Edit tour

Windows Analysis Report
avutil.dll.dll

Overview

General Information

Sample name:	avutil.dll.dll (renamed file extension from exe to dll)
Original sample name:	avutil.dll.exe
Analysis ID:	1567647
MD5:	2334a6aede2ad2a9004ecd96c872a910
SHA1:	45f7683952a599a607ba6b9b02dacc1586135f22
SHA256:	c3baf0446831b6968a30ea23647ac559ee62219f91daae5c1b0a9787f9c860b9
Tags:	BruteRatelBruteRatelC4exeLatrodectususer-k3dg3___
Infos:

Detection

BruteRatel

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 3268 cmdline: loaddll64.exe "C:\Users\user\Desktop\avutil.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5996 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 4976 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2304 cmdline: rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,DLLMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6368 cmdline: rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_q MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5896 cmdline: rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_stable MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4232 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",DLLMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7020 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_q MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7040 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_stable MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3700 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_version MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5692 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_license MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3536 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_configuration MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2128 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_vga16_font MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 612 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_tempfile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1112 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_solve_lls MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5140 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_free MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 992 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_execute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3468 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_create MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5392 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_set_systematic_pal2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 3424 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_scalarproduct_float_c MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5236 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_request_sample MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2544 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_report_missing_feature MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2308 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_open MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7052 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_init_lls MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 884 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_fopen_utf8 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1396 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_float_dsp_alloc MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2888 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_dict_set_timestamp MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6108 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_cga_font MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4900 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_alloc_fixed_dsp MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1372 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_init MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4616 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_crypt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6516 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_init MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4196 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_crypt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5936 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_alloc MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 368 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line2 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7176 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7184 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vlog MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7192 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vkfmt_from_pixfmt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7200 cmdline: rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vk_frame_alloc MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.4681807964.0000023B61A2C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000009.00000002.4718709422.0000026D524AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000009.00000003.2620826714.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000009.00000003.2620889065.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000003.2290158761.0000021E06F25000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000003.3250525715.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 2304	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 4976	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 4232	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Click to see the 6 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:43:27.566091+0100	2028371	3	Unknown Traffic	192.168.2.6	49744	20.42.65.92	443	TCP
2024-12-03T17:43:27.567553+0100	2028371	3	Unknown Traffic	192.168.2.6	49746	20.42.65.92	443	TCP
2024-12-03T17:43:27.623125+0100	2028371	3	Unknown Traffic	192.168.2.6	49743	20.42.65.92	443	TCP
2024-12-03T17:43:27.624411+0100	2028371	3	Unknown Traffic	192.168.2.6	49745	20.42.65.92	443	TCP
2024-12-03T17:46:46.269900+0100	2028371	3	Unknown Traffic	192.168.2.6	50006	188.114.96.6	443	TCP
2024-12-03T17:47:23.184566+0100	2028371	3	Unknown Traffic	192.168.2.6	50007	20.42.73.29	443	TCP
2024-12-03T17:47:28.167489+0100	2028371	3	Unknown Traffic	192.168.2.6	50008	20.42.73.29	443	TCP
2024-12-03T17:47:28.974293+0100	2028371	3	Unknown Traffic	192.168.2.6	50009	20.42.73.29	443	TCP
2024-12-03T17:47:31.131851+0100	2028371	3	Unknown Traffic	192.168.2.6	50010	20.42.73.29	443	TCP

ET MALWARE Latrodectus Loader Related Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T17:46:46.275407+0100	2048735	1	A Network Trojan was detected	192.168.2.6	50006	188.114.96.6	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: avutil.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.6:50006 -> 188.114.96.6:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.43.224 6542			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.57.249.207 6542			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.6:49707 -> 103.57.249.207:6542
Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 94.232.43.224:6542

Source: Joe Sandbox View	ASN Name: SITINETWORS-IN-APSITINETWORKSLIMITEDIN SITINETWORS-IN-APSITINETWORKSLIMITEDIN
Source: Joe Sandbox View	ASN Name: WELLWEBNL WELLWEBNL

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49745 -> 20.42.65.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49743 -> 20.42.65.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49746 -> 20.42.65.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49744 -> 20.42.65.92:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50008 -> 20.42.73.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50007 -> 20.42.73.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50009 -> 20.42.73.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50006 -> 188.114.96.6:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50010 -> 20.42.73.29:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: vutarf.com
Source: global traffic	DNS traffic detected: DNS query: huanvn.com

Source: rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.o
Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C1A5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C1A5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.oCt
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250525715.0000021E0151E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01525000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618014731.0000023B5C1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250525715.0000021E0151E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01525000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618014731.0000023B5C1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/2
Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/4
Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/
Source: rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.php
Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.phpO
Source: rundll32.exe, 00000009.00000002.4681505732.0000026D4CBDE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/stop.php
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/stop.phpb
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/stop.phpq
Source: loaddll64.exe, 00000000.00000002.4682995000.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4682042385.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2283430783.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2304898278.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2303220927.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2305957918.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2302816272.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2290332722.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2277869231.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2297403449.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2303131049.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2303978956.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2360364252.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2289876882.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2358440180.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2361221187.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2303968170.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2296520709.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2358802398.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.2278843733.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.2303493254.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://streams.videolan.org/upload/
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/K3
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/kY
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401439218.0000026D4CB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.php
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.phpA
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.phpM
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.phpRc
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.phpoc
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E0146F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/stop.php
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/stop.php&

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021E06BFD326 NtProtectVirtualMemory,	3_3_0000021E06BFD326
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021E06BFD2B6 NtAllocateVirtualMemory,	3_3_0000021E06BFD2B6
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B17B0 NtClose,NtClose,	3_2_0000021E016B17B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E4360 NtCreateThreadEx,	3_2_0000021E016E4360
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E4BE0 NtProtectVirtualMemory,	3_2_0000021E016E4BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E4FF0 NtQueueApcThread,	3_2_0000021E016E4FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E4740 NtFreeVirtualMemory,	3_2_0000021E016E4740
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E3F40 NtAllocateVirtualMemory,	3_2_0000021E016E3F40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B71B0 NtClose,	3_2_0000021E016B71B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C7A50 NtSetContextThread,	3_2_0000021E016C7A50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B1600 NtClose,RtlExitUserThread,	3_2_0000021E016B1600
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C8149 NtSetContextThread,	3_2_0000021E016C8149
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_0000023B6169D326 NtProtectVirtualMemory,	4_3_0000023B6169D326
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_0000023B6169D2B6 NtAllocateVirtualMemory,	4_3_0000023B6169D2B6
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61504FF0 NtQueueApcThread,	4_2_0000023B61504FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61504BE0 NtProtectVirtualMemory,	4_2_0000023B61504BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61504740 NtFreeVirtualMemory,	4_2_0000023B61504740
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61503F40 NtAllocateVirtualMemory,	4_2_0000023B61503F40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D17B0 NtClose,NtClose,	4_2_0000023B614D17B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61504360 NtCreateThreadEx,	4_2_0000023B61504360
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E7A50 NtSetContextThread,	4_2_0000023B614E7A50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D1600 NtClose,RtlExitUserThread,	4_2_0000023B614D1600
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E8149 NtSetContextThread,	4_2_0000023B614E8149

