564510CC

Strings

1#INF, xrefs: 00007FF7564500A3
1#SNAN, xrefs: 00007FF75645008A
1#IND, xrefs: 00007FF756450067
1#QNAN, xrefs: 00007FF756450093

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: f599b05029d98f237293d086c6c8cbc83094781c7e8eddfec9504f7173d138ad
Instruction ID: 54bf55e83568fa2fa58ca0f46ab77a1bf54179ef5618c1f0a0264297fc2452c5
Opcode Fuzzy Hash: f599b05029d98f237293d086c6c8cbc83094781c7e8eddfec9504f7173d138ad
Instruction Fuzzy Hash: 9FB2E876E182828BE765DF64D8407FEB7A1FB64B44F885135DE0D57A88DB38AB00CB50

Function 000002574146A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000002574146A430: RtlAcquirePebLock.NTDLL ref: 000002574146A473
Part of subcall function 000002574146A430: NtAllocateVirtualMemory.NTDLL ref: 000002574146A4AB
Part of subcall function 000002574146A430: lstrcpyW.KERNEL32 ref: 000002574146A50D
Part of subcall function 000002574146A430: lstrcatW.KERNEL32 ref: 000002574146A5C2

CoInitializeEx.OLE32 ref: 000002574146A7EA
lstrcpyW.KERNEL32 ref: 000002574146A9C9
lstrcatW.KERNEL32 ref: 000002574146ABCE
CoGetObject.OLE32 ref: 000002574146ABEC
lstrcpyW.KERNEL32 ref: 000002574146B269
lstrcatW.KERNEL32 ref: 000002574146B48C
CoGetObject.OLE32 ref: 000002574146B4AA
CoUninitialize.OLE32 ref: 000002574146B972

Strings

0, xrefs: 000002574146B0AA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: ddf47bfd185a9b812a7d6d648a0717e0b54138d9b1669b27fbe14ef61e0f60d0
Instruction ID: 317499bfc6c010b16279b080fb6de249b3a06872f326dc7d5766a32c06757bd7
Opcode Fuzzy Hash: ddf47bfd185a9b812a7d6d648a0717e0b54138d9b1669b27fbe14ef61e0f60d0
Instruction Fuzzy Hash: B3B2893662AF948AD7818F69F88165EB3B5F788B88B106215FECD57F18EB38C154C740

Function 00007FF756432B97 Relevance: 12.0, Strings: 9, Instructions: 793COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF7564334E4
invalid distance too far back, xrefs: 00007FF7564335AA
invalid code lengths set, xrefs: 00007FF756432D25
invalid bit length repeat, xrefs: 00007FF756432F9C
invalid literal/lengths set, xrefs: 00007FF75643303F
too many length or distance symbols, xrefs: 00007FF756432D3E
invalid code -- missing end-of-block, xrefs: 00007FF756432FC9
invalid literal/length code, xrefs: 00007FF756433308
invalid distances set, xrefs: 00007FF7564330B5

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 8dab440fc9059f63e4ec5b970c608ca424db9a839ae67d8aedf904f713204985
Instruction ID: 9112f7880c00ea79e4868bc0730455488186e2a6605912d3facc1c7b3188da4e
Opcode Fuzzy Hash: 8dab440fc9059f63e4ec5b970c608ca424db9a839ae67d8aedf904f713204985
Instruction Fuzzy Hash: B462F832B046A987E7A49F15D998F7F77A9EB44380F494139EA4A437C0DB3CDA84CB50

Function 00007FF75644CE44 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

TranslateName.LIBCMT ref: 00007FF75644CEAE
TranslateName.LIBCMT ref: 00007FF75644CEE9
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7564442C8), ref: 00007FF75644CF30
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7564442C8), ref: 00007FF75644CF68
GetLocaleInfoW.KERNEL32 ref: 00007FF75644D125

Strings

utf8, xrefs: 00007FF75644D04C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: f952dde8d3cd7788e963193f5ea5aa1e92811ebc708004aabb464cf43692a041
Instruction ID: 0827787063c45e6694934c9481faa190da133861ff23d622b699956195928136
Opcode Fuzzy Hash: f952dde8d3cd7788e963193f5ea5aa1e92811ebc708004aabb464cf43692a041
Instruction Fuzzy Hash: 0D917B32E0874286EB64BB21DC422BAA3A5EB45B86F8C4131DE4C47795EF3CE651C360

Function 00007FF75644D88C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445CFD

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF75644D9FC

Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445D2A
Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445D3B
Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445D4C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7564442C1), ref: 00007FF75644D9E3
ProcessCodePage.LIBCMT ref: 00007FF75644DA26
IsValidCodePage.KERNEL32 ref: 00007FF75644DA38
IsValidLocale.KERNEL32 ref: 00007FF75644DA4E
GetLocaleInfoW.KERNEL32 ref: 00007FF75644DAAA
GetLocaleInfoW.KERNEL32 ref: 00007FF75644DAC6

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: c4ae29048c0868d5221bcf0fbd91c5e5467cd0d186a5bb531500621032177dec
Instruction ID: 0d451ed4075fbf3f91830aed44061661e64c02c42cf1a8f62c9626475cfc40a6
Opcode Fuzzy Hash: c4ae29048c0868d5221bcf0fbd91c5e5467cd0d186a5bb531500621032177dec
Instruction Fuzzy Hash: 07717962F186428AFF51BB60DC526BEA7A0BF48785F884035CA0D67795EF3CE645C320

Function 00007FF756441E68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF756441EE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF756441EF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF756441F34
IsDebuggerPresent.KERNEL32 ref: 00007FF756441F6D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF756441F77
UnhandledExceptionFilter.KERNEL32 ref: 00007FF756441F82

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ce7e3796c7a5bb2387eca005e84a3121ab51e1fc44c73afe5079a6031630cece
Instruction ID: b700bf3aac2845eada6fa0aae34508418884ddeaf799264bb4eca6e20cbb8748
Opcode Fuzzy Hash: ce7e3796c7a5bb2387eca005e84a3121ab51e1fc44c73afe5079a6031630cece
Instruction Fuzzy Hash: 23318236A18B8185D760DF25EC402BEB3A4FB84754F980136EA9D43B58EF38D655C710

Function 0000025741413A30 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 699COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 0000025741414A48, 0000025741414A8C
filename, xrefs: 0000025741414624
content, xrefs: 0000025741414749

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmProvider$CloseGenerateOpenPropertySymmetric
String ID: content$filename$ios_base::badbit set
API String ID: 4024084497-879919306
Opcode ID: 41fbaf792d795717714e91d8dde3fa3885405ae078dd94e1a7e96cd12b450092
Instruction ID: 7b57cd35ae35e2f13cbba99464a573ed3eb55cc49781bfd0c112d7d2953972c3
Opcode Fuzzy Hash: 41fbaf792d795717714e91d8dde3fa3885405ae078dd94e1a7e96cd12b450092
Instruction Fuzzy Hash: 0882113215DFC585EAB19B18F8843DAB3A4F7C9381F505226EACD52B69EF78C194CB04

Function 00000257414198CD Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

status, xrefs: 000002574141AD67
config, xrefs: 0000025741419CDD
filename, xrefs: 0000025741419B46, 0000025741419ECE, 000002574141A762
content, xrefs: 0000025741419B9F, 0000025741419F27, 000002574141A844
users, xrefs: 000002574141A262

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: f8b0f1709f333bd9866b3879c8fff69ecfcb3be96692accb681bc184fb3af1c9
Instruction ID: 1ab78084c7123eea1ce3641ee22f58f44044053c78e5334d3fa81b489ec7a66e
Opcode Fuzzy Hash: f8b0f1709f333bd9866b3879c8fff69ecfcb3be96692accb681bc184fb3af1c9
Instruction Fuzzy Hash: 96C26C62695FC189DB30AF38EC883DD2371F785799F505212DA9D6BA9AEF34C684C304

Function 000002574149D804 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002574149D865
IsDebuggerPresent.KERNEL32 ref: 000002574149D87D
OutputDebugStringW.KERNEL32 ref: 000002574149D88E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000002574149D887

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction ID: b8adb11ddfcb3b74cd240e784ea0a9b8a81759dae0e4262d9c406a8e18aa063a
Opcode Fuzzy Hash: 9ee4415ca50324c33a3d5a57874f9cc99ad178eb9645fb895110d63af1d9e2c1
Instruction Fuzzy Hash: B7119E32354F40A3F704EB2AFA483A932B4FB04346F448024D74996A91EF78D4B4C708

Function 00007FF7564230B0 Relevance: 7.0, Strings: 5, Instructions: 719COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF75642374E
d, xrefs: 00007FF756423C7F
0, xrefs: 00007FF7564236AD
d, xrefs: 00007FF756423B18
d, xrefs: 00007FF7564235F5

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: 0$0$d$d$d
API String ID: 0-911316061
Opcode ID: be84b10c0d2d45635747b94c10be12c5baf49aa36d94cf40a0aca8293bbb7e80
Instruction ID: 575f67ca0420f065754e7ba6d1e8aff2ee384f61f116688c8432fe2aef4db66c
Opcode Fuzzy Hash: be84b10c0d2d45635747b94c10be12c5baf49aa36d94cf40a0aca8293bbb7e80
Instruction Fuzzy Hash: B27217766186818AE764CF19E4807ABF7A2F7C9744F544126EB8E83B98DB3DD841CF10

Function 000002574148F908 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002574148F934
GetCurrentThreadId.KERNEL32 ref: 000002574148F942
GetCurrentProcessId.KERNEL32 ref: 000002574148F94E
QueryPerformanceCounter.KERNEL32 ref: 000002574148F95E

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction ID: 1d9ad15797d57a988251ea12a28aeda20aecbccf89f7f0e07b58144fd3ee6bb8
Opcode Fuzzy Hash: 4ffc0ff1ccd2cf120a16052376350404e0c91ed7b37e0d63ec5629fc76b72274
Instruction Fuzzy Hash: 78117026754F008AEB00DF64FC483A873B4F318759F441E21EA2D567A4DF78C1548744

Function 00007FF7564322E8 Relevance: 5.5, Strings: 4, Instructions: 453COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF75643233C
header crc mismatch, xrefs: 00007FF7564327B6
unknown compression method, xrefs: 00007FF75643231A
, xrefs: 00007FF7564323D0

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 5fd275a1f547e5e5e246a265f17631c6e5570a77d34065937c2ebc4c447087f8
Instruction ID: 67e63298491471355cf6ffffbc7731468cf34eff38a00723570a0088a57cd312
Opcode Fuzzy Hash: 5fd275a1f547e5e5e246a265f17631c6e5570a77d34065937c2ebc4c447087f8
Instruction Fuzzy Hash: 7312A372B043D987E7A5AF19C888B3BBAA9FF44784F594534DA4947790CB38EA80C750

Function 00007FF75644FA90 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF75644FAF6
memcpy_s.LIBCPMT ref: 00007FF75644FB21

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 57a8bb62846f71c15516153ffb7b4828fa003a6834a4406426bc392e6d140f03
Instruction ID: c20ec2db94585584f5b00d2ac8dc8f67a884dc0000ce94c480d4fb05023b5f8c
Opcode Fuzzy Hash: 57a8bb62846f71c15516153ffb7b4828fa003a6834a4406426bc392e6d140f03
Instruction Fuzzy Hash: 65C12272B1868687E764DF1AA58466BF791F7C8B85F888135DF4A43784DB3CEA01CB00

Function 00007FF75644D308 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445CFD

GetLocaleInfoW.KERNEL32 ref: 00007FF75644D374

Part of subcall function 00007FF75645242C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF756452449

GetLocaleInfoW.KERNEL32 ref: 00007FF75644D3BD

Part of subcall function 00007FF75645242C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7564524A2

GetLocaleInfoW.KERNEL32 ref: 00007FF75644D485

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: ffb303f14084d201689acfaa42d903f902045a7f0c7723b67fadfb05f0f86b60
Instruction ID: 923c046591d107c7bb2df9d641010e0a850ddb0d4c4d26ef438e158e22eeac30
Opcode Fuzzy Hash: ffb303f14084d201689acfaa42d903f902045a7f0c7723b67fadfb05f0f86b60
Instruction Fuzzy Hash: 5D61C272E0854286EB34AF11E9522BEB3A1FB44786F884135CB9E87695DF3CF651C720

Function 00007FF7564227B0 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF756422E76
0, xrefs: 00007FF756422BEC
0, xrefs: 00007FF756422C8D