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FBFB8	0_2_0000026CE85FBFB8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8608BB0	0_2_0000026CE8608BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FFD38	0_2_0000026CE85FFD38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FED84	0_2_0000026CE85FED84
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DAED4	0_2_0000026CE85DAED4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DDED4	0_2_0000026CE85DDED4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85CDE7C	0_2_0000026CE85CDE7C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DBE74	0_2_0000026CE85DBE74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8607E70	0_2_0000026CE8607E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8602F34	0_2_0000026CE8602F34
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85D8F7C	0_2_0000026CE85D8F7C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85E0038	0_2_0000026CE85E0038
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DA030	0_2_0000026CE85DA030
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860C064	0_2_0000026CE860C064
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85EB074	0_2_0000026CE85EB074
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860214C	0_2_0000026CE860214C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FF134	0_2_0000026CE85FF134
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F71E4	0_2_0000026CE85F71E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85E41DC	0_2_0000026CE85E41DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85EC198	0_2_0000026CE85EC198
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8607244	0_2_0000026CE8607244
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860A294	0_2_0000026CE860A294
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85D8330	0_2_0000026CE85D8330
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85CD440	0_2_0000026CE85CD440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85EE5B4	0_2_0000026CE85EE5B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F7644	0_2_0000026CE85F7644
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DA630	0_2_0000026CE85DA630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85CF6C4	0_2_0000026CE85CF6C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FB6A0	0_2_0000026CE85FB6A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85E9744	0_2_0000026CE85E9744
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DD734	0_2_0000026CE85DD734
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F4780	0_2_0000026CE85F4780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85EE840	0_2_0000026CE85EE840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DF84C	0_2_0000026CE85DF84C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85D7808	0_2_0000026CE85D7808
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85EA7F0	0_2_0000026CE85EA7F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE86018BC	0_2_0000026CE86018BC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F78D8	0_2_0000026CE85F78D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85CE9E8	0_2_0000026CE85CE9E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85E39CC	0_2_0000026CE85E39CC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FB96C	0_2_0000026CE85FB96C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85FFAC4	0_2_0000026CE85FFAC4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F7AA8	0_2_0000026CE85F7AA8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860DB3B	0_2_0000026CE860DB3B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DDB04	0_2_0000026CE85DDB04
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860AAF8	0_2_0000026CE860AAF8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85DEB90	0_2_0000026CE85DEB90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8606C20	0_2_0000026CE8606C20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85D6CE0	0_2_0000026CE85D6CE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE6870024	0_2_0000026CE6870024
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68AF36C	0_2_0000026CE68AF36C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE6887BD8	0_2_0000026CE6887BD8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68B6AEC	0_2_0000026CE68B6AEC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68BA47E	0_2_0000026CE68BA47E
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE687CCE8	0_2_0000026CE687CCE8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE688E438	0_2_0000026CE688E438
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68A7180	0_2_0000026CE68A7180
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68B1164	0_2_0000026CE68B1164
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE687E290	0_2_0000026CE687E290
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE687EF6C	0_2_0000026CE687EF6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE688D77C	0_2_0000026CE688D77C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE687D724	0_2_0000026CE687D724
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68AAF48	0_2_0000026CE68AAF48
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE689A098	0_2_0000026CE689A098
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68870B0	0_2_0000026CE68870B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68898D8	0_2_0000026CE68898D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE689E0E8	0_2_0000026CE689E0E8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE6888824	0_2_0000026CE6888824
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE6886588	0_2_0000026CE6886588
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE68AF5E0	0_2_0000026CE68AF5E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE6889ED8	0_2_0000026CE6889ED8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE689DE5C	0_2_0000026CE689DE5C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CABFB8	3_2_0000021E04CABFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB8BB0	3_2_0000021E04CB8BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C88330	3_2_0000021E04C88330
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBA294	3_2_0000021E04CBA294
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C7D440	3_2_0000021E04C7D440
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8A630	3_2_0000021E04C8A630
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA7644	3_2_0000021E04CA7644
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C9E5B4	3_2_0000021E04C9E5B4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB2F34	3_2_0000021E04CB2F34
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8AED4	3_2_0000021E04C8AED4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8DED4	3_2_0000021E04C8DED4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C7DE7C	3_2_0000021E04C7DE7C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB7E70	3_2_0000021E04CB7E70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8BE74	3_2_0000021E04C8BE74
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C90038	3_2_0000021E04C90038
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8A030	3_2_0000021E04C8A030
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C88F7C	3_2_0000021E04C88F7C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAF134	3_2_0000021E04CAF134
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB214C	3_2_0000021E04CB214C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBC064	3_2_0000021E04CBC064
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C9B074	3_2_0000021E04C9B074
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB7244	3_2_0000021E04CB7244
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA71E4	3_2_0000021E04CA71E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C941DC	3_2_0000021E04C941DC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C9C198	3_2_0000021E04C9C198
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBDB3B	3_2_0000021E04CBDB3B
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBAAF8	3_2_0000021E04CBAAF8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8DB04	3_2_0000021E04C8DB04
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA7AA8	3_2_0000021E04CA7AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAFAC4	3_2_0000021E04CAFAC4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB6C20	3_2_0000021E04CB6C20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8EB90	3_2_0000021E04C8EB90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAFD38	3_2_0000021E04CAFD38
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C86CE0	3_2_0000021E04C86CE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAED84	3_2_0000021E04CAED84
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8D734	3_2_0000021E04C8D734
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C99744	3_2_0000021E04C99744
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAB6A0	3_2_0000021E04CAB6A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C7F6C4	3_2_0000021E04C7F6C4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C8F84C	3_2_0000021E04C8F84C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C9E840	3_2_0000021E04C9E840
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C9A7F0	3_2_0000021E04C9A7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C87808	3_2_0000021E04C87808
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA4780	3_2_0000021E04CA4780
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CB18BC	3_2_0000021E04CB18BC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA78D8	3_2_0000021E04CA78D8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C7E9E8	3_2_0000021E04C7E9E8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04C939CC	3_2_0000021E04C939CC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CAB96C	3_2_0000021E04CAB96C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016DFBC0	3_2_0000021E016DFBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D13A3	3_2_0000021E016D13A3
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D2BB0	3_2_0000021E016D2BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E2F60	3_2_0000021E016E2F60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E2812	3_2_0000021E016E2812
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016CCBE0	3_2_0000021E016CCBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B66C0	3_2_0000021E016B66C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016CBED0	3_2_0000021E016CBED0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C16A0	3_2_0000021E016C16A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C42A0	3_2_0000021E016C42A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D82A0	3_2_0000021E016D82A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E1F40	3_2_0000021E016E1F40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016BA730	3_2_0000021E016BA730
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D66E0	3_2_0000021E016D66E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C55C0	3_2_0000021E016C55C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B99D0	3_2_0000021E016B99D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C4DB0	3_2_0000021E016C4DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B5D60	3_2_0000021E016B5D60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D7220	3_2_0000021E016D7220
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E0210	3_2_0000021E016E0210
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016DB5E0	3_2_0000021E016DB5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D55E0	3_2_0000021E016D55E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016E1490	3_2_0000021E016E1490
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016D4550	3_2_0000021E016D4550
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016C9120	3_2_0000021E016C9120
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016B9500	3_2_0000021E016B9500
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016CA100	3_2_0000021E016CA100
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E016CB4E0	3_2_0000021E016CB4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F20024	3_2_0000021E02F20024
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F4E0E8	3_2_0000021E02F4E0E8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F398D8	3_2_0000021E02F398D8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F370B0	3_2_0000021E02F370B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F4A098	3_2_0000021E02F4A098
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F57180	3_2_0000021E02F57180
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F61164	3_2_0000021E02F61164
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F5AF48	3_2_0000021E02F5AF48
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F2D724	3_2_0000021E02F2D724
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F39ED8	3_2_0000021E02F39ED8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F38824	3_2_0000021E02F38824
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F3D77C	3_2_0000021E02F3D77C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F2EF6C	3_2_0000021E02F2EF6C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F2CCE8	3_2_0000021E02F2CCE8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F6A47E	3_2_0000021E02F6A47E
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F4DE5C	3_2_0000021E02F4DE5C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F5F5E0	3_2_0000021E02F5F5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F36588	3_2_0000021E02F36588
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F66AEC	3_2_0000021E02F66AEC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F2E290	3_2_0000021E02F2E290
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F3E438	3_2_0000021E02F3E438
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F37BD8	3_2_0000021E02F37BD8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E02F5F36C	3_2_0000021E02F5F36C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78BFB8	4_2_0000023B5F78BFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F798BB0	4_2_0000023B5F798BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F75E9E8	4_2_0000023B5F75E9E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78FAC4	4_2_0000023B5F78FAC4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F787AA8	4_2_0000023B5F787AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F7739CC	4_2_0000023B5F7739CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78B96C	4_2_0000023B5F78B96C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76F84C	4_2_0000023B5F76F84C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F77E840	4_2_0000023B5F77E840
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F767808	4_2_0000023B5F767808
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F77A7F0	4_2_0000023B5F77A7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F7878D8	4_2_0000023B5F7878D8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F7918BC	4_2_0000023B5F7918BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F779744	4_2_0000023B5F779744
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76D734	4_2_0000023B5F76D734
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F784780	4_2_0000023B5F784780
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F787644	4_2_0000023B5F787644
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76A630	4_2_0000023B5F76A630
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F75F6C4	4_2_0000023B5F75F6C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78B6A0	4_2_0000023B5F78B6A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F77E5B4	4_2_0000023B5F77E5B4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F75D440	4_2_0000023B5F75D440
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F768330	4_2_0000023B5F768330
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F797244	4_2_0000023B5F797244
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F7871E4	4_2_0000023B5F7871E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F7741DC	4_2_0000023B5F7741DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79A294	4_2_0000023B5F79A294
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79214C	4_2_0000023B5F79214C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78F134	4_2_0000023B5F78F134
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F77C198	4_2_0000023B5F77C198
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76A030	4_2_0000023B5F76A030
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F770038	4_2_0000023B5F770038
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F77B074	4_2_0000023B5F77B074
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79C064	4_2_0000023B5F79C064
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F792F34	4_2_0000023B5F792F34
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F768F7C	4_2_0000023B5F768F7C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76DED4	4_2_0000023B5F76DED4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76AED4	4_2_0000023B5F76AED4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F75DE7C	4_2_0000023B5F75DE7C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F797E70	4_2_0000023B5F797E70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76BE74	4_2_0000023B5F76BE74
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78FD38	4_2_0000023B5F78FD38
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F766CE0	4_2_0000023B5F766CE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F78ED84	4_2_0000023B5F78ED84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F796C20	4_2_0000023B5F796C20
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79DB3B	4_2_0000023B5F79DB3B
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76DB04	4_2_0000023B5F76DB04
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79AAF8	4_2_0000023B5F79AAF8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F76EB90	4_2_0000023B5F76EB90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA00024	4_2_0000023B5DA00024
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA2A098	4_2_0000023B5DA2A098
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA198D8	4_2_0000023B5DA198D8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA170B0	4_2_0000023B5DA170B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA18824	4_2_0000023B5DA18824
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA1D77C	4_2_0000023B5DA1D77C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA0EF6C	4_2_0000023B5DA0EF6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA3AF48	4_2_0000023B5DA3AF48
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA0D724	4_2_0000023B5DA0D724
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA0E290	4_2_0000023B5DA0E290
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA37180	4_2_0000023B5DA37180
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA41164	4_2_0000023B5DA41164
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA2E0E8	4_2_0000023B5DA2E0E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA4A47E	4_2_0000023B5DA4A47E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA1E438	4_2_0000023B5DA1E438
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA3F36C	4_2_0000023B5DA3F36C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA17BD8	4_2_0000023B5DA17BD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA46AEC	4_2_0000023B5DA46AEC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA2DE5C	4_2_0000023B5DA2DE5C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA19ED8	4_2_0000023B5DA19ED8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA3F5E0	4_2_0000023B5DA3F5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA16588	4_2_0000023B5DA16588
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5DA0CCE8	4_2_0000023B5DA0CCE8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614ECBE0	4_2_0000023B614ECBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61502812	4_2_0000023B61502812
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61501490	4_2_0000023B61501490
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614DA730	4_2_0000023B614DA730
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61501F40	4_2_0000023B61501F40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F66E0	4_2_0000023B614F66E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F13A3	4_2_0000023B614F13A3
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F2BB0	4_2_0000023B614F2BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614FFBC0	4_2_0000023B614FFBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61502F60	4_2_0000023B61502F60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F7220	4_2_0000023B614F7220
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614FB5E0	4_2_0000023B614FB5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F55E0	4_2_0000023B614F55E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B61500210	4_2_0000023B61500210
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F82A0	4_2_0000023B614F82A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E16A0	4_2_0000023B614E16A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E42A0	4_2_0000023B614E42A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D66C0	4_2_0000023B614D66C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614EBED0	4_2_0000023B614EBED0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E9120	4_2_0000023B614E9120
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614F4550	4_2_0000023B614F4550
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614EB4E0	4_2_0000023B614EB4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D9500	4_2_0000023B614D9500
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614EA100	4_2_0000023B614EA100
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E4DB0	4_2_0000023B614E4DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614E55C0	4_2_0000023B614E55C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D99D0	4_2_0000023B614D99D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B614D5D60	4_2_0000023B614D5D60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C28BB0	6_2_0000020779C28BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1BFB8	6_2_0000020779C1BFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2AAF8	6_2_0000020779C2AAF8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFDB04	6_2_0000020779BFDB04
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1FAC4	6_2_0000020779C1FAC4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C039CC	6_2_0000020779C039CC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BEE9E8	6_2_0000020779BEE9E8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1B96C	6_2_0000020779C1B96C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BF6CE0	6_2_0000020779BF6CE0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C26C20	6_2_0000020779C26C20
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFEB90	6_2_0000020779BFEB90
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2DB3B	6_2_0000020779C2DB3B
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFAED4	6_2_0000020779BFAED4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFDED4	6_2_0000020779BFDED4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C27E70	6_2_0000020779C27E70
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BEDE7C	6_2_0000020779BEDE7C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFBE74	6_2_0000020779BFBE74
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1ED84	6_2_0000020779C1ED84
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1FD38	6_2_0000020779C1FD38
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C0B074	6_2_0000020779C0B074
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFA030	6_2_0000020779BFA030
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C00038	6_2_0000020779C00038
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2C064	6_2_0000020779C2C064
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C22FD9	6_2_0000020779C22FD9
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BF8F7C	6_2_0000020779BF8F7C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2A294	6_2_0000020779C2A294
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C27244	6_2_0000020779C27244
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C041DC	6_2_0000020779C041DC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C171E4	6_2_0000020779C171E4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C0C198	6_2_0000020779C0C198
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1F134	6_2_0000020779C1F134
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2214C	6_2_0000020779C2214C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BED440	6_2_0000020779BED440
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BF8330	6_2_0000020779BF8330
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BEF705	6_2_0000020779BEF705
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFA630	6_2_0000020779BFA630
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C1B6A0	6_2_0000020779C1B6A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C17644	6_2_0000020779C17644
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C0E5B4	6_2_0000020779C0E5B4
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C218BC	6_2_0000020779C218BC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C0E840	6_2_0000020779C0E840
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C0A84A	6_2_0000020779C0A84A
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFF84C	6_2_0000020779BFF84C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BF7808	6_2_0000020779BF7808
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C14780	6_2_0000020779C14780
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779BFD734	6_2_0000020779BFD734
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C09744	6_2_0000020779C09744
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777E90024	6_2_0000020777E90024
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA98D8	6_2_0000020777EA98D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA8824	6_2_0000020777EA8824
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EAD77C	6_2_0000020777EAD77C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777E9D724	6_2_0000020777E9D724
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777ECF5E0	6_2_0000020777ECF5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA6588	6_2_0000020777EA6588
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EDA47E	6_2_0000020777EDA47E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EAE438	6_2_0000020777EAE438
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777ECF36C	6_2_0000020777ECF36C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777E9E290	6_2_0000020777E9E290
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EC7180	6_2_0000020777EC7180
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777ED1164	6_2_0000020777ED1164
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EBE0E8	6_2_0000020777EBE0E8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA70B0	6_2_0000020777EA70B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EBA098	6_2_0000020777EBA098
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777E9EF6C	6_2_0000020777E9EF6C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777ECAF48	6_2_0000020777ECAF48
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA9ED8	6_2_0000020777EA9ED8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EBDE5C	6_2_0000020777EBDE5C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777E9CCE8	6_2_0000020777E9CCE8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777EA7BD8	6_2_0000020777EA7BD8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020777ED6AEC	6_2_0000020777ED6AEC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A8BB0	8_2_0000025DE61A8BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619BFB8	8_2_0000025DE619BFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6176CE0	8_2_0000025DE6176CE0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619FD38	8_2_0000025DE619FD38
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619ED84	8_2_0000025DE619ED84
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE616DE7C	8_2_0000025DE616DE7C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A7E70	8_2_0000025DE61A7E70
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617BE74	8_2_0000025DE617BE74
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619FAC4	8_2_0000025DE619FAC4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61AAAF8	8_2_0000025DE61AAAF8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617DB04	8_2_0000025DE617DB04
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61ADB3B	8_2_0000025DE61ADB3B
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617EB90	8_2_0000025DE617EB90
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A6C20	8_2_0000025DE61A6C20
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61978D8	8_2_0000025DE61978D8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619B96C	8_2_0000025DE619B96C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61839CC	8_2_0000025DE61839CC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE616E9E8	8_2_0000025DE616E9E8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6197AA8	8_2_0000025DE6197AA8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE616F6C4	8_2_0000025DE616F6C4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617D734	8_2_0000025DE617D734
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6189744	8_2_0000025DE6189744
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6194780	8_2_0000025DE6194780
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE618A7F0	8_2_0000025DE618A7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6177808	8_2_0000025DE6177808
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617F84C	8_2_0000025DE617F84C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE618E840	8_2_0000025DE618E840
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A18BC	8_2_0000025DE61A18BC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE618E5B4	8_2_0000025DE618E5B4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617A630	8_2_0000025DE617A630
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6197644	8_2_0000025DE6197644
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619B6A0	8_2_0000025DE619B6A0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6178330	8_2_0000025DE6178330
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE616D440	8_2_0000025DE616D440
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE619F134	8_2_0000025DE619F134
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A214C	8_2_0000025DE61A214C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE618C198	8_2_0000025DE618C198
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61841DC	8_2_0000025DE61841DC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61971E4	8_2_0000025DE61971E4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A7244	8_2_0000025DE61A7244
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61AA294	8_2_0000025DE61AA294
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617AED4	8_2_0000025DE617AED4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617DED4	8_2_0000025DE617DED4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61A2F34	8_2_0000025DE61A2F34
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6178F7C	8_2_0000025DE6178F7C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6180038	8_2_0000025DE6180038
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE617A030	8_2_0000025DE617A030
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE618B074	8_2_0000025DE618B074
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61AC064	8_2_0000025DE61AC064
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4410024	8_2_0000025DE4410024
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4456AEC	8_2_0000025DE4456AEC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4427BD8	8_2_0000025DE4427BD8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE441CCE8	8_2_0000025DE441CCE8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE443DE5C	8_2_0000025DE443DE5C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE441D724	8_2_0000025DE441D724
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE442D77C	8_2_0000025DE442D77C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4428824	8_2_0000025DE4428824
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE44298D8	8_2_0000025DE44298D8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE444F36C	8_2_0000025DE444F36C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE442E438	8_2_0000025DE442E438
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE445A47E	8_2_0000025DE445A47E
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4426588	8_2_0000025DE4426588
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE444F5E0	8_2_0000025DE444F5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4429ED8	8_2_0000025DE4429ED8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE444AF48	8_2_0000025DE444AF48
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE441EF6C	8_2_0000025DE441EF6C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE443A098	8_2_0000025DE443A098
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE44270B0	8_2_0000025DE44270B0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE443E0E8	8_2_0000025DE443E0E8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4447180	8_2_0000025DE4447180
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE4451164	8_2_0000025DE4451164
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE441E290	8_2_0000025DE441E290