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: 0$0$d
API String ID: 0-3608139397
Opcode ID: 5c76ddb99ef15a809886bb458ee614dacd124281dc7315fd32f47024dea49008
Instruction ID: 1a13df5896803dc41814808f01865d0afbd7404bb7977a07be684fd6d640e415
Opcode Fuzzy Hash: 5c76ddb99ef15a809886bb458ee614dacd124281dc7315fd32f47024dea49008
Instruction Fuzzy Hash: 2B32157261C6818BD760CF19E4807ABF7A2F7C9744F544126EA8A83BA8DB7DD581CF10

Function 00007FF75643A140 Relevance: 4.2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF75643A649
invalid distance too far back, xrefs: 00007FF75643A666
invalid literal/length code, xrefs: 00007FF75643A62C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 7a605b2cea8ad5d7cbca8e7681ee519b81b1658c2b26500f27ae4b4ec54e850d
Instruction ID: 4a7febf949ebf7219aa59eca2528b2d86b34d5b73d5095d870356a3ed66cd4ba
Opcode Fuzzy Hash: 7a605b2cea8ad5d7cbca8e7681ee519b81b1658c2b26500f27ae4b4ec54e850d
Instruction Fuzzy Hash: 41F14972B0C6D983DB589F15985867EBB92E7C57C4F588139EA8D03B88DE3CD984CB10

Function 00007FF756438C30 Relevance: 4.2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF756439139
invalid distance too far back, xrefs: 00007FF756439156
invalid literal/length code, xrefs: 00007FF75643911C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: e5486bf6340005e40ec32ce1de8edf0dcb03f50dc41d0fbeeae64139bd64bd70
Instruction ID: c097ef949944455f3481361e9d14d252520e93f0e64879819bbc784420f4f2f2
Opcode Fuzzy Hash: e5486bf6340005e40ec32ce1de8edf0dcb03f50dc41d0fbeeae64139bd64bd70
Instruction Fuzzy Hash: A1F11832B0C69987DB949F15985467EFBA2EBC57C4F588139EA8E03788DE3CDA44C710

Function 00007FF75643CA20 Relevance: 4.0, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF75643CC42
, xrefs: 00007FF75643CCD2
@, xrefs: 00007FF75643CB89

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: $0$@
API String ID: 0-2347541974
Opcode ID: eeca5f65d7def711a2938bc2b9d1f084d0224f6aa778e8f803134c364f27b88c
Instruction ID: 4933d5ff8f3d5773f2284e90f6fba791959cf628fd47cf3ebea58ef808ba9089
Opcode Fuzzy Hash: eeca5f65d7def711a2938bc2b9d1f084d0224f6aa778e8f803134c364f27b88c
Instruction Fuzzy Hash: 17B18267D28FC641F6138B3954429B5F310AFFF3D0A64A327FEE475612AB68A7818314

Function 0000025741431AF0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000025741431D4E

Strings

parse_error, xrefs: 0000025741431B7E

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error
API String ID: 592178966-3903021949
Opcode ID: b885a082d793ee80b873f81d266700831fac8e7b555c931ae118d27a38319675
Instruction ID: 3a711b63aa2ed6ed5d922b1fa34fe82e0a20daf89808d7a468bc71d3f4cccca9
Opcode Fuzzy Hash: b885a082d793ee80b873f81d266700831fac8e7b555c931ae118d27a38319675
Instruction Fuzzy Hash: 2BA1C462B54F8489FB10EF79E8483AD6371E7897E9F105711EA5C26ADADF34C181C344

Function 00007FF7564491E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF75644449A), ref: 00007FF756449254

Strings

GetLocaleInfoEx, xrefs: 00007FF7564491FC, 00007FF75644920D

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 9b4a3f26f7b91ef26a560136e31b55ba1280cb57d4f7cd41046f5acf592c097e
Instruction ID: 72c62e1a9051d97433c0ba7a956e0bc79c148d333a762df6b4aa431ea07c6377
Opcode Fuzzy Hash: 9b4a3f26f7b91ef26a560136e31b55ba1280cb57d4f7cd41046f5acf592c097e
Instruction Fuzzy Hash: 2A018F21F08B8186EB44AB56B8414ABE760AF89BD1FAC8035DE4D03B55DE3CD641C390

Function 000002574145C8E0 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000002574145C943
ShellExecuteW.SHELL32 ref: 000002574145CF8A

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: a7338904e57405cb7424316b332a1e38ca99d4c22208ccb12818e04892214995
Instruction ID: 105a3cf807e1f8e4f7ed2b3c15ddb1b9f687a2347fcc65ec263ff6b22504fb1f
Opcode Fuzzy Hash: a7338904e57405cb7424316b332a1e38ca99d4c22208ccb12818e04892214995
Instruction Fuzzy Hash: EB122872629FC48ADB808F29E88469EB3B5F788798F506215FEDD57B58EB78C150C700

Function 00007FF756448758 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7564489A7
RaiseException.KERNEL32 ref: 00007FF7564489B8

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a1839167aa180c42619ad643ddb8024cdd347c0831b0529f6c74a26638d682ba
Instruction ID: 73cf2a541da016888a889c5b2292ab7c0657a560693f77f9f0046fd61d66f353
Opcode Fuzzy Hash: a1839167aa180c42619ad643ddb8024cdd347c0831b0529f6c74a26638d682ba
Instruction Fuzzy Hash: 45B17B73A04B898FEB55DF29C846369BBA0F784B89F588821DB5D837A4CB3AD451C710

Function 0000025741458B00 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

%, xrefs: 0000025741459164
+, xrefs: 000002574145917F

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 2905ef894ddc9819a68913b84647b8305ba226602fcd5b943371844175bbe5ab
Instruction ID: 1945db40e04c7284f83e8a28f106bb1ae64cebf92b7dda104a0c10dd898545da
Opcode Fuzzy Hash: 2905ef894ddc9819a68913b84647b8305ba226602fcd5b943371844175bbe5ab
Instruction Fuzzy Hash: DE226823798E808AFB11DBA9E8683ED63B1E754799F054611EF4927BC9DF38C445C348

Function 0000025741410A80 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

dumps, xrefs: 0000025741410AC8
emoji, xrefs: 0000025741410AF0

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: 9c1d1d90ca4f88bc8268b0322e863aaa792dfa8aa99b6ae742cb4d4f1446b717
Instruction ID: c6767a0afeac04c7919ed9ba264527a18a5fa7b748b54510104a3b484eeb965c
Opcode Fuzzy Hash: 9c1d1d90ca4f88bc8268b0322e863aaa792dfa8aa99b6ae742cb4d4f1446b717
Instruction Fuzzy Hash: CCB10B22968FC486E761CB29F88025AB7B4F799784F115315FBCD23B59DB38D291CB04

Function 00007FF756446CD8 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

e+000, xrefs: 00007FF756446DE5
gfff, xrefs: 00007FF756446E62

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: eae3eaedb716b390790cfcc6eb53f328968db58e854ae428f084f307bb2cca52
Instruction ID: a443b5fba692f2beb1e5cf1ab0e6717b0d13c8b1a324f412207405f9ce89e4b3
Opcode Fuzzy Hash: eae3eaedb716b390790cfcc6eb53f328968db58e854ae428f084f307bb2cca52
Instruction Fuzzy Hash: 9A5159A2F186C546E7249E35DC4276AEBD1E744B94F9C8231CB6C4BAC5CF3ED5848710

Function 0000025741440AC0 Relevance: 2.0, APIs: 1, Instructions: 470COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000025741440B3B

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6605e0d46bb03ba56f522f97e79a71f05f38da00fcb732d196618f5e6b8406c8
Instruction ID: 6769a47c0d2113cbe7471cbb72a1391e129669f7d4809f8a807b63af19394e7e
Opcode Fuzzy Hash: 6605e0d46bb03ba56f522f97e79a71f05f38da00fcb732d196618f5e6b8406c8
Instruction Fuzzy Hash: 4C02BD62799F8486EB10EFA9E84839E7371E348BD9F044222DE9C27799DF34D495C384

Function 00007FF756449CD8 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF756449E20

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f303fb9edb89c9981dcaa8221041ff2017a834cce71cc05f93e29e86dd0c05cc
Instruction ID: df3cfc485b718c1f862ed9a4550cadc51f68134dcca43b33ee02a9f086453eb1
Opcode Fuzzy Hash: f303fb9edb89c9981dcaa8221041ff2017a834cce71cc05f93e29e86dd0c05cc
Instruction Fuzzy Hash: 1C128F22E18BC186E751DF28D8452FEB3A4FB59748F899235EB8C42656DF39E2D4C310

Function 0000025741486A68 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000025741486BB0

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 34bb98c3edea38196bc2890941daf16f7b3cf89dc383ed318ce956197c2a0362
Instruction ID: 8618458851cdb9b888326f82e4a26ce9ae87740d1e2dbdb95ed68d7b03edebce
Opcode Fuzzy Hash: 34bb98c3edea38196bc2890941daf16f7b3cf89dc383ed318ce956197c2a0362
Instruction Fuzzy Hash: D112CC22A08BC486E791DF3CA8183ED73B4F759749F059226EF9893692EB34D1C5C704

Function 00007FF75644A448 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25a4eb04e97a1cbd05bf3468fe75687d39b44580424cbd94dd95bbadaa425fa
Instruction ID: 088b75b8c55b3133e06eb39d2524f91e5873dedcd45d9fdd220884a7c4a0a17a
Opcode Fuzzy Hash: f25a4eb04e97a1cbd05bf3468fe75687d39b44580424cbd94dd95bbadaa425fa
Instruction Fuzzy Hash: 98E14F32A08B9186E720EB61E8512EFB7A4F755B88F844532DF8E53B56EF78D245C310

Function 000002574143BAB0 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574143BDC4

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1fbfef3e63d2319619a5e63a60d6c4d77880160888e7311b6829c17497faaf30
Instruction ID: 1119849049c7ac9fbd6008e1fc83b8233c6698ee9b70e4a0a666766650a9e4c9
Opcode Fuzzy Hash: 1fbfef3e63d2319619a5e63a60d6c4d77880160888e7311b6829c17497faaf30
Instruction Fuzzy Hash: 4EA19C22719F988AEB10CB69E8883AC77B0F359B89F544416DF8D63B99DB38C191C314

Function 000002574143B780 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002574143BAA9

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a9167eaa65478a799c7f3ec9e29dde26aa86ec3791fbfc1cbc06c4d1a3e3b434
Instruction ID: d3d99440b40bd4110538b2a9f1ac80a5882720e23d6788dacab2d5f67671bf6c
Opcode Fuzzy Hash: a9167eaa65478a799c7f3ec9e29dde26aa86ec3791fbfc1cbc06c4d1a3e3b434
Instruction Fuzzy Hash: 63A19B22719F988AEB00DBA9E8843AC77B0F759789F544516DF8D67B59DB38C091C308

Function 00007FF75644D550 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

Part of subcall function 00007FF756445CB8: FlsSetValue.KERNEL32 ref: 00007FF756445CFD

GetLocaleInfoW.KERNEL32 ref: 00007FF75644D5B8

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1fc60497d60af84bc3a25616b2cbffb7f0d58d90d82e0e4919eba903a1a3e98e
Instruction ID: 25b1206c5189286c9070214765656aa50daaadfaf8c6708e2c5bee58fa1be0c0
Opcode Fuzzy Hash: 1fc60497d60af84bc3a25616b2cbffb7f0d58d90d82e0e4919eba903a1a3e98e
Instruction Fuzzy Hash: 01318432E0868286EB24AF21E8523BFB3A1FB89745F885135DA4D83695DF3CE651C710

Function 00007FF75644D1A0 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF75644D98F,?,00000000,00000092,?,?,00000000,?,00007FF7564442C1), ref: 00007FF75644D23E

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 381a7898935054535fb9b37bad717d8d2f933d4e212882dca7d474c99c627ba2
Instruction ID: bf4af0bcd35b666dfa2ec97f7db5130a53887b42f185618038da0ebcd0aa7890
Opcode Fuzzy Hash: 381a7898935054535fb9b37bad717d8d2f933d4e212882dca7d474c99c627ba2
Instruction Fuzzy Hash: 2D11E763E086458AEB15AF15E8812B9BBA0FB40FA1F884135DA59433C4DE38D7D1C750