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000025DE6191484 appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000023B5F781484 appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000021E04CA1484 appears 39 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000020779C11484 appears 39 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 0000026CE85F1484 appears 39 times

Source: avutil.dll.dll

Static PE information: Number of sections : 13 > 10

Source: avutil.dll.dll

Binary or memory string: OriginalFilenameavutil-lav-59.dll. vs avutil.dll.dll

Source: classification engine

Classification label: mal96.troj.evad.winDLL@119/1@4/2

Source: C:\Windows\System32\rundll32.exe

Code function: 3_3_00007DF40CCA0000 CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,

3_3_00007DF40CCA0000

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\NTUSER.DAT.Not

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03

Source: avutil.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,DLLMain

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\avutil.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,DLLMain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_q
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_stable
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",DLLMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_q
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_stable
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_version
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_license
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_configuration
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_vga16_font
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_tempfile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_solve_lls
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_free
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_execute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_create
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_set_systematic_pal2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_scalarproduct_float_c
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_request_sample
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_report_missing_feature
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_open
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_init_lls
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_fopen_utf8
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_float_dsp_alloc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_dict_set_timestamp
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_cga_font
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_alloc_fixed_dsp
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_init
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_crypt
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_init
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_crypt
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_alloc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vlog
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vkfmt_from_pixfmt
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vk_frame_alloc
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,DLLMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_q	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_stable	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",DLLMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_q	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_stable	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_version	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_license	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_configuration	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_vga16_font	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_tempfile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_solve_lls	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_free	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_execute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_create	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_set_systematic_pal2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_scalarproduct_float_c	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_request_sample	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_report_missing_feature	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_open	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_init_lls	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_fopen_utf8	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_float_dsp_alloc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_dict_set_timestamp	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_cga_font	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_alloc_fixed_dsp	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_init	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_crypt	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_init	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_crypt	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_alloc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line2	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vlog	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vkfmt_from_pixfmt	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vk_frame_alloc	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: avutil.dll.dll

Static PE information: More than 595 > 100 exports found

Source: avutil.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: avutil.dll.dll

Static file information: File size 1752140 > 1048576

Source: avutil.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: avutil.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: avutil.dll.dll

Static PE information: real checksum: 0x38ca43 should be: 0x1b07ed

Source: avutil.dll.dll	Static PE information: section name: .xdata
Source: avutil.dll.dll	Static PE information: section name: .debug

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE8610DBD pushfq ; retf	0_2_0000026CE8610F19
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_0000021E06BC0105 push ecx; retf	3_3_0000021E06BC010E
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CC0EF2 pushfq ; retf	3_2_0000021E04CC0F19
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_0000023B61660105 push ecx; retf	4_3_0000023B6166010E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C35CA5 push 0779C365h; ret	6_2_0000020779C35CC2
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C30F18 pushfq ; retf	6_2_0000020779C30F19
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C35DF5 push rax; ret	6_2_0000020779C35E31
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C357D5 push rax; ret	6_2_0000020779C35801
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61B0F18 pushfq ; retf	8_2_0000025DE61B0F19

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE85F71E4 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0000026CE85F71E4

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,		3_2_0000021E016D4D00
Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,		4_2_0000023B614F4D00

Source: C:\Windows\System32\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-72241

Source: C:\Windows\System32\loaddll64.exe	API coverage: 7.3 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 3.1 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 5.9 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(a
Source: rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW /
Source: rundll32.exe, 00000003.00000002.4678724103.0000021E0146F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-54644
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-54864
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-71242
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_0000021E016BCCE0 LdrGetProcedureAddress,

3_2_0000021E016BCCE0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE85F9FAC IsDebuggerPresent,

0_2_0000026CE85F9FAC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE860371C EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0000026CE860371C

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE85FAFB0 GetProcessHeap,

0_2_0000026CE85FAFB0

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860F0D8 SetUnhandledExceptionFilter,	0_2_0000026CE860F0D8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE860F0A8 RtlLookupFunctionEntry,SetUnhandledExceptionFilter,	0_2_0000026CE860F0A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000026CE85F7608 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000026CE85F7608
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CA7608 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000021E04CA7608
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBF0A8 RtlLookupFunctionEntry,SetUnhandledExceptionFilter,	3_2_0000021E04CBF0A8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000021E04CBF0D8 SetUnhandledExceptionFilter,	3_2_0000021E04CBF0D8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F787608 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000023B5F787608
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000023B5F79F0D8 SetUnhandledExceptionFilter,	4_2_0000023B5F79F0D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2F0A8 RtlLookupFunctionEntry,SetUnhandledExceptionFilter,	6_2_0000020779C2F0A8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C2F0D8 SetUnhandledExceptionFilter,	6_2_0000020779C2F0D8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000020779C17608 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0000020779C17608
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE6197608 SetUnhandledExceptionFilter,UnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0000025DE6197608
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61AF0D8 SetUnhandledExceptionFilter,	8_2_0000025DE61AF0D8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000025DE61AF0A8 RtlLookupFunctionEntry,SetUnhandledExceptionFilter,	8_2_0000025DE61AF0A8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.43.224 6542			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.57.249.207 6542			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 8B70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 8F40000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_00007DF40CCA0100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		3_3_00007DF40CCA0100
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_00007DF494700100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		4_3_00007DF494700100

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread created: unknown EIP: 2E00000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: unknown EIP: 8B70000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: unknown EIP: 8F40000	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8B70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8F40000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 4004 base: 2E00000 value: 4D	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 4004 base: 8B70000 value: 4D	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 4004 base: 8F40000 value: 4D	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 2304	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 2304	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 2304	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 2304	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 2304	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4976	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 4976 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 2E00000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8B70000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8F40000	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_0000026CE85F9CDC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_0000026CE85FFD38
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	0_2_0000026CE8604E7C
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_0000026CE860708C
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,	0_2_0000026CE8607140
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_0000026CE85EE0FC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_0000026CE8607244
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_0000026CE8606218
Source: C:\Windows\System32\loaddll64.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0000026CE8606384
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	0_2_0000026CE86055E0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000026CE86075BC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000026CE8607670
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000026CE8607704
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000026CE8607934
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	0_2_0000026CE8604910
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0000026CE8607A80
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,GetLocaleInfoW,	0_2_0000026CE8607B30
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	0_2_0000026CE85F2BC4
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_0000026CE8607BD8
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_0000026CE8606C20
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_0000026CE85F9C1C
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_0000026CE85FCCD0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	0_2_0000026CE68B6AEC
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_0000026CE689D9A4
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	0_2_0000026CE68B6934
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	0_2_0000026CE68AF5E0
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	3_2_0000021E04CA9CDC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_0000021E04CB6384
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	3_2_0000021E04CB55E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	3_2_0000021E04CB75BC
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	3_2_0000021E04CB4E7C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	3_2_0000021E04CB7140
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	3_2_0000021E04C9E0FC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	3_2_0000021E04CB708C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	3_2_0000021E04CB7244
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	3_2_0000021E04CB6218
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	3_2_0000021E04CB7B30
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0000021E04CB7A80
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	3_2_0000021E04CB6C20
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_0000021E04CA9C1C
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	3_2_0000021E04CA2BC4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	3_2_0000021E04CB7BD8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	3_2_0000021E04CAFD38
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	3_2_0000021E04CACCD0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	3_2_0000021E04CB7704
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	3_2_0000021E04CB7670
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	3_2_0000021E04CB7934
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	3_2_0000021E04CB4910
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	3_2_0000021E02F66934
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	3_2_0000021E02F4D9A4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	3_2_0000021E02F5F5E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	3_2_0000021E02F66AEC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	4_2_0000023B5F789CDC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0000023B5F797A80
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000023B5F797934
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	4_2_0000023B5F794910
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000023B5F797704
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	4_2_0000023B5F7955E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000023B5F797670
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000023B5F7975BC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_0000023B5F796384
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	4_2_0000023B5F797244
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	4_2_0000023B5F796218
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	4_2_0000023B5F797140
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_0000023B5F77E0FC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	4_2_0000023B5F79708C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	4_2_0000023B5F794E7C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	4_2_0000023B5F78FD38
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_0000023B5F789C1C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	4_2_0000023B5F796C20
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	4_2_0000023B5F78CCD0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	4_2_0000023B5F797B30
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	4_2_0000023B5F797BD8
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	4_2_0000023B5F782BC4
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_0000023B5DA2D9A4
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	4_2_0000023B5DA46934
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	4_2_0000023B5DA46AEC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	4_2_0000023B5DA3F5E0
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	6_2_0000020779C19CDC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0000020779C27A80
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	6_2_0000020779C27934
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	6_2_0000020779C1CCD0
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	6_2_0000020779C19C1C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	6_2_0000020779C26C20
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	6_2_0000020779C12BC4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	6_2_0000020779C27BD8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	6_2_0000020779C27B30
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	6_2_0000020779C24E7C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	6_2_0000020779C1FD38
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	6_2_0000020779C0E0FC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	6_2_0000020779C2708C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	6_2_0000020779C27244
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	6_2_0000020779C26218
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	6_2_0000020779C27140
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_0000020779C26384
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	6_2_0000020779C27704
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	6_2_0000020779C27670
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	6_2_0000020779C275BC
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	6_2_0000020779C255E0
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	6_2_0000020779C24910
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	6_2_0000020777ECF5E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	6_2_0000020777ED6AEC
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	6_2_0000020777EBD9A4
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	6_2_0000020777ED6934
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	8_2_0000025DE6199CDC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	8_2_0000025DE619CCD0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	8_2_0000025DE619FD38
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	8_2_0000025DE61A4E7C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	8_2_0000025DE61A7B30
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	8_2_0000025DE61A7BD8
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	8_2_0000025DE6192BC4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	8_2_0000025DE6199C1C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	8_2_0000025DE61A6C20
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	8_2_0000025DE61A4910
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	8_2_0000025DE61A7934
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0000025DE61A7A80
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	8_2_0000025DE61A7704
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	8_2_0000025DE61A75BC
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	8_2_0000025DE61A55E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	8_2_0000025DE61A7670
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_0000025DE61A6384
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	8_2_0000025DE618E0FC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	8_2_0000025DE61A7140
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	8_2_0000025DE61A6218
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	8_2_0000025DE61A7244
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	8_2_0000025DE61A708C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	8_2_0000025DE4456AEC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	8_2_0000025DE4456934
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	8_2_0000025DE443D9A4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	8_2_0000025DE444F5E0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE85FE074 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000026CE85FE074

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_0000021E016D4D00 GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

3_2_0000021E016D4D00

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000026CE8602F34 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

0_2_0000026CE8602F34

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000004.00000002.4681807964.0000023B61A2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4718709422.0000026D524AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2620826714.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2620889065.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2290158761.0000021E06F25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.3250525715.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4232, type: MEMORYSTR