Function 00007FF75644D758 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

GetLocaleInfoW.KERNEL32(?,?,?,00007FF75644D502), ref: 00007FF75644D78F

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 453c54bd9860f3c2c2274d73c6c0209dd6e7591276c886d4b974ba9ca7b18a21
Instruction ID: b63def10e2e3050018b589f6496b8d2a64e9192f3f1ab523e2dd2692cacfd6a6
Opcode Fuzzy Hash: 453c54bd9860f3c2c2274d73c6c0209dd6e7591276c886d4b974ba9ca7b18a21
Instruction Fuzzy Hash: 01115C32F1C65243E778B725E842A7FA260EB44765F9C4231D66E436C4EE29DA818310

Function 00007FF75644D270 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF756445CB8: GetLastError.KERNEL32 ref: 00007FF756445CC7
Part of subcall function 00007FF756445CB8: FlsGetValue.KERNEL32 ref: 00007FF756445CDC
Part of subcall function 00007FF756445CB8: SetLastError.KERNEL32 ref: 00007FF756445D67

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF75644D94B,?,00000000,00000092,?,?,00000000,?,00007FF7564442C1), ref: 00007FF75644D2EE

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: a8334e6b54be681260e95f2da46ab40b3b68223c67b0e278abaffbc4ce1ac67b
Instruction ID: 34e2d48c87db6e6bc49dbe7549f9bb9720d05d2cccc8461da46a7062bf8f7386
Opcode Fuzzy Hash: a8334e6b54be681260e95f2da46ab40b3b68223c67b0e278abaffbc4ce1ac67b
Instruction Fuzzy Hash: DD01F572F0828146EB146F55E8817FAB6A1FB407A6F888231C669472C4DF7CD680C710

Function 00007FF756448E4C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7564491AF,?,?,?,?,?,?,?,?,00000000,00007FF75644C7F0), ref: 00007FF756448E9B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 22e6d56a2479983aa24c821f7915748be8a8f683883795b8a980db0dd1babcfa
Instruction ID: 30a09925cf99fd1eec79976fa81496294bae7e7c6a6e9af05a25e6ef562be9c2
Opcode Fuzzy Hash: 22e6d56a2479983aa24c821f7915748be8a8f683883795b8a980db0dd1babcfa
Instruction Fuzzy Hash: D7F01D71A08B8183E704EB19ED911AAB372EB98B80F9C4035DA4D87765CF3CD5A0C310

Function 000002574147DAE0 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000002574147DB2F

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction ID: 4a8865c9ce270a40a8dac227f8fa4e96a9d677cd819da2fbae9ba07a1c89e56a
Opcode Fuzzy Hash: 17140df511fe09419b9fc83be2d2c34c2fb9fdba42dd4bc62a26aeb66c77a399
Instruction Fuzzy Hash: B7F06875748F4083E744EB1AFC94295B371F7987C1F255025EA5993369CE3CC551C708

Function 00007FF756446844 Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF756446B86

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 7f8d784388c29e50a9ea76849624ee7fdd6d3f0132adaebc282318182cf08c6d
Instruction ID: 5982858acc5a68dc5ab10cd2840aa5fe99d66918af16a87ba696533ebdc20330
Opcode Fuzzy Hash: 7f8d784388c29e50a9ea76849624ee7fdd6d3f0132adaebc282318182cf08c6d
Instruction Fuzzy Hash: 76A17762F087D686EB21DF25A8017ABBB94EB51B84F488032DF8D47785DE3DE645C310

Function 00007FF7564402A8 Relevance: 1.5, Strings: 1, Instructions: 247COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FF756440484

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d37ea77a3cce38cd321032bb1ff835da33d935561b5e8104ad0e6f6f8b8a62f8
Instruction ID: e61d4326a3346df44deb509f1f65b72acbdb9c8e7ee414ba5a30e5210b89bdb0
Opcode Fuzzy Hash: d37ea77a3cce38cd321032bb1ff835da33d935561b5e8104ad0e6f6f8b8a62f8
Instruction Fuzzy Hash: A3B1BE72D087458AE764EF28C85227EBBA0E745F49FA80135CB4E47395CF39D661C724

Function 00007FF75645209C Relevance: 1.4, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF756452141

Part of subcall function 00007FF756445798: HeapAlloc.KERNEL32(?,?,00000000,00007FF756445E92,?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028), ref: 00007FF7564457ED

Part of subcall function 00007FF756445810: RtlFreeHeap.NTDLL(?,?,00007FF756445929,00007FF75644ACD6,?,?,?,00007FF75644B053,?,?,00000000,00007FF75644B9B9,?,?,?,00007FF75644B8EB), ref: 00007FF756445826
Part of subcall function 00007FF756445810: GetLastError.KERNEL32(?,?,00007FF756445929,00007FF75644ACD6,?,?,?,00007FF75644B053,?,?,00000000,00007FF75644B9B9,?,?,?,00007FF75644B8EB), ref: 00007FF756445830

Part of subcall function 00007FF756454700: _invalid_parameter_noinfo.LIBCMT ref: 00007FF756454733

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 053a47b18b98772e483d4cb8cedf15fedaac31aca4fa50d076ed251903ccc722
Instruction ID: 728ba1b14ec60c1a215c2f673a3c5af3f28efcc58d6c99b5382292aab6e68dc3
Opcode Fuzzy Hash: 053a47b18b98772e483d4cb8cedf15fedaac31aca4fa50d076ed251903ccc722
Instruction Fuzzy Hash: FF41C321F1964342FA307A226C517BBE690AFA57C0FC85536EE4D47B89EE3DE6018620

Function 00007FF7564166E0 Relevance: 1.0, Instructions: 996COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a24e7cebadb25e1a1071a985e3153bb70c692dd492349961dac4431c1ac8243
Instruction ID: 161e07e5f089ff6a964711fca9ff3358ee0c017a6b00b8a63cfa7641c21e6a0c
Opcode Fuzzy Hash: 9a24e7cebadb25e1a1071a985e3153bb70c692dd492349961dac4431c1ac8243
Instruction Fuzzy Hash: C1A26BF6304A4087DB08CA9DE0A572AF766E3C8B90F44513AE75B877A8DE7CD855CB04

Function 00007FF756416730 Relevance: .9, Instructions: 934COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cca1694c4598a210c22f8f475ca8cb19f43e7237f1ec9f88dcea8dcebb1f8f2
Instruction ID: 043d1bd3dcbeca4356ade009636ecdf095cfafa45db118e47c457106ffa0812d
Opcode Fuzzy Hash: 3cca1694c4598a210c22f8f475ca8cb19f43e7237f1ec9f88dcea8dcebb1f8f2
Instruction Fuzzy Hash: 63926AF5304A4087DB08CA9DE0A572AB766E3C8B90F44513AE75B877E8DE7CD895CB04

Function 00007FF7564423EC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c0cb83c689dd070a6176691960342bf1b6f8408e44a1f4b5d5845a74465e3e
Instruction ID: 2e0c7197d27c00c4391e2fceb621181a8efe98ebfaec4c266672a5810f9da1cf
Opcode Fuzzy Hash: 84c0cb83c689dd070a6176691960342bf1b6f8408e44a1f4b5d5845a74465e3e
Instruction Fuzzy Hash: 5242AB21D7DE4686E663AF35EC52937E724BF523C5F848333E80E36555EF6CA6428220

Function 00007FF7564381D0 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbc041faab4c4b85c301c09ae377af77968fd4b1b396d05bf3904191bd81879
Instruction ID: d0a5e677131f163c01c127908b9561db3c4b13a92d747ef5fe718d745acb8605
Opcode Fuzzy Hash: 0cbc041faab4c4b85c301c09ae377af77968fd4b1b396d05bf3904191bd81879
Instruction Fuzzy Hash: C112D1727101644BEA44EB2AE86C4BA37D2F79C78E7C56027FB894F349C62DA504D721

Function 00007FF756434C30 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6634bdd44a1fa22541afa8fe710b752d6f9a0eae90cea3df49b852092a4059f
Instruction ID: bf2971ab6bbbb35e479b352ac0b19f8e9d4fee1e3cb6c5a0d2e015607fde07b1
Opcode Fuzzy Hash: b6634bdd44a1fa22541afa8fe710b752d6f9a0eae90cea3df49b852092a4059f
Instruction Fuzzy Hash: C112C432B1829687D7289F26D9406BEB7A1FB457C5F840031EBC947784DB3DE6A09B60

Function 00007FF7564139E0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642dc4f14b60206c0f6215a59d388f5b7023f11b53123760bd48b8ccc2892c3b
Instruction ID: a9d0df47433d729632484541a538db234b4f0fdc4cfdd1c4e966a2cb56abc5f8
Opcode Fuzzy Hash: 642dc4f14b60206c0f6215a59d388f5b7023f11b53123760bd48b8ccc2892c3b
Instruction Fuzzy Hash: 5D221B72A1C2818FD365DA29E45076BFBE2E7C9304F548139F69DC3A99DA3CE9008F54

Function 00007FF7564407B4 Relevance: .3, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec41fcf7318b3fdb136675af6d95facf500f9601c2ec072af153a2977cac78c0
Instruction ID: 5a56e39e39a960a9d953e8d362c0899b858101e953d6f064fb02ed8cae092d09
Opcode Fuzzy Hash: ec41fcf7318b3fdb136675af6d95facf500f9601c2ec072af153a2977cac78c0
Instruction Fuzzy Hash: 95D1E522E0864285FB68AF29895227FB7A0EF45F49F9C4135CE0D17695CF3DEA61C360

Function 0000025741455AB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: 9b3668f0b8192ea3ab6c4dfb9da2d961eb15aff6ec2f399210e9e7cca2328ed0
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: E9C1D1B3A146948BE355CF2CD40195D7BA0F398B84F40A629EF56C3B01E778E9A5CF80

Function 00007FF756444110 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: ccdc4cc223566a9e700b4a92f04d3f31291b7a6cb77f8d2068ca2b5d0f3811b7
Instruction ID: c271928056e0a0bca11d4378c95650e56d8ac0840c2d6f9569faec22d19b85e9
Opcode Fuzzy Hash: ccdc4cc223566a9e700b4a92f04d3f31291b7a6cb77f8d2068ca2b5d0f3811b7
Instruction Fuzzy Hash: ADC1C726E0868245EB60EF629C127BBA7A0FB947C9FC84235DE4D47A94EF3CD645C310

Function 000002574147A924 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction ID: d312cff8088a233e9c4238eb34719bd22accdf0b1e628452fb2f93e6bb2475fd
Opcode Fuzzy Hash: a2379e98abae736fe33e8b4f9fedcc0141c51f1be06055089ccb01d873b85599
Instruction Fuzzy Hash: FEC1086A348F8086EB60BB6AEC143AA27B1F7847CAF684015DE9D67BD4DF38C545C704

Function 00007FF75643C550 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f11c4fce7bcea95ba431acbf49a59f23e7ae597986c30c574894197be224cf
Instruction ID: f1f84912f0fd2ff75228dceffdffdffe8e63d09e19cb80973890dc2344bacaf5
Opcode Fuzzy Hash: 46f11c4fce7bcea95ba431acbf49a59f23e7ae597986c30c574894197be224cf
Instruction Fuzzy Hash: 37B1A497E28FCA41F613973D5442576E311AFFB3D0A79E323FDE430A11AB54A6C58224

Function 00007FF75644C8B4 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 016909b738e5124339fad153d3415a28628c645a638055c2929be9a92ab91f6c
Instruction ID: 9ccaa5e23981ea41f34e2808577eb130ad4d718c81b02fb7eea90d4dfbb25a21
Opcode Fuzzy Hash: 016909b738e5124339fad153d3415a28628c645a638055c2929be9a92ab91f6c
Instruction Fuzzy Hash: 7AB1A872E1878682EB64EF21D8126BBB351FB54B89F8C4131DA59836C9DF3CE641C760

Function 00007FF756463DA0 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d98f4d47e0a857b1cf393355eb1c2583f24a2c3040599a4cd7810a84d3a9fbd0
Instruction ID: a48f769a110d8c2dfa7a9faefbe5f7111e2cee795e5ae09b195e779f77930367
Opcode Fuzzy Hash: d98f4d47e0a857b1cf393355eb1c2583f24a2c3040599a4cd7810a84d3a9fbd0
Instruction Fuzzy Hash: E481D572A04A9186EB64EF25D88137E73A0FB44B98F888636EF1E57785CF38D651C350

Function 00007FF756439C10 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976ad66ee5da2cf88b50c9bfd367b15b8b9c24bdb5795f368fa9833ed7feb0ee
Instruction ID: 2928cbe91ec0ecee974360bc20f9e6e4a0449ff2a45677f72ecbc19031d19d47
Opcode Fuzzy Hash: 976ad66ee5da2cf88b50c9bfd367b15b8b9c24bdb5795f368fa9833ed7feb0ee
Instruction Fuzzy Hash: 2D715A61F387C547F716473CA8021B6D655AFE23C5F94E332F98836A96FB2C92828304