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000004.00000002.4681807964.0000023B61A2C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4718709422.0000026D524AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2620826714.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2620889065.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2290158761.0000021E06F25000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.3250525715.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	911 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	911 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
avutil.dll.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://vutarf.com/K3	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.phpM	0%	Avira URL Cloud	safe
https://huanvn.com/	0%	Avira URL Cloud	safe
https://huanvn.com/2	0%	Avira URL Cloud	safe
http://r11.o.lencr.oCt	0%	Avira URL Cloud	safe
https://huanvn.com/4	0%	Avira URL Cloud	safe
https://vutarf.com/kY	0%	Avira URL Cloud	safe
https://vutarf.com:6542/stop.php	0%	Avira URL Cloud	safe
https://huanvn.com:6542/gop.php	0%	Avira URL Cloud	safe
http://r10.i.lencr.o	0%	Avira URL Cloud	safe
https://huanvn.com:6542/gop.phpO	0%	Avira URL Cloud	safe
https://vutarf.com/	0%	Avira URL Cloud	safe
https://vutarf.com:6542/stop.php&	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.phpA	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.phpRc	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.phpoc	0%	Avira URL Cloud	safe
https://huanvn.com:6542/	0%	Avira URL Cloud	safe
https://huanvn.com:6542/stop.phpb	0%	Avira URL Cloud	safe
https://huanvn.com:6542/stop.phpq	0%	Avira URL Cloud	safe
https://huanvn.com:6542/stop.php	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.php	0%	Avira URL Cloud	safe
https://vutarf.com:6542/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vutarf.com	94.232.43.224	true	true		unknown
huanvn.com	103.57.249.207	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://vutarf.com/K3	rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/gop.phpM	rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://r10.i.lencr.o	rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/gop.php	rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com/kY	rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/	rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.o.lencr.org0#	rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C1A5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vutarf.com:6542/stop.php	rundll32.exe, 00000003.00000002.4678724103.0000021E0146F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.o.lencr.oCt	rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/4	rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/2	rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/gop.phpO	rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.i.lencr.org/0	rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://vutarf.com/	rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/gop.phpA	rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/stop.php&	rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/gop.phpRc	rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/	rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/stop.phpb	rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://streams.videolan.org/upload/	loaddll64.exe, 00000000.00000002.4682995000.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4682042385.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.2283430783.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.2304898278.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.2303220927.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2305957918.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2302816272.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.2290332722.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.2277869231.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.2297403449.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.2303131049.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.2303978956.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2360364252.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2289876882.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.2358440180.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000020.00000002.2361221187.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.2303968170.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.2296520709.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.2358802398.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.2278843733.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000026.00000002.2303493254.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmp	false		high
https://vutarf.com:6542/gop.phpoc	rundll32.exe, 00000009.00000003.2620708987.0000026D4CB83000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250525715.0000021E0151E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01525000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618014731.0000023B5C1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	rundll32.exe, 00000003.00000002.4678724103.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250525715.0000021E0151E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3250744554.0000021E0152A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289737477.0000021E01528000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01525000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618014731.0000023B5C1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1AF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250496128.0000023B5C1BE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://huanvn.com:6542/stop.phpq	rundll32.exe, 00000009.00000003.2620708987.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401385805.0000026D4CBB4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/stop.php	rundll32.exe, 00000009.00000002.4681505732.0000026D4CBDE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681505732.0000026D4CBD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/gop.php	rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401439218.0000026D4CB65000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4680546114.0000026D4CB66000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/	rundll32.exe, 00000003.00000002.4678724103.0000021E014CC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014C9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4678724103.0000021E01513000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2289912519.0000021E014FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/0	rundll32.exe, 00000004.00000003.2618031585.0000023B5C153000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2618031585.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3250618182.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C189000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668299780.0000023B5C1A5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C0F8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4668075279.0000023B5C155000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4679205737.0000026D4CB28000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.2620690341.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000003.3401277048.0000026D4CBF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000009.00000002.4681991702.0000026D4CBED000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.57.249.207	huanvn.com	India		17747	SITINETWORS-IN-APSITINETWORKSLIMITEDIN	true
94.232.43.224	vutarf.com	Russian Federation		44477	WELLWEBNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567647
Start date and time:	2024-12-03 17:42:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	avutil.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	avutil.dll.exe
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@119/1@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 26 Number of non-executed functions: 240
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, reateberam.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, dogirafer.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: avutil.dll.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.57.249.207	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse
103.57.249.207	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
94.232.43.224	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse
	cTgZnuQlDo.exe	Get hash	malicious	SystemBC	Browse
	cTgZnuQlDo.exe	Get hash	malicious	SystemBC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vutarf.com	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
huanvn.com	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207
huanvn.com	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SITINETWORS-IN-APSITINETWORKSLIMITEDIN	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207
	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	202.142.118.100
	na.elf	Get hash	malicious	Gafgyt	Browse	103.225.178.92
	msas.msi	Get hash	malicious	ORPCBackdoor	Browse	103.57.249.42
	msas.msi	Get hash	malicious	ORPCBackdoor	Browse	103.57.249.42
	sstn.exe	Get hash	malicious	Unknown	Browse	103.57.250.204
	sstn.exe	Get hash	malicious	Unknown	Browse	103.57.250.204
	VKkfiTAZXP.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.225.178.98
	YnO77q8WhV.elf	Get hash	malicious	Unknown	Browse	45.117.200.73
WELLWEBNL	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	94.232.43.213
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.232.45.36
	JeZHGKJvrB.exe	Get hash	malicious	Unknown	Browse	94.232.44.144
	hFoVk4DJXG.exe	Get hash	malicious	Unknown	Browse	94.232.44.144

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.207627100346911
Encrypted:	false
SSDEEP:	3:BcBqWpNIiSYJazdWoqyd50JLQWpNIiSlyQKwtC1Y:BopNIeJ4IAd6JPpNIPLwS
MD5:	42F8F39F87E786C7DB552EBC76F08C39
SHA1:	DC8A85FA36A3FB66B821D4E6C37AB7A8E79D3580
SHA-256:	4DFD6A61644CF77087A3971FC563BE604E22EECB8578FC6C8960F410C8F89F23
SHA-512:	4DD80430111C85235EA236FD74FF471CCDB88291391B6010BCA68DBDC03A506AEBD32E3399F7E112142226E81B7FC8772E62CDC1D72DEDF48D8065C8550E8C1B
Malicious:	false
Preview:	{YXZ1dGlsLmRsbC5kbGw=, IkM6XFVzZXJzXGVuZ2luZWVyXERlc2t0b3BcYXZ1dGlsLmRsbC5kbGwi, MQ==, RExMTWFpbg==}

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	7.305582889398964
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	avutil.dll.dll
File size:	1'752'140 bytes
MD5:	2334a6aede2ad2a9004ecd96c872a910
SHA1:	45f7683952a599a607ba6b9b02dacc1586135f22
SHA256:	c3baf0446831b6968a30ea23647ac559ee62219f91daae5c1b0a9787f9c860b9
SHA512:	ea6d669f474ea9281b00cf61a436ff59627f0ef19c9c0df93c641db0476ca9feb0763a747e56b5c79b65287cb60628fb60c9e72bd2003bd0b5c270ea11c4ff51
SSDEEP:	24576:zbE5t+4+x4D5Z+KFNTsnkN6MFBUp6xdRWxgnsOmYX82Or0t:zbEfH+xIDhNTYCBUURWxgd72e
TLSH:	7A85BF02D6E368ADC4BA4430476B7957B2323412C9A46E3F17A15D783E29FA05CCFA7D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...A..f..........& ...)....L.......0........................................P......C.8...`... ............................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180001330
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66EC9041 [Thu Sep 19 20:57:37 2024 UTC]
TLS Callbacks:	0x800af3a0, 0x1, 0x800af370, 0x1, 0x800bff10, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1231c96382e36b1e775f3ad59513b5a0