Function 00007FF756447358 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cc90599417af31cb42002b1ceffe57e88da7026f26894e3c97641a83985020
Instruction ID: 57f414b37382f66f4861b5a934958ec4613cbc06067613d52d9ca5ce1540c06e
Opcode Fuzzy Hash: 47cc90599417af31cb42002b1ceffe57e88da7026f26894e3c97641a83985020
Instruction Fuzzy Hash: 98811372E0878186E774DB29988237BBA91FB857D4F984235DA8D07B89CF3DD601CB10

Function 00007FF756437F90 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fef933332038a432e0cbe0650c9c98f510f7709ea3c3125d6e13103ebde481
Instruction ID: 66f54772f44f0a0cce6898f5f45fe558371406c4f474bc7b2dc8a1f440f7dd7c
Opcode Fuzzy Hash: e6fef933332038a432e0cbe0650c9c98f510f7709ea3c3125d6e13103ebde481
Instruction Fuzzy Hash: 6751D3B1F580E50BDFAC433DA835F79ADD59B82350B4DE039E191C9BDBE01E8242AB54

Function 000002574147F7E6 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction ID: ffbfe3d9718a4498a9ae2adddb1b223295281669fccc3796b8d8a629d7c83891
Opcode Fuzzy Hash: afd72482e03d17e0c267891211c2a08fffdf3b2de236a6c27577c882ac387638
Instruction Fuzzy Hash: 8F51387265CB8086EB74EB2DB848369BAA0F3467D4F144225DABA63BD9D73CC5008B14

Function 00007FF75643F7EC Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: bddff93895798ae2f994d8b674f26ba6501942e29c301b065662b1bb5cb18313
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: FF51A636B18655C5E7A89F2AC45027AB7A0EB44F98FAC4131CE4D17794CF3AEA83C750

Function 00007FF75643FBF4 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 6d7e2d2034bfaaa23a485fb50217e9f73f29562907ac7714659b87abbc0cdc3e
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 4E51C672B18A5585E7A49B29C44433AB7A0FB45F98FAC4131CE4D477A4CF3AEA83C750

Function 00007FF75643F9F0 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: f55ce141d914aae6143592e32931702f21d562a44636843a7e3b7c9eb2553ad3
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 6451D972B1865585E7A4AB29C45023EB7A0EB44F98FAC4131CE4C17794DF3AEE83C750

Function 000002574147579C Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 74f3d2c5a42d9c60148aac22d0cadfb77e2ca52aec38310401b78f10b7a15621
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: D951D172668E5086EB249F2DE85832C37B0E345F69F298115CE996F7A4CB32CC53C784

Function 00007FF7564528CC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 252e97116b409d639cb7cf3346977e6c479a1c19db0d37f8eb51e4ebf816e3a9
Instruction ID: 0dbf94fac640b68d4fd056ab9c1230c718babf1beece550fdef9024da0b85369
Opcode Fuzzy Hash: 252e97116b409d639cb7cf3346977e6c479a1c19db0d37f8eb51e4ebf816e3a9
Instruction Fuzzy Hash: 6941B032B14A5582EF18DF2AD96516AA3A2FB58FD0B8D9433DE0D87B58DF3DD6418300

Function 00007FF75643CFA0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3993780a94f75fabcfaabf439322e03bb81cee0a4827234de154ef40bcba7dd
Instruction ID: 9ce496e4d42fc4ecd0bffe7962153ce384791a3ad7a290ccfd9e250d75bfa9c8
Opcode Fuzzy Hash: e3993780a94f75fabcfaabf439322e03bb81cee0a4827234de154ef40bcba7dd
Instruction Fuzzy Hash: B031CD56D19BC945E602EB39AC42232E390BF9A790FE4D321EEF474555EF1CF2444714

Function 00007FF75643AF56 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e816ee9afbbd517afeac584de8933918a4fef5f7729cbd70fe33994d3c5995a
Instruction ID: 2fa86ed1a07721dd0dcf3fe807388df18e06487fac30650a44189e44ca7dffc6
Opcode Fuzzy Hash: 3e816ee9afbbd517afeac584de8933918a4fef5f7729cbd70fe33994d3c5995a
Instruction Fuzzy Hash: CE219C97C1DBCD45E602AF3E9C82172E350BF9A790FA4E321EDF434411AF18B2944714

Function 00007FF75643CEB2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c464e3852cc5915b9151c8cba22a9675c3ba6e6f19de27809d4dbd020f5729
Instruction ID: c7f75d17a904b6bcf5dbd9ed02b5b13e71179aa7fb6980d95d8785f560346b15
Opcode Fuzzy Hash: 93c464e3852cc5915b9151c8cba22a9675c3ba6e6f19de27809d4dbd020f5729
Instruction Fuzzy Hash: 7E118DC7C5AB5D05E603AF3F5CC2061E250AF6A5947B8E762EDF034121FB2572D94314

Function 00007FF756449AA0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e39b6c27bf28f0e056e49cbc12428bf1b6f050c7fc376ff2e6193081efeec9
Instruction ID: b60ff33a15b7e301f4808ec03717a0ad6de5d09b26cc6e89023ee1cf303dda49
Opcode Fuzzy Hash: 31e39b6c27bf28f0e056e49cbc12428bf1b6f050c7fc376ff2e6193081efeec9
Instruction Fuzzy Hash: 63F06871B186968BDB98DF28A823A2A77D1F718780F94853AD58DC3B08DF3D90908F14

Function 0000025741454A30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000025741454A86
Process32FirstW.KERNEL32 ref: 0000025741454ACA
Process32NextW.KERNEL32 ref: 0000025741454ADF
OpenProcess.KERNEL32 ref: 0000025741454B1B
OpenProcessToken.ADVAPI32 ref: 0000025741454B42
GetTokenInformation.ADVAPI32 ref: 0000025741454B6E
GetLastError.KERNEL32 ref: 0000025741454B7C
GetTokenInformation.ADVAPI32 ref: 0000025741454BBC
ConvertSidToStringSidA.ADVAPI32 ref: 0000025741454BD3
CloseHandle.KERNEL32 ref: 0000025741454C46
CloseHandle.KERNEL32 ref: 0000025741454C51
CloseHandle.KERNEL32 ref: 0000025741454CB6
Process32NextW.KERNEL32 ref: 0000025741454CC3
CloseHandle.KERNEL32 ref: 0000025741454CE9
CloseHandle.KERNEL32 ref: 0000025741454CF2
CloseHandle.KERNEL32 ref: 0000025741454D07

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction ID: b575529d2629cfe6c7de2b83cb432fa7c170b8d33f7473f0044ed7a92be601b7
Opcode Fuzzy Hash: b7cdb7a7c6588e50aaab37c0fa57b8db1cd1071ffc72c1321cf755afb8342ce3
Instruction Fuzzy Hash: CD819132258F8082E751EF5AFC5836AB3B4F788B96F450015DE896BB58EF78C405CB04

Function 00007FF756404C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF756404C1F
_Yarn.LIBCPMTD ref: 00007FF756404C31
_Yarn.LIBCPMTD ref: 00007FF756404C43
_Yarn.LIBCPMTD ref: 00007FF756404C55
_Yarn.LIBCPMTD ref: 00007FF756404C67
_Yarn.LIBCPMTD ref: 00007FF756404C79
_Yarn.LIBCPMTD ref: 00007FF756404C8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF756404CA3

Part of subcall function 00007FF75645B954: _Yarn.LIBCPMT ref: 00007FF75645B982

Strings

bad locale name, xrefs: 00007FF756404CAB

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: fdf93c7b3725d3de9480c70fc984c330f16ff8bafd09a5e6a50b7f6b76af3ea8
Instruction ID: 3fa38170beae2c965788366fc0cccecc54f2c4dd23a65e122fa7d6ed11adeee5
Opcode Fuzzy Hash: fdf93c7b3725d3de9480c70fc984c330f16ff8bafd09a5e6a50b7f6b76af3ea8
Instruction Fuzzy Hash: CC114F61A4EB4682DE00F72AE89126F9360FFC7B84F941035EA8E1B76BCE2DD5518714

Function 0000025741469B70 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000025741469BA1
GetProcessId.KERNEL32 ref: 0000025741469BAA
RmStartSession.RSTRTMGR ref: 0000025741469BCA
RmRegisterResources.RSTRTMGR ref: 0000025741469BF5
RmGetList.RSTRTMGR ref: 0000025741469C2E
RmGetList.RSTRTMGR ref: 0000025741469C90
RmEndSession.RSTRTMGR ref: 0000025741469CCB
RmEndSession.RSTRTMGR ref: 0000025741469D02
RmEndSession.RSTRTMGR ref: 0000025741469D17

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction ID: ad4c1e2291ab2165354f1a3c76a80c0617697c81d0f995110ba5a57ff597d94b
Opcode Fuzzy Hash: 4ddc3a5b4f8c6342cd3dcf0c0e78daa6693b2bbe667ef408570da53bc05ca548
Instruction Fuzzy Hash: 8A515072B58A508AFB10DFA9F85879D73B1F74874AF504129DE0A67B98DF38C806C744

Function 00007FF7564035B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7564035DB
RtlImageNtHeader.NTDLL ref: 00007FF756403606

Strings

.data, xrefs: 00007FF7564035E6
ntdll.dll, xrefs: 00007FF7564035D4
.mrdata, xrefs: 00007FF7564036DA

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: HandleHeaderImageModule
String ID: .data$.mrdata$ntdll.dll
API String ID: 1307054163-825320017
Opcode ID: 540e6d451a2b33d2f7aa5391ba2a9d0ff351769d0afe938c76c5a5a31751ba7e
Instruction ID: dae3911b46d03da24273eb2928660a83e55db731a86f42e788993cfca29a8e8a
Opcode Fuzzy Hash: 540e6d451a2b33d2f7aa5391ba2a9d0ff351769d0afe938c76c5a5a31751ba7e
Instruction Fuzzy Hash: CBA14A32618B8686E7A0EB15E84036BFBA4F788794F944135EACD47BA8DF3CD544CB10

Function 00007FF756448EC8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7564495D0,?,?,?,?,00007FF75644DBCD,?,?,?,?,00007FF75645B3F8), ref: 00007FF756449044
GetProcAddress.KERNEL32(?,?,?,00007FF7564495D0,?,?,?,?,00007FF75644DBCD,?,?,?,?,00007FF75645B3F8), ref: 00007FF756449050

Strings

api-ms-, xrefs: 00007FF756448F8E
ext-ms-, xrefs: 00007FF756448FA1

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 88c23d9036aded5f7076838acfe0058b8650966d7edef86c05992df23181fc12
Instruction ID: 69119591c53906b9b7a79a567868f540b727426fc034db52fc0da11b9981c1dd
Opcode Fuzzy Hash: 88c23d9036aded5f7076838acfe0058b8650966d7edef86c05992df23181fc12
Instruction Fuzzy Hash: F941F431F19A0286FA16AB16AC2157BA396BF45BE0F8C4135DD0D87784EF3CE645C320

Function 000002574147DB5C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002574147DCD8
GetProcAddress.KERNEL32 ref: 000002574147DCE4

Strings

ext-ms-, xrefs: 000002574147DC35
api-ms-, xrefs: 000002574147DC22

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction ID: d659d8a3dd5c729655cb69f50e1a345ffb96f533fb450c718b7d2f2a84edf412
Opcode Fuzzy Hash: ca7c09baf792878f96d911292d21648074434898d998409f668d6f16be7d0add
Instruction Fuzzy Hash: 314126213A9F1085FB16EB1ABC0876663F9B744BE2F4945269D2D7B788DE38C805C308

Function 00007FF75644146C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7564414AF
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75644189C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF756441B38

Strings

p, xrefs: 00007FF7564415D9
p, xrefs: 00007FF756441561
f, xrefs: 00007FF7564415D1

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 35f128cec712ba658e9c7200868182dc03db665a37542de7a91c1d423a514665
Instruction ID: a12c380de65df78317ef05bcde636c9db7245e7742e4e466be02e921c35a3ff3
Opcode Fuzzy Hash: 35f128cec712ba658e9c7200868182dc03db665a37542de7a91c1d423a514665
Instruction Fuzzy Hash: 59128231E0C18386FB24BA55E8566BBF6A1FB40752FCC4535D689476C4DF3CE6848B24

Function 00000257414738F0 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000025741473933
_invalid_parameter_noinfo.LIBCMT ref: 0000025741473D20
_invalid_parameter_noinfo.LIBCMT ref: 0000025741473FBC

Strings

p, xrefs: 0000025741473A5D
f, xrefs: 0000025741473A55
p, xrefs: 00000257414739E5

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction ID: bfdc7e9512b80b56edf4f3544c9291e3de592247f48e0b589ebf4a35024cb614
Opcode Fuzzy Hash: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction Fuzzy Hash: CE12E77264C94286FB60BB1DFA5C3B976B1F780B52FC84125E6F5676C4D738C8848B18

Function 00007FF7564535B8 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7564539E5

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2111bb826fba5276a3a9dd84415bba117cbc3f7a0067bdd87d396387dbaf4657
Instruction ID: d45028c38e2382b16ebd49e10ed1d3e371cf05dedd576630dfe68ad51fdf9774
Opcode Fuzzy Hash: 2111bb826fba5276a3a9dd84415bba117cbc3f7a0067bdd87d396387dbaf4657
Instruction Fuzzy Hash: 1AC1F562E0C78691E7267B15A8402BFFB91EBA0B80FDD4135ED4D03399EE7DE6458321

Function 00007FF75641EFC0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641F011

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF75641F334
4, xrefs: 00007FF75641EFE9
d, xrefs: 00007FF75641F0CC
4, xrefs: 00007FF75641F30A
+, xrefs: 00007FF75641F0AE

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz$4$4$d
API String ID: 3999070443-264949567
Opcode ID: 1743ddae81d6ea49377a863fa6a1ec82f2316a6d258534a902e75a0a57e9bff6
Instruction ID: 8bdd25240e45bfd738be9d843fccf83a4dd909261a2a2d8f3a9d2c03006b24a6
Opcode Fuzzy Hash: 1743ddae81d6ea49377a863fa6a1ec82f2316a6d258534a902e75a0a57e9bff6
Instruction Fuzzy Hash: B0C1CA7250DBC48ADBA1CB19F4803AAB7A0F399790F504125E6CE43B98DB7DD595CF10

Function 00007FF75645AF88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF75645B18F,?,?,00000000,00007FF756457CE2,?,?,?,00007FF7564674ED), ref: 00007FF75645B00D
GetLastError.KERNEL32(?,?,?,00007FF75645B18F,?,?,00000000,00007FF756457CE2,?,?,?,00007FF7564674ED), ref: 00007FF75645B01B
LoadLibraryExW.KERNEL32(?,?,?,00007FF75645B18F,?,?,00000000,00007FF756457CE2,?,?,?,00007FF7564674ED), ref: 00007FF75645B045
FreeLibrary.KERNEL32(?,?,?,00007FF75645B18F,?,?,00000000,00007FF756457CE2,?,?,?,00007FF7564674ED), ref: 00007FF75645B0B3
GetProcAddress.KERNEL32(?,?,?,00007FF75645B18F,?,?,00000000,00007FF756457CE2,?,?,?,00007FF7564674ED), ref: 00007FF75645B0BF

Strings

api-ms-, xrefs: 00007FF75645B02D

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0d0ac073453aeb45f407a3059d888d0c76c4a1015270bd98423673d19d5896fd
Instruction ID: 7d8b6ad61627192363fe9232ea1b403600e366a11f48616261fe3093c12700cd
Opcode Fuzzy Hash: 0d0ac073453aeb45f407a3059d888d0c76c4a1015270bd98423673d19d5896fd
Instruction Fuzzy Hash: 2431A621A1A64291EE12BB16AD10576E3D4FF5AFA0F8D4536DD2D07398DF3CE6458320

Function 00007FF756445CB8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF756445CC7
FlsGetValue.KERNEL32 ref: 00007FF756445CDC
FlsSetValue.KERNEL32 ref: 00007FF756445CFD
FlsSetValue.KERNEL32 ref: 00007FF756445D2A
FlsSetValue.KERNEL32 ref: 00007FF756445D3B
FlsSetValue.KERNEL32 ref: 00007FF756445D4C
SetLastError.KERNEL32 ref: 00007FF756445D67

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0e9a261044974c98fe15c55c3d55f2b3032747381efac69e6f322ca96625eeb5
Instruction ID: 5ca085258f2c1f432f8525e19fb7b55a5ad0de9ea93f58f5513880dad6e7f55b
Opcode Fuzzy Hash: 0e9a261044974c98fe15c55c3d55f2b3032747381efac69e6f322ca96625eeb5
Instruction Fuzzy Hash: 88212120E0D58242FE5C77219E5B17FE2865F487B2FDC4B34D83E066D5EE6CB6418620

Function 00007FF7564549EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF756454A1D
GetLastError.KERNEL32 ref: 00007FF756454A29
CloseHandle.KERNEL32 ref: 00007FF756454A41
CreateFileW.KERNEL32 ref: 00007FF756454A6C
WriteConsoleW.KERNEL32 ref: 00007FF756454A8B

Strings

CONOUT$, xrefs: 00007FF756454A4D

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 143c3a3f26d5e4478db14557210d9b5f5d56c35c52044c9f27410f3b50e0fd75
Instruction ID: b1cde305bbd8fc9ed3140b535801e5e1668945078a96718e2771d32411e9a828
Opcode Fuzzy Hash: 143c3a3f26d5e4478db14557210d9b5f5d56c35c52044c9f27410f3b50e0fd75
Instruction Fuzzy Hash: 41118431B18B4186E7509B52EC5432AE7A0FB98FE4F880234DD5D87B94DF3CD9148754

Function 000002574148C8CC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002574148C8FD
GetLastError.KERNEL32 ref: 000002574148C909
CloseHandle.KERNEL32 ref: 000002574148C921
CreateFileW.KERNEL32 ref: 000002574148C94C
WriteConsoleW.KERNEL32 ref: 000002574148C96B

Strings

CONOUT$, xrefs: 000002574148C92D

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction ID: 81546dc73bbf9de6aa0efbfedce8f5d8c49080b357b9de05c84adad6b6ea5bd9
Opcode Fuzzy Hash: 53dac6272d403f79ff27e653aa55d51cb6535fcae6368453f164039c5e4e95e8
Instruction Fuzzy Hash: C611B231758F8086E750EF5AFC58369A2B4F388FE6F044224EA5D97B94CF38C8448748

Function 00007FF756428020 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 458COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF7564280CE
nan, xrefs: 00007FF75642824A
e, xrefs: 00007FF756428088

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 07c1dcf7fe85bbc1e067f6de4f926c6fb306207c60ad19f74a8bddca7f9c4e8f
Instruction ID: 18f41c549501ffc87874c678e0d05017064d814450fe06b5a79e7668abf02533
Opcode Fuzzy Hash: 07c1dcf7fe85bbc1e067f6de4f926c6fb306207c60ad19f74a8bddca7f9c4e8f
Instruction Fuzzy Hash: 5D42D23260DAC589D6B1AB15E8903EFB7A5F788740F984126CACD83B99DF3CD644CB50

Function 00007FF756429120 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 457COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF7564291CE
nan, xrefs: 00007FF75642934A
e, xrefs: 00007FF756429188

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 7952403a15a35431d6767a2053f8123c38403e361d52805be08b9de745fd9cb8
Instruction ID: 901b3ab4d269e7832e89c6ea1ac355881e6f394c5be128bd60307210f07fa7a6
Opcode Fuzzy Hash: 7952403a15a35431d6767a2053f8123c38403e361d52805be08b9de745fd9cb8
Instruction Fuzzy Hash: B842E33260CAC589D6B19B16E8903EFB7A5F789780F984126CACD83B59DF3CD644CB50

Function 00007FF756429C20 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 457COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF756429CCE
e, xrefs: 00007FF756429C88
nan, xrefs: 00007FF756429E4A

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 5bed7973e5487bab54717232cb26603583bcbfed259e19c44ec6817ed4f113ea
Instruction ID: 22468072a1694254e9131b791b5000c39fc823d6c8afd8c97efffc39e07c8db9
Opcode Fuzzy Hash: 5bed7973e5487bab54717232cb26603583bcbfed259e19c44ec6817ed4f113ea
Instruction Fuzzy Hash: 9E42E23260CAC589D6B1DA15E8903EFB7A5F789780F944026DACD83B99DF3CD684CB50

Function 00007FF75645D26C Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF75645D2DC
MultiByteToWideChar.KERNEL32 ref: 00007FF75645D37A
LCMapStringEx.KERNEL32 ref: 00007FF75645D3E3
LCMapStringEx.KERNEL32 ref: 00007FF75645D435
LCMapStringEx.KERNEL32 ref: 00007FF75645D4DA
WideCharToMultiByte.KERNEL32 ref: 00007FF75645D534

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 2b2fdd1503a79b380a1020f4e969409d4e922ebcf1c0befb99e6f4eb1a253c2d
Instruction ID: 97356e07d03548cc69b81d45e308537ee034da0cef7093063a734b0567eb117b
Opcode Fuzzy Hash: 2b2fdd1503a79b380a1020f4e969409d4e922ebcf1c0befb99e6f4eb1a253c2d
Instruction Fuzzy Hash: F9819172A0878186EB209F25984026EA7E5FF547A8F984231EE5D47BD8DF3CD6448714

Function 0000025741470840 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000257414708B2
_invalid_parameter_noinfo.LIBCMT ref: 00000257414708E3
_invalid_parameter_noinfo.LIBCMT ref: 0000025741470923
_invalid_parameter_noinfo.LIBCMT ref: 0000025741470965
_invalid_parameter_noinfo.LIBCMT ref: 000002574147099A
_invalid_parameter_noinfo.LIBCMT ref: 0000025741470A17

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction ID: b40d82a5ad57c6f72c58e81f99f46af15a4dd286d4769f630243dea2b5233d5d
Opcode Fuzzy Hash: 619b2885e3fd1682f6a864358b33df5452abb606e6c6f730ccce56a3fdc98189
Instruction Fuzzy Hash: 5051867218EF8485F792BF6CF8643AD37B1A757B45F498042C6E867386CA398446C70A

Function 00007FF756445E30 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445E3F
FlsSetValue.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445E75
FlsSetValue.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445EA2
FlsSetValue.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445EB3
FlsSetValue.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445EC4
SetLastError.KERNEL32(?,?,?,00007FF756445929,?,?,?,?,00007FF75644650C,?,?,00000028,00007FF756455573), ref: 00007FF756445EDF

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: cf8115dcaa5ee2122fb104c4df6f54fc23ab72e4ca67caacefd1d5263795953b
Instruction ID: 96078f38e08e17e320aa7aff2df47ba1941e7ccfab768af89a47472e598e1c22
Opcode Fuzzy Hash: cf8115dcaa5ee2122fb104c4df6f54fc23ab72e4ca67caacefd1d5263795953b
Instruction Fuzzy Hash: BE111230E0C68241FA5873229E9717FE2965F487B2FEC4734D93E466D5EE6CB6418320

Function 000002574140DCE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000002574140DD3F

Part of subcall function 000002574149B260: AreFileApisANSI.KERNEL32 ref: 000002574149B272

__std_exception_destroy.LIBVCRUNTIME ref: 000002574140DFE7
__std_exception_destroy.LIBVCRUNTIME ref: 000002574140E0A1

Strings

", ", xrefs: 000002574140DE2D
: ", xrefs: 000002574140DDFA

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: f498b8f5e8a97fd21941d0d66b2b90442ce225ea58df12b1bc0806c1167bf2bc
Instruction ID: 0d6abb256ea01de3b5650fa82a728e5c4e3f3e4e2439ac2be0e9706b8aad685f
Opcode Fuzzy Hash: f498b8f5e8a97fd21941d0d66b2b90442ce225ea58df12b1bc0806c1167bf2bc
Instruction Fuzzy Hash: 32B1CF72758E8086EB00EF69E8483AD2371E749BC9F508521EF5D27B99DF38C595C388

Function 00007FF75641DB90 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641DBC8

Strings

o, xrefs: 00007FF75641DDF2
u, xrefs: 00007FF75641DDDC
e, xrefs: 00007FF75641DF5E
%, xrefs: 00007FF75641DDE7