Entrypoint Preview

Instruction
dec eax
cmp edx, 01h
je 00007F5094F9E44Ah
dec eax
mov eax, 00000001h
ret
dec sp
movd mm5, ecx
dec eax
mov eax, ecx
dec eax
sub esp, 00000098h
dec eax
mov edx, 003D092Ch
dec esp
lea eax, dword ptr [esp+20h]
dec eax
xor ecx, ecx
dec eax
xor edx, edx
inc ecx
mov byte ptr [eax+ecx], cl
dec eax
inc ecx
dec eax
cmp ecx, 72h
jbe 00007F5094F9E435h
dec eax
xor ecx, ecx
dec eax
inc edx
dec eax
cmp edx, 003D092Bh
jbe 00007F5094F9E426h
dec eax
add eax, 011147F8h
dec eax
mov ecx, FFFFFFFFh
dec eax
xor edx, edx
dec ecx
mov eax, 01D45028h
dec ecx
mov ecx, 00003000h
dec eax
mov dword ptr [esp+20h], 00000040h
dec eax
mov dword ptr [esp+28h], 00000000h
call dword ptr [eax]
cld
dec sp
movd esi, mm5
dec eax
add esi, 011183BCh
dec eax
mov ecx, 000A8CA8h
dec eax
mov edi, eax
rep movsb
dec eax
mov edi, eax
dec ecx
mov eax, 00000017h
dec eax
xor eax, eax
dec eax
xor ecx, ecx
dec bp
movd ecx, mm5
dec ecx
add ecx, 000F37C2h
dec eax
xor edx, edx
dec ecx
div eax
inc ebp
mov dl, byte ptr [ecx+edx]
inc esp
xor byte ptr [edi+ecx], dl
dec eax
inc ecx
dec eax
mov eax, ecx
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x110f000	0x45f2	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1114000	0x19b4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1118000	0xa9064	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x40b0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11c2000	0x1214	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x111b030	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xef520	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1114610	0x5a8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xcaf28	0xcb000	8632d7dfe9db21d2664c8f8f51a7106e	False	0.39980492803263545	data	6.640813162143309	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xcc000	0x1d0	0x200	7920b7164b7062e50e940076159e8f54	False	0.291015625	Matlab v4 mat-file (little endian) \377\377\377\377, text, rows 0, columns 0	2.2249897541236128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xcd000	0x267d0	0x26800	5ca933a0b0977956f7138fe4f796ae0f	False	0.3154804180194805	data	4.61180516962909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xf4000	0x40b0	0x4200	e867ae8eb8baa5acdb8dfbab1148a051	False	0.5062144886363636	data	5.769162171746146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0xf9000	0x4f10	0x5000	841d3b3d93f1d53c89bb7a2effae919a	False	0.185205078125	data	4.797717862971696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xfe000	0x1010690	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x110f000	0x45f2	0x4600	62db52503afee76aae195dc3c07e401f	False	0.4040736607142857	data	5.51537379283415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x1114000	0x19b4	0x1a00	a82d8c46a2eb7840c80c49e7057ed3e4	False	0.310546875	data	4.855407659649912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x1116000	0x60	0x200	70c1b2591433bb45bbcfd44224870185	False	0.068359375	data	0.3232550539007212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1117000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1118000	0xa9064	0xa9200	ec39622b3dedf373d4ae26f532ce02c4	False	0.8292062199741316	data	7.841884260057169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11c2000	0x1214	0x1400	8453f1d204f5b6db7a34816a0f220a20	False	0.4322265625	data	5.159121394192686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.debug	0x11c4000	0x200	0x4c	8a8b483344a5b06272954fecf64e6102	False	0.8421052631578947	data	4.450480963211839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x11180a0	0x31c	data	English	United States	0.47110552763819097
RT_VXD	0x11183bc	0xa8ca8	data			0.8301671468740237

Imports

DLL	Import
bcrypt.dll	BCryptCloseAlgorithmProvider, BCryptGenRandom, BCryptOpenAlgorithmProvider
KERNEL32.dll	AcquireSRWLockExclusive, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileMappingA, CreateMutexA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FileTimeToSystemTime, FreeLibrary, GetConsoleMode, GetConsoleScreenBufferInfo, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetFullPathNameW, GetHandleInformation, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetProcessTimes, GetStdHandle, GetSystemDirectoryW, GetSystemTimeAdjustment, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetThreadTimes, GetTickCount64, GetTimeZoneInformation, InitOnceBeginInitialize, InitOnceComplete, InitializeConditionVariable, InitializeCriticalSection, InitializeSRWLock, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, LoadLibraryExA, LoadLibraryExW, MapViewOfFile, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseMutex, ReleaseSRWLockExclusive, ReleaseSemaphore, VirtualAllocExNuma, ResetEvent, ResumeThread, SetConsoleTextAttribute, SetEvent, SetLastError, SetProcessAffinityMask, SetSystemTime, SetThreadContext, SetThreadPriority, Sleep, SleepConditionVariableSRW, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WaitForSingleObjectEx, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteConsoleW, __C_specific_handler
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __iob_func, __setusermatherr, _aligned_free, _aligned_malloc, _aligned_realloc, _amsg_exit, _beginthreadex, _endthreadex, _errno, _fstat64, _get_osfhandle, _gmtime64, _hypot, _initterm, _localtime64, _lock, _mktime64, _setjmp, _sopen, _ultoa, _unlock, _wsopen, abort, acos, asin, atan, atoi, bsearch, calloc, clock, cosh, exit, fclose, fprintf, fputc, fputs, fread, free, fwrite, getc, getenv, isspace, tanh, isxdigit, localeconv, log10, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, rand, realloc, setvbuf, signal, sinh, strchr, strcmp, strcpy, strcspn, strerror, strftime, strlen, strncmp, strrchr, strspn, strstr, strtol, strtoul, tan, tolower, ungetc, vfprintf, wcscat, wcscpy, wcslen, wcsrchr, _strtoui64, _strtoi64, _strdup, _isatty, _fdopen, _close
USER32.dll	GetDesktopWindow

Exports

Name	Ordinal	Address
DLLMain	1	0x1800236c0
av_add_q	2	0x1800343b0
av_add_stable	3	0x180027660
av_adler32_update	4	0x180001380
av_aes_alloc	5	0x180001be0
av_aes_crypt	6	0x180001bf0
av_aes_ctr_alloc	7	0x180002370
av_aes_ctr_crypt	8	0x1800024a0
av_aes_ctr_free	9	0x180002440
av_aes_ctr_get_iv	10	0x1800023c0
av_aes_ctr_increment_iv	11	0x180002450
av_aes_ctr_init	12	0x180002410
av_aes_ctr_set_full_iv	13	0x1800023a0
av_aes_ctr_set_iv	14	0x180002380
av_aes_ctr_set_random_iv	15	0x1800023d0
av_aes_init	16	0x180001c10
av_aes_size	17	0x1800cd00c
av_ambient_viewing_environment_alloc	18	0x1800025c0
av_ambient_viewing_environment_create_side_data	19	0x180002600
av_append_path_component	20	0x180006420
av_asprintf	21	0x180005e90
av_assert0_fpu	22	0x180084960
av_audio_fifo_alloc	23	0x1800026b0
av_audio_fifo_drain	24	0x180002af0
av_audio_fifo_free	25	0x180002650
av_audio_fifo_peek	26	0x180002920
av_audio_fifo_peek_at	27	0x1800029b0
av_audio_fifo_read	28	0x180002a50
av_audio_fifo_realloc	29	0x1800027e0
av_audio_fifo_reset	30	0x180002b60
av_audio_fifo_size	31	0x180002ba0
av_audio_fifo_space	32	0x180002bb0
av_audio_fifo_write	33	0x180002880
av_base64_decode	34	0x180006ab0
av_base64_encode	35	0x180006cd0
av_basename	36	0x180006340
av_bessel_i0	37	0x1800277a0
av_blowfish_alloc	38	0x180007220
av_blowfish_crypt	39	0x1800079a0
av_blowfish_crypt_ecb	40	0x180007230
av_blowfish_init	41	0x1800c4c30
av_bmg_get	42	0x1800250d0
av_bprint_append_data	43	0x180008250
av_bprint_chars	44	0x180008110
av_bprint_clear	45	0x180008760
av_bprint_escape	46	0x180008820
av_bprint_finalize	47	0x180008780
av_bprint_get_buffer	48	0x180008650
av_bprint_init	49	0x180007d40
av_bprint_init_for_buffer	50	0x180007e00
av_bprint_strftime	51	0x180008390
av_bprintf	52	0x180007e40
av_buffer_alloc	53	0x180008d80
av_buffer_allocz	54	0x180008eb0
av_buffer_create	55	0x180008e20
av_buffer_default_free	56	0x180008cc0
av_buffer_get_opaque	57	0x180008f90
av_buffer_get_ref_count	58	0x180008fa0
av_buffer_is_writable	59	0x180008f70
av_buffer_make_writable	60	0x180008fb0
av_buffer_pool_buffer_get_opaque	61	0x180009710
av_buffer_pool_get	62	0x180009540
av_buffer_pool_init	63	0x180009410
av_buffer_pool_init2	64	0x1800093a0
av_buffer_pool_uninit	65	0x180009460
av_buffer_realloc	66	0x180009060
av_buffer_ref	67	0x180008ee0
av_buffer_replace	68	0x1800092a0
av_buffer_unref	69	0x180008f20
av_calloc	70	0x180028a40
av_camellia_alloc	71	0x180009af0
av_camellia_crypt	72	0x180009b00
av_camellia_init	73	0x1800c4d8d
av_camellia_size	74	0x1800ce678
av_cast5_alloc	75	0x18000a690
av_cast5_crypt	76	0x18000a7c0
av_cast5_crypt2	77	0x18000a6a0
av_cast5_init	78	0x1800c590c
av_cast5_size	79	0x1800d0a80
av_channel_description	80	0x18000aae0
av_channel_description_bprint	81	0x18000aa30
av_channel_from_string	82	0x18000ac20
av_channel_layout_ambisonic_order	83	0x18000af60
av_channel_layout_channel_from_index	84	0x18000b920
av_channel_layout_channel_from_string	85	0x18000bdb0
av_channel_layout_check	86	0x18000bde0
av_channel_layout_compare	87	0x18000bfb0
av_channel_layout_copy	88	0x18000aed0
av_channel_layout_custom_init	89	0x18000ad30
av_channel_layout_default	90	0x18000c1a0
av_channel_layout_describe	91	0x18000b8c0
av_channel_layout_describe_bprint	92	0x18000b0a0
av_channel_layout_from_mask	93	0x18000adc0
av_channel_layout_from_string	94	0x18000c7b0
av_channel_layout_index_from_channel	95	0x18000ba50
av_channel_layout_index_from_string	96	0x18000bc50
av_channel_layout_retype	97	0x18000c2b0
av_channel_layout_standard	98	0x18000c200
av_channel_layout_subset	99	0x18000c230
av_channel_layout_uninit	100	0x18000ae90
av_channel_name	101	0x18000a8f0
av_channel_name_bprint	102	0x18000a840
av_chroma_location_enum_to_pos	103	0x180033cc0
av_chroma_location_from_name	104	0x180033c60
av_chroma_location_name	105	0x180033c40
av_chroma_location_pos_to_enum	106	0x180033d00
av_cmp_i	107	0x180023de0
av_color_primaries_from_name	108	0x180033ae0
av_color_primaries_name	109	0x180033ac0
av_color_range_from_name	110	0x180033a60
av_color_range_name	111	0x180033a40
av_color_space_from_name	112	0x180033be0
av_color_space_name	113	0x180033bc0
av_color_transfer_from_name	114	0x180033b60
av_color_transfer_name	115	0x180033b40
av_compare_mod	116	0x180027450
av_compare_ts	117	0x180027390
av_content_light_metadata_alloc	118	0x180027030
av_content_light_metadata_create_side_data	119	0x180027060
av_cpu_count	120	0x18000cfb0
av_cpu_force_count	121	0x18000d0c0
av_cpu_max_align	122	0x18000d0d0
av_crc	123	0x18000d880
av_crc_get_table	124	0x18000d4d0
av_crc_init	125	0x18000d2d0
av_csp_approximate_trc_gamma	126	0x18000e030
av_csp_luma_coeffs_from_avcsp	127	0x18000ddd0
av_csp_primaries_desc_from_id	128	0x18000de00
av_csp_primaries_id_from_desc	129	0x18000de30
av_csp_trc_func_from_id	130	0x18000e060
av_d2q	131	0x180034470
av_default_get_category	132	0x180026290
av_default_item_name	133	0x180025630
av_des_alloc	134	0x18000e790
av_des_crypt	135	0x18000e820
av_des_init	136	0x18000e7a0
av_des_mac	137	0x18000e850
av_detection_bbox_alloc	138	0x18000e890
av_detection_bbox_create_side_data	139	0x18000e8f0
av_dict_copy	140	0x18000f740
av_dict_count	141	0x18000e9e0
av_dict_free	142	0x18000f6e0
av_dict_get	143	0x18000ea30
av_dict_get_string	144	0x18000fac0
av_dict_iterate	145	0x18000e9f0
av_dict_parse_string	146	0x18000f0d0
av_dict_set	147	0x18000eb40
av_dict_set_int	148	0x18000ee10
av_dirname	149	0x1800063b0
av_display_matrix_flip	150	0x18000fed0
av_display_rotation_get	151	0x18000fd30
av_display_rotation_set	152	0x18000fe30
av_div_i	153	0x180025010
av_div_q	154	0x180034360
av_dovi_alloc	155	0x18000ff60
av_dovi_find_level	156	0x18000fff0
av_dovi_metadata_alloc	157	0x18000ff90
av_downmix_info_update_side_data	158	0x180010030
av_dynamic_hdr_plus_alloc	159	0x18001a590
av_dynamic_hdr_plus_create_side_data	160	0x18001a5c0
av_dynamic_hdr_plus_from_t35	161	0x18001a600
av_dynamic_hdr_plus_to_t35	162	0x18001b5f0
av_dynamic_hdr_vivid_alloc	163	0x18001ce50
av_dynamic_hdr_vivid_create_side_data	164	0x18001ce80
av_dynarray2_add	165	0x180028db0
av_dynarray_add	166	0x180028cf0
av_dynarray_add_nofree	167	0x180028c40
av_encryption_info_add_side_data	168	0x1800104a0
av_encryption_info_alloc	169	0x180010240
av_encryption_info_clone	170	0x1800102f0
av_encryption_info_free	171	0x180010370
av_encryption_info_get_side_data	172	0x1800103b0
av_encryption_init_info_add_side_data	173	0x180010b20
av_encryption_init_info_alloc	174	0x1800105b0
av_encryption_init_info_free	175	0x180010770
av_encryption_init_info_get_side_data	176	0x180010900
av_escape	177	0x180006590
av_executor_alloc	178	0x1800154a0
av_executor_execute	179	0x1800157b0
av_executor_free	180	0x1800156c0
av_expr_count_func	181	0x180014d50
av_expr_