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: %$e$o$u
API String ID: 1853752696-1884988985
Opcode ID: 5fa3bfed00eb7f098b7cf37669c34e1e722c137927b02883ea76b391b0f2ab52
Instruction ID: 86e0b0eb4c440a8b84d1dda88cb7baba51fce2e5cbcc30bed604b47e6a3cba2e
Opcode Fuzzy Hash: 5fa3bfed00eb7f098b7cf37669c34e1e722c137927b02883ea76b391b0f2ab52
Instruction Fuzzy Hash: 5DE1E37260CBC589DA61DB15E8903EFB7A0F788784F944126EA8D83B69DF7CD544CB40

Function 00007FF756428B30 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 260COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF756428CB3
_Mpunct.LIBCPMTD ref: 00007FF756428E3F

Strings

0, xrefs: 00007FF756428FAD
0, xrefs: 00007FF756428BB8
., xrefs: 00007FF756428F49

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Mpunct
String ID: .$0$0
API String ID: 4240859931-1691970187
Opcode ID: e9687b47ea457237dee4bdc78be1e40fba84c5c64e038008681aa2fe3be40f6b
Instruction ID: 62c295d0c01e55d5b0818067f05bac514d4da7ec86ca20b2ed126111a408464f
Opcode Fuzzy Hash: e9687b47ea457237dee4bdc78be1e40fba84c5c64e038008681aa2fe3be40f6b
Instruction Fuzzy Hash: D1D1D936209BC995DAA1DB1AE4903EEB761F7C8B84F948022DF8D43B69DF39C545CB10

Function 00007FF756402020 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF7564023D2

Part of subcall function 00007FF7564066C0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7564066DD

Strings

rbx, xrefs: 00007FF756402070
rax, xrefs: 00007FF7564021A3
ebx, xrefs: 00007FF7564020A8
eax, xrefs: 00007FF7564021F6

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID: eax$ebx$rax$rbx
API String ID: 1755220593-2388916327
Opcode ID: c01962a9961ff03dcf299c024bebee3a4452aa249518325b59cd457b6bb118a3
Instruction ID: 805eb628463b0e6584cbb41be2a6c4eb9e0bb3aa19f615d1fbabec9de568bb60
Opcode Fuzzy Hash: c01962a9961ff03dcf299c024bebee3a4452aa249518325b59cd457b6bb118a3
Instruction Fuzzy Hash: CAD13223918BD189E331DF389C413EA77B0FBA9748F446225EAC85BA5ADF789344C351

Function 00007FF75641B1E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641B22E

Strings

nan(snan), xrefs: 00007FF75641B3D8
inf, xrefs: 00007FF75641B35F
nan(ind), xrefs: 00007FF75641B390
nan, xrefs: 00007FF75641B3C1

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: e246f93cfd8b01a24d44e219b48bef0b546a2f143c45bedcdc11885149c42856
Instruction ID: 0177743eb34d9bc099c61560036e10ab27c5d6491b315345e66109b945ab6caf
Opcode Fuzzy Hash: e246f93cfd8b01a24d44e219b48bef0b546a2f143c45bedcdc11885149c42856
Instruction Fuzzy Hash: B7A1096660DBC4C5EAB0DB15E8903ABA7A0F7C8790F944136EA8E43B98DF3CD544CB50

Function 00007FF75641D630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641D656

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF75641D862
0p+0, xrefs: 00007FF75641D66C
1, xrefs: 00007FF75641D74D
4, xrefs: 00007FF75641D838

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: 0123456789abcdefghijklmnopqrstuvwxyz$0p+0$1$4
API String ID: 3999070443-1197085086
Opcode ID: 22605e3e1ccf5c9f3454907df50a8bf921d3aa5bdd4aa9ee1894e77eaf097de2
Instruction ID: 36f67b05b7556091bec6f81049eaa138618a68e0d44cb43b2d4a70eada2614f2
Opcode Fuzzy Hash: 22605e3e1ccf5c9f3454907df50a8bf921d3aa5bdd4aa9ee1894e77eaf097de2
Instruction Fuzzy Hash: E3A1A27660DBC485DBA0DB09F8903AAB7A5F388B90F548125EACD47BA8CF7CD544CB11

Function 00007FF75641AE00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641AE4E

Strings

nan, xrefs: 00007FF75641AF8F
nan(snan), xrefs: 00007FF75641AFA6
inf, xrefs: 00007FF75641AF41
nan(ind), xrefs: 00007FF75641AF6B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: 464d97ded6cad5ea3cc5b8df829cfb978308b82cca82f5cc6969c81aa40300fb
Instruction ID: b855e5dc1358d0bc3da4b1171da7d976b6bd814a869f48ed54110e7e99d50481
Opcode Fuzzy Hash: 464d97ded6cad5ea3cc5b8df829cfb978308b82cca82f5cc6969c81aa40300fb
Instruction Fuzzy Hash: 2CA1C57660DBC586EBB0DB15E8807ABB7A0F789780F944126EA8D43B98DF3CD544CB50

Function 00007FF75641AAC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641AB0B

Strings

nan(snan), xrefs: 00007FF75641ACA0
nan, xrefs: 00007FF75641AC89
inf, xrefs: 00007FF75641AC27
nan(ind), xrefs: 00007FF75641AC58

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: d5b88743fa5b3b07afb4db1eeea1c002ad18bbf23253e37765dc3445f34048a6
Instruction ID: c2dc39e2e64201fff8b02b23eee1d737b498261a214e264be16cdefb37931b0d
Opcode Fuzzy Hash: d5b88743fa5b3b07afb4db1eeea1c002ad18bbf23253e37765dc3445f34048a6
Instruction Fuzzy Hash: 64814C6260CBC485DAA0DB15E8503ABB7A1FBC9790FA44136EACE43B98DF3CD144CB51

Function 00007FF75641A7D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641A81B

Strings

nan(snan), xrefs: 00007FF75641A95A
nan(ind), xrefs: 00007FF75641A91F
inf, xrefs: 00007FF75641A8F5
nan, xrefs: 00007FF75641A943

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: 72cc235c785df8f3571cec6a84209a645bb403642a45b9f3071a678ad278a7e8
Instruction ID: f7a06f3c1244afc798cab9b409292cfe842c61d13dfc9ab0ea5d72d59ba5c9ae
Opcode Fuzzy Hash: 72cc235c785df8f3571cec6a84209a645bb403642a45b9f3071a678ad278a7e8
Instruction Fuzzy Hash: B871F97261CBC589DB60DB15E8903ABB7A0FB85780F945026EACD43BA8DF3CD584CB51

Function 00007FF75641A4E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641A528

Strings

inf, xrefs: 00007FF75641A644
nan(snan), xrefs: 00007FF75641A6BD
nan(ind), xrefs: 00007FF75641A675
nan, xrefs: 00007FF75641A6A6

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: 70d59d2c9d76d07b0f33b11adfc2aa066c03e6bbcb9822e25dfa6d8139c5e202
Instruction ID: e0105627bb5aed74577d57b80dc39a4629fde789b8f4cb37e3c2edbf91061dea
Opcode Fuzzy Hash: 70d59d2c9d76d07b0f33b11adfc2aa066c03e6bbcb9822e25dfa6d8139c5e202
Instruction Fuzzy Hash: 3F71296260CBC885DA60DB16F85036BB7A0F789790FA44136EADD47B99DF3CD184CB50

Function 00007FF75641A250 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641A298

Strings

nan(ind), xrefs: 00007FF75641A39C
nan, xrefs: 00007FF75641A3C0
nan(snan), xrefs: 00007FF75641A3D7
inf, xrefs: 00007FF75641A372

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: d5adf79395b74f9d5280ca903bbc3249ff26270c4855bacc272925e682a68ccf
Instruction ID: a6af2b836df9f1f756474ad7cf52c7c92d2de4badb9f616d9228096c75d2687e
Opcode Fuzzy Hash: d5adf79395b74f9d5280ca903bbc3249ff26270c4855bacc272925e682a68ccf
Instruction Fuzzy Hash: 1961F47260CBC589DA609B15E8803ABF7A0F785784FA44026EACD87B69DF3CD585CB50

Function 00007FF7564275D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF75642760E
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564276FD

Strings

^, xrefs: 00007FF756427679
Invalid format string., xrefs: 00007FF75642761E
invalid fill character '{', xrefs: 00007FF7564276C3

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fac_nodeFac_node::_allocatorstd::_
String ID: Invalid format string.$^$invalid fill character '{'
API String ID: 598859312-3800272876
Opcode ID: ad42ce789a6cde225e893fa38872b060042fd1935f330b2a9c7aacee0af1ed30
Instruction ID: a1fde321def2d54dad6e170f5bb84003ef23d5d56612d5c8db8454ce9130c168
Opcode Fuzzy Hash: ad42ce789a6cde225e893fa38872b060042fd1935f330b2a9c7aacee0af1ed30
Instruction Fuzzy Hash: AB41412250DBC189D670AB25E88036BE7A1F7C9794FA81535E6CD43BAADF3CD6448B10

Function 00007FF75644DE14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF75644DE39
GetProcAddress.KERNEL32 ref: 00007FF75644DE4F
FreeLibrary.KERNEL32 ref: 00007FF75644DE76

Strings

CorExitProcess, xrefs: 00007FF75644DE48
mscoree.dll, xrefs: 00007FF75644DE30

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b098b623c8c7801e5285911e96efcdbd3b420d839b436883500a26a7c39cdebe
Instruction ID: 992f70196928b226e6d67a194485ad0e51fbcb6dc4f379b5b4d86e1deea0d13c
Opcode Fuzzy Hash: b098b623c8c7801e5285911e96efcdbd3b420d839b436883500a26a7c39cdebe
Instruction Fuzzy Hash: F9F0C2A1B08B0281FB10AB24EC8537BE360AF94BA1FD80635C56E455E4CF3CD248C320

Function 00007FF75644843C Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF75644847B
_set_statfp.LIBCMT ref: 00007FF756448499
_set_statfp.LIBCMT ref: 00007FF7564484C2
_set_statfp.LIBCMT ref: 00007FF7564486FE

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7ad41c2085167253e11841c847abdc28045ab084f43f852668cbe7a267bd0bec
Instruction ID: cf13d1e7524ca283c7fbc35d96a6328aa7ef61e2c1f44df17736009fd1dc31b7
Opcode Fuzzy Hash: 7ad41c2085167253e11841c847abdc28045ab084f43f852668cbe7a267bd0bec
Instruction Fuzzy Hash: 93814712D1CA468DF2F2BB34AC5237BE2A0EF55395F9C5231E94E26594DF3CE7818620

Function 00007FF756449894 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7564498BC
_set_statfp.LIBCMT ref: 00007FF7564498D7
_set_statfp.LIBCMT ref: 00007FF7564498F3
_set_statfp.LIBCMT ref: 00007FF75644992F

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: 71c05f62f0ad3f99e12f4656951ae98cc4c7d0be135ee66e75d7666079f57d83
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: 91119472E18A0349F6943128DC5737F93417F94376FDC0635E66E067EA8E1CAB41A120

Function 00007FF756445EF8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF756441DF7,?,?,00000000,00007FF756442092,?,?,?,?,?,00007FF75644201E), ref: 00007FF756445F17
FlsSetValue.KERNEL32(?,?,?,00007FF756441DF7,?,?,00000000,00007FF756442092,?,?,?,?,?,00007FF75644201E), ref: 00007FF756445F36
FlsSetValue.KERNEL32(?,?,?,00007FF756441DF7,?,?,00000000,00007FF756442092,?,?,?,?,?,00007FF75644201E), ref: 00007FF756445F5E
FlsSetValue.KERNEL32(?,?,?,00007FF756441DF7,?,?,00000000,00007FF756442092,?,?,?,?,?,00007FF75644201E), ref: 00007FF756445F6F
FlsSetValue.KERNEL32(?,?,?,00007FF756441DF7,?,?,00000000,00007FF756442092,?,?,?,?,?,00007FF75644201E), ref: 00007FF756445F80

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 599f45f996d19451c8b2a229de22a9c688dca7130503bd761d5e478bd2defdca
Instruction ID: f2250c142104268b830bdbf08dc98aea3fc015b8aceefd5302b74d9b29805992
Opcode Fuzzy Hash: 599f45f996d19451c8b2a229de22a9c688dca7130503bd761d5e478bd2defdca
Instruction Fuzzy Hash: AF113D20E0D68242FE5C7722AD5717BE2869F487B2FDC4734E82D466D5EE6CB6418221

Function 00007FF756445D8C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF756445D9D
FlsSetValue.KERNEL32 ref: 00007FF756445DBC
FlsSetValue.KERNEL32 ref: 00007FF756445DE4
FlsSetValue.KERNEL32 ref: 00007FF756445DF5
FlsSetValue.KERNEL32 ref: 00007FF756445E06

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b77b770852fc01411a0c66b1882f58713974e64d821ee1e4b1b057d686c5eaee
Instruction ID: d35754564f1336df3c8df76c1a2d15bc86e3057d75f96ef71630d82537383086
Opcode Fuzzy Hash: b77b770852fc01411a0c66b1882f58713974e64d821ee1e4b1b057d686c5eaee
Instruction Fuzzy Hash: 2B11EC20E0928341FE5C77269C971BBE2864F49372FDC5B34D93E0A2C2ED6CB6519230

Function 00007FF75640AFD0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF75640B29F
_Mpunct.LIBCPMTD ref: 00007FF75640B2BC
std::ios_base::width.LIBCPMTD ref: 00007FF75640B79A

Strings

@, xrefs: 00007FF75640B448

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Mpunct$std::ios_base::width
String ID: @
API String ID: 1355946870-2766056989
Opcode ID: 23e837240074d2248eaa6e84e28edfd629583ca9120122449e8306abbf3755b7
Instruction ID: 9c06cd088347edf3c5d65dd7350d36f67fa618da5734f0894faeae9b6f5c0bdf
Opcode Fuzzy Hash: 23e837240074d2248eaa6e84e28edfd629583ca9120122449e8306abbf3755b7
Instruction Fuzzy Hash: 2512283260DAC985DAB0AB15E8943EFA7A1F7C8790F844136DACD47B69DE7CC645CB00

Function 0000025741429990 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000025741429A00
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000025741429A48
_Getcoll.LIBCPMT ref: 0000025741429A7C

Strings

bad locale name, xrefs: 0000025741429B81

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 21633944dd2c6dfadbdf1e8318949ade1173bd104d2b491eb5dcde31cda3e0aa
Instruction ID: 7ba70ed958a5aca01c099baca6f2508cfa275fdc7a7caab0e5f6d41424e0d272
Opcode Fuzzy Hash: 21633944dd2c6dfadbdf1e8318949ade1173bd104d2b491eb5dcde31cda3e0aa
Instruction Fuzzy Hash: E191AD72745F808AEF14EFB9F89839C3371EB44B99F444165DB5D27A8ADE34C4918348

Function 00007FF75641E280 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641E2D1

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF75641E576
+, xrefs: 00007FF75641E34D
d, xrefs: 00007FF75641E36B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz$d
API String ID: 1853752696-121654361
Opcode ID: 114d9d9c213bd84ef5e71c4c351011e52d5e67b59f85d736c31e102dd82b51f1
Instruction ID: 94c9daaa862797549cc982356899074bf1fdcc6b7203f3d9ab8d4b2d605b4819
Opcode Fuzzy Hash: 114d9d9c213bd84ef5e71c4c351011e52d5e67b59f85d736c31e102dd82b51f1
Instruction Fuzzy Hash: 33C1EF7661C6C58AD7A0DB59E4807AABBA0F388740F50812AE7CE83B98DB7CD444CF50

Function 00007FF75641D260 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF75641D286

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF75641D47C
0p+0, xrefs: 00007FF75641D29A
1, xrefs: 00007FF75641D36C

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: 0123456789abcdefghijklmnopqrstuvwxyz$0p+0$1
API String ID: 1853752696-64391948
Opcode ID: 87ffbadd58718491a0f75fa8edb27ea73874d19d2365bb681a35b88d33976b5c
Instruction ID: 5917caf96ff7808b5831d6fd05f9e9c600bef62660253481956dc55cc0d13e82
Opcode Fuzzy Hash: 87ffbadd58718491a0f75fa8edb27ea73874d19d2365bb681a35b88d33976b5c
Instruction Fuzzy Hash: DDA1927661CBC889D7A0DF19E4803AAB7A0F789B84F549025EACE47B58CF7CD544CB11

Function 000002574140CA60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002574140CACF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002574140CB17
_Getctype.LIBCPMT ref: 000002574140CB55

Strings

bad locale name, xrefs: 000002574140CC0E

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 461f5172515d6199666a23d78f3aff95217434da73e3bc5dd098c4cb94a6e218
Instruction ID: bbbef62bb2d8f2570efce2a74e113e4fc478625ffa96fa81ce4e0ec30b96fdac
Opcode Fuzzy Hash: 461f5172515d6199666a23d78f3aff95217434da73e3bc5dd098c4cb94a6e218
Instruction Fuzzy Hash: 7051373274AF40CAEB10EFB9F8983AD33B5EB44749F444425DA8936A99DF34C525D348

Function 00007FF756405820 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FF7564058D8

Part of subcall function 00007FF7564577D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457824
Part of subcall function 00007FF7564577D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457865

Strings

ios_base::eofbit set, xrefs: 00007FF7564058C2
ios_base::badbit set, xrefs: 00007FF75640589B
ios_base::failbit set, xrefs: 00007FF7564058B4

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ExceptionFileHeaderRaisestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 504923140-1866435925
Opcode ID: 37625c85163a6a2edd9043ea699a6532f1f35351b076ec396d6e3d08002ad281
Instruction ID: 154502cc3326339d6f01cd3884bf778396707e17bd2800abf6b95bb6b1735931
Opcode Fuzzy Hash: 37625c85163a6a2edd9043ea699a6532f1f35351b076ec396d6e3d08002ad281
Instruction Fuzzy Hash: 46214C72A1C781D6E774EB14E85126BB7A0FB88350F984435EACD87A98DF3CD614CB10

Function 00007FF75644E294 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF75644E313
WriteFile.KERNEL32 ref: 00007FF75644E5DB
WriteFile.KERNEL32 ref: 00007FF75644E621
GetLastError.KERNEL32 ref: 00007FF75644E6D7

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 8006df4a7e49d247def26c2c7127d35bc6642300e1a35ffac0c40609046d0867
Instruction ID: 8024ba1eb98cfa353fc49c4da1378aac7d9a434965450ea027c65130b8d3369f
Opcode Fuzzy Hash: 8006df4a7e49d247def26c2c7127d35bc6642300e1a35ffac0c40609046d0867
Instruction Fuzzy Hash: 7FD1E132F18A808AE711DFB5D8406ADB7B2FB44798B888235CF5D97B99DE38D516C310

Function 00007FF75644EBBC Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75644EBA7), ref: 00007FF75644ECD8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75644EBA7), ref: 00007FF75644ED63

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 105dd8715a37432a8ca5a6fa959f0c984e635dbff9f10a33cd2e20e3aea9f4a0
Instruction ID: 38cdece68d9dc0c416be8419aad8e31e92f4277ef1f2acb88c8366c04b888e5a
Opcode Fuzzy Hash: 105dd8715a37432a8ca5a6fa959f0c984e635dbff9f10a33cd2e20e3aea9f4a0
Instruction Fuzzy Hash: 0C91F772F0865285F750EF659C816BEABA0FB44B89F9C8139DE0E57684CF38D542C720

Function 00007FF756407520 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 00007FF75640766A
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7564077D6

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWork
String ID:
API String ID: 4081100948-0
Opcode ID: 433dcc4501cc22be7c96191e04221bbceba203970fa6bf234e56f01351b521ae
Instruction ID: b076d77b1181f50481439db7bee1e759680ad4f6e6f367aa78e8a2a6a92db1c3
Opcode Fuzzy Hash: 433dcc4501cc22be7c96191e04221bbceba203970fa6bf234e56f01351b521ae
Instruction Fuzzy Hash: 8691F53261DAD585EA71AB15E8503EFA7A0FBC8790F841032DACD47BA9DE3CD640CB50

Function 00000257414278A0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000257414278CB
std::_Lockit::_Lockit.LIBCPMT ref: 00000257414278F0
std::_Facet_Register.LIBCPMT ref: 000002574142799B
Concurrency::cancel_current_task.LIBCPMT ref: 00000257414279E6

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction ID: d06bfad9e676cbdf8263f71246bfeb9c6cde13dba97c2d328f55686332cc28ab
Opcode Fuzzy Hash: fce11bbf2716b712929d21612f2a8f238f427733906def6abb3c40e1e27c6ea6
Instruction Fuzzy Hash: B9417F76298F4080FB11EB1AFC58399A770F399BE6F191211EA8D677A5DF38C481C708

Function 000002574149B8E0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000002574149B210: GetModuleHandleW.KERNEL32 ref: 000002574149B226
Part of subcall function 000002574149B210: GetProcAddress.KERNEL32 ref: 000002574149B236

GetLastError.KERNEL32 ref: 000002574149B904

Part of subcall function 00000257414798B4: IsProcessorFeaturePresent.KERNEL32 ref: 00000257414798DA

GetFileAttributesW.KERNEL32 ref: 000002574149B913
__std_fs_open_handle.LIBCPMT ref: 000002574149B93C
CloseHandle.KERNEL32 ref: 000002574149B94E

Memory Dump Source

Source File: 00000000.00000002.1563116781.00000257413E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000257413E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_257413e0000_siveria.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction ID: 07c5745f04f133008a5d268826ef31d1ca1ff4290fb95229b8e66e0772e1c7ba
Opcode Fuzzy Hash: 6a84e7cc61d3f6faa1a02f0b285c9e89f06a54f244136a8e8d2e5cb925bd3053
Instruction Fuzzy Hash: DE11A33127CE4085EB50AB7DB8CCF3A6671D7867B2F144614FAB667AE5DA38C4408B0C

Function 00007FF756456530 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75645655C
GetCurrentThreadId.KERNEL32 ref: 00007FF75645656A
GetCurrentProcessId.KERNEL32 ref: 00007FF756456576
QueryPerformanceCounter.KERNEL32 ref: 00007FF756456586

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a6819c37be0477cab6629fe85bd40332cbc882bfc7744020e340a307dd6c19ab
Instruction ID: 3a189eb2d49c03d008bd6e8fdee5da53a35f192f3f049d202627040109c69256
Opcode Fuzzy Hash: a6819c37be0477cab6629fe85bd40332cbc882bfc7744020e340a307dd6c19ab
Instruction Fuzzy Hash: 3D115E32B14F058AEB00DF61EC552BA73A4FB18758F880E31DA6D86BA4DF38D1A4C350

Function 00007FF756408830 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 356COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF756408A67
std::ios_base::width.LIBCPMTD ref: 00007FF756408EE6

Strings

@, xrefs: 00007FF756408B94

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Mpunctstd::ios_base::width
String ID: @
API String ID: 1954291571-2766056989
Opcode ID: 03687c50ff717027d4cbf97da90ce4cd140f58e9f754c6eefb8b4b0b970cbde7
Instruction ID: 1bdf104f71b140ed4ac99858d5e5f6801ddc8df320274a7eeb44fda6aa74d88e
Opcode Fuzzy Hash: 03687c50ff717027d4cbf97da90ce4cd140f58e9f754c6eefb8b4b0b970cbde7
Instruction Fuzzy Hash: 45022A3260DAD585DAB0AB15E8943EFA7A1F7C8790F884132DACD47B69DE7CC645CB00

Function 00007FF75641E860 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 274COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF75641E898

Strings

e, xrefs: 00007FF75641EC46
B, xrefs: 00007FF75641EAC3

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fence64Read
String ID: B$e
API String ID: 3999070443-1081078989
Opcode ID: c5527d5727164a535ea70a8198cdfd9bb409c33ca9616b643965ae659df559ff
Instruction ID: 44fa665b50d021e9a7bc30c888523d9ae6a3b7b24fee7b7f688f52f2aa6ad4d8
Opcode Fuzzy Hash: c5527d5727164a535ea70a8198cdfd9bb409c33ca9616b643965ae659df559ff
Instruction Fuzzy Hash: 40E1F0B661CBC589DAA0DB15E8903ABB7A0F788784F944126EBCD83B58DF3CD145CB50

Function 00007FF75642B990 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 265COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF75642BBD3

Part of subcall function 00007FF75640B830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75640B84F
Part of subcall function 00007FF75640B830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF75640B87C

Part of subcall function 00007FF7564186A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564186DD

Part of subcall function 00007FF756415C90: List.LIBCMTD ref: 00007FF756415CB2

Strings

x, xrefs: 00007FF75642BAA9
integral cannot be stored in char, xrefs: 00007FF75642B9E8

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 37da2e45b0d7b3146df98e9d44cab3b08f691e1043df3819007dde9a53eafa5e
Instruction ID: 198cb1ecc92b07a614c221d6686daf8740f55fefaf11e3ccc0c5bd15fe1cf117
Opcode Fuzzy Hash: 37da2e45b0d7b3146df98e9d44cab3b08f691e1043df3819007dde9a53eafa5e
Instruction Fuzzy Hash: 86E1273260CBC585D7B1AB15E8943EBBBA1F785744F884126DACC83BA9DF2DD644CB10

Function 00007FF75642C340 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF75642C57E

Part of subcall function 00007FF75640B830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75640B84F
Part of subcall function 00007FF75640B830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF75640B87C

Part of subcall function 00007FF7564186A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564186DD

Part of subcall function 00007FF756415C90: List.LIBCMTD ref: 00007FF756415CB2

Strings

x, xrefs: 00007FF75642C458
integral cannot be stored in char, xrefs: 00007FF75642C397

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 1077f688a18f0bb061bb1737b16c4c955e09df886ced37da15a21ec57a8cb352
Instruction ID: d42953749331030b461f6a53e4bd34df24b143938e0ee7acfa0f4559f7a6cd0d
Opcode Fuzzy Hash: 1077f688a18f0bb061bb1737b16c4c955e09df886ced37da15a21ec57a8cb352
Instruction Fuzzy Hash: BBE1063260CBC585D6B0EB15E8843EBB7A1F785784F984126DACD83BA9DF2DD544CB10

Function 00007FF75642D500 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF75642D748

Part of subcall function 00007FF75640B830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75640B84F
Part of subcall function 00007FF75640B830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF75640B87C

Part of subcall function 00007FF7564186A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564186DD

Part of subcall function 00007FF756415C90: List.LIBCMTD ref: 00007FF756415CB2

Strings

integral cannot be stored in char, xrefs: 00007FF75642D558
x, xrefs: 00007FF75642D619

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 4b244738b26a5789b77ad3fd3cb99100bb612cdf3abe259f1d14dde2a12ef4b0
Instruction ID: 918ba37e322f13d6be484864a8a914cc38aaf26460a7a2d6747049d091ef94c1
Opcode Fuzzy Hash: 4b244738b26a5789b77ad3fd3cb99100bb612cdf3abe259f1d14dde2a12ef4b0
Instruction Fuzzy Hash: 67E1173260CAC599E770AB15E8943EBB7A1FBC9740F844126DACC43BA9DF2CD544CB10

Function 00007FF75642DDF0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF75642E038

Part of subcall function 00007FF75640B830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75640B84F
Part of subcall function 00007FF75640B830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF75640B87C

Part of subcall function 00007FF7564186A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564186DD

Part of subcall function 00007FF756415C90: List.LIBCMTD ref: 00007FF756415CB2

Strings

x, xrefs: 00007FF75642DF09
integral cannot be stored in char, xrefs: 00007FF75642DE48

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 1596abfdd457b49d8574ff87fe7b334aa10946dc342344dab65ebbd4e4ec0ae5
Instruction ID: aca3d35c43be31991fccac7f8d535e9af8f4e9a82f6b6bc661a00101af577e03
Opcode Fuzzy Hash: 1596abfdd457b49d8574ff87fe7b334aa10946dc342344dab65ebbd4e4ec0ae5
Instruction Fuzzy Hash: 35E1273260CBC599D670AB15E8943EBB7A1FB89740F984126DACD43BA9DF3CD644CB10

Function 00007FF75642CC20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF75642CE5E

Part of subcall function 00007FF75640B830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75640B84F
Part of subcall function 00007FF75640B830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF75640B87C

Part of subcall function 00007FF7564186A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564186DD

Part of subcall function 00007FF756415C90: List.LIBCMTD ref: 00007FF756415CB2

Strings

x, xrefs: 00007FF75642CD38
integral cannot be stored in char, xrefs: 00007FF75642CC77

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: f68e61a9b24bcdbe501b4cb4a8be31105e4a74e301578b4c8d38f57891bf8768
Instruction ID: 5f9177fce34b2d7b964954e62c75bad2037e0b1eb92b13940166686f55c8c4a1
Opcode Fuzzy Hash: f68e61a9b24bcdbe501b4cb4a8be31105e4a74e301578b4c8d38f57891bf8768
Instruction Fuzzy Hash: CFE1163260CBC585E6B0AB15E8843EBB7A1F785780F984126DACD43BA9DF3DD644CB50

Function 00007FF756443E7C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF756444020

Strings

., xrefs: 00007FF756443EB7
_.,, xrefs: 00007FF756443EF1

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: .$_.,
API String ID: 3215553584-3384562259
Opcode ID: 5005c32137a548dfb07fd7f872a37727fbf1990c54d12e514ca1fba1ab344483
Instruction ID: a023df576c9d7a4936a68aef0fecc1adb3deae37904dd1089f3bdc10ee98eff6
Opcode Fuzzy Hash: 5005c32137a548dfb07fd7f872a37727fbf1990c54d12e514ca1fba1ab344483
Instruction Fuzzy Hash: D541F721E0924245FB76BA268C432BBE2A1EF51F61FEC0631DA1D076C5DF3DEB558220

Function 00007FF7564291FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF75642930F

Strings

p, xrefs: 00007FF756429212
nan, xrefs: 00007FF75642934A

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 212ba282b589994af6719a8786fa105b4abc7be932bc5a6e8be15af795549e72
Instruction ID: ceb7eef813bf141a305138d118b7715ca29d1a60355efc31546e3f91719e1289
Opcode Fuzzy Hash: 212ba282b589994af6719a8786fa105b4abc7be932bc5a6e8be15af795549e72
Instruction Fuzzy Hash: FC51A47260DBC588D6B19A16E8503EFB6A5F785740F944026CACD86B89DF3CD240CB50

Function 00007FF7564280FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF75642820F

Strings

p, xrefs: 00007FF756428112
nan, xrefs: 00007FF75642824A

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 9322a994478f8a1e71212c7b64208aeab5a97f826a7379df3ff919e47543f4b3
Instruction ID: e46b18d590e8044e224c9e4536e0777d56a326d50de07b2039842c1a355e34cf
Opcode Fuzzy Hash: 9322a994478f8a1e71212c7b64208aeab5a97f826a7379df3ff919e47543f4b3
Instruction Fuzzy Hash: AC51B37260DBC588E7B19B15E8403EFB6A5F788740F984025CACD86B99DF3DD244CB60

Function 00007FF756429CFF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF756429E0F

Strings

p, xrefs: 00007FF756429D12
nan, xrefs: 00007FF756429E4A

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 9481a30ab3fd2cd97439ded438629b95f0626152fff0811fa843788489d09e16
Instruction ID: 74fcd5e04df9977b4e4a1f1abc1977e9c7c5359357ce8530803cb23a36014f97
Opcode Fuzzy Hash: 9481a30ab3fd2cd97439ded438629b95f0626152fff0811fa843788489d09e16
Instruction Fuzzy Hash: 3A51A37260DBC588D6B19B15E8503EFB7A9F785780F944026CACD86B99DF7DD280CB10

Function 00007FF75644E92C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF75644EA43
GetLastError.KERNEL32 ref: 00007FF75644EA65

Strings

U, xrefs: 00007FF75644E9EF

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 803ea60b07f2bfd039fe1532e5b1b15e9d3e37eaacb6a5ccb339d6080fddc9c5
Instruction ID: 2089f9f25383671ebae3057b8d55c3ce893b3a08c2f6695a9cc074bfe0a39308
Opcode Fuzzy Hash: 803ea60b07f2bfd039fe1532e5b1b15e9d3e37eaacb6a5ccb339d6080fddc9c5
Instruction Fuzzy Hash: 5741D672B18A8181DB60EF25E8457BAB761FB98784F884031EE8D87798EF3CD501C710

Function 00007FF7564278B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF756427972

Strings

Invalid format string., xrefs: 00007FF7564279A7
Missing precision specifier., xrefs: 00007FF7564279C3

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_
String ID: Invalid format string.$Missing precision specifier.
API String ID: 2780765137-617221873
Opcode ID: 4ca59656c3cc1c0764987cb03f835006a52b7bc3725c2088db24ddf1b17c7d77
Instruction ID: 14f8fa12e8a62480b63a1169465e7dd5f5340775939248b4cb90411443575282
Opcode Fuzzy Hash: 4ca59656c3cc1c0764987cb03f835006a52b7bc3725c2088db24ddf1b17c7d77
Instruction Fuzzy Hash: 96316D2250DBC585EA50EB55E89012FF7A6FB88790F980532E6CD83B69CFBCD610CB50

Function 00007FF756427761 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7564276FD

Strings

^, xrefs: 00007FF756427679
invalid fill character '{', xrefs: 00007FF7564276C3

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: ^$invalid fill character '{'
API String ID: 1114552684-1467272599
Opcode ID: 719a7894ea2433418be1f6a2a8793a54ba95e5472bef42d9267058544f7ac8f4
Instruction ID: d6b85cac345b85152bcef31645a37bae7f6906ca99e505dcb02866554e8c9de9
Opcode Fuzzy Hash: 719a7894ea2433418be1f6a2a8793a54ba95e5472bef42d9267058544f7ac8f4
Instruction Fuzzy Hash: 3F21861260DBC584D671E715E88037FE751E7C9794FA81432EACD43BAACE6CD644CB10

Function 00007FF756430060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF756430162

Strings

x, xrefs: 00007FF75643009B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: a98be8c2056132d05dbec4f152304ae5764991d5042131e464acb9f7d0bc06b8
Instruction ID: 1955b789ba6277f885d486f8ce4795eece354240b8166aa3e8f85101ffee6ebd
Opcode Fuzzy Hash: a98be8c2056132d05dbec4f152304ae5764991d5042131e464acb9f7d0bc06b8
Instruction Fuzzy Hash: F6313861A1C5C585FF24A715DC4013BEB70BB86BC4FA84532EA8D07A99CF2EDA44CB54

Function 00007FF7564303B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF7564304B0

Strings

x, xrefs: 00007FF7564303EB

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: 9bfe9e957daf48727a13c624664f7626c2dd4fb6e28bca9134fae2d2c54b9db9
Instruction ID: 82fb7c1c3429503ab1da3b97f6261fba4e9e7c7063705ffdf736b4a2e3b7909a
Opcode Fuzzy Hash: 9bfe9e957daf48727a13c624664f7626c2dd4fb6e28bca9134fae2d2c54b9db9
Instruction Fuzzy Hash: F031A851A1C6C581EB24A705DC5023BEB70FB91BC4FA84531E6CD07A99CF2DDB44CB50

Function 00007FF756430920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF756430A21

Strings

x, xrefs: 00007FF75643095B

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: 7016c2d3df3c20257f2f836e6a0a8dc63c202ef464d6a10d065f226a5f5ba269
Instruction ID: 80815f33209908b25c36cac2f1af62a16a8c18103afb76906ddc370d4329da97
Opcode Fuzzy Hash: 7016c2d3df3c20257f2f836e6a0a8dc63c202ef464d6a10d065f226a5f5ba269
Instruction Fuzzy Hash: BA315451B1C5C581EB24B715E84423BE7B0FB86BC4FA84532EB8D07A99CF2DDA45CB50

Function 00007FF7564577D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457824
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF75645651B), ref: 00007FF756457865

Strings

csm, xrefs: 00007FF756457852

Memory Dump Source

Source File: 00000000.00000002.1563649995.00007FF756401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF756400000, based on PE: true

Associated: 00000000.00000002.1563628496.00007FF756400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75646B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563707432.00007FF75671D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563859066.00007FF756729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1563877909.00007FF75672C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff756400000_siveria.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c503307943bf2825cf6e1cf168de274f8e029fc4329f5c4f3fb9745047db57ca
Instruction ID: 31984ab9befa6e46ce9f735d6a773fe36c655b96e2486fde12aec4f0c3f2273d
Opcode Fuzzy Hash: c503307943bf2825cf6e1cf168de274f8e029fc4329f5c4f3fb9745047db57ca
Instruction Fuzzy Hash: 52112E32618B8182EB219F15E84026BB7E4FB98B94F984635DE8C07768DF3CD651C740

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report siveria.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

Windows Analysis Report
siveria.exe

Function 0000025741465B70 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 000002574149B5B0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000002574141D570 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 0000025741445970 Relevance: 17.8, Strings: 14, Instructions: 304
COMMON

Function 000002574145C600 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 0000025741412CA0 Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 789
registryCOMMON

Function 0000025741482E3C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 0000025741465240 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000257414A0658 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 0000025741446350 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1136
COMMON

Function 00000257414120B0 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 684
registryCOMMON

Function 000002574145F020 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 000002574145EBF0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 000002574145FCA0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 226
networkCOMMON

Function 000002574148092C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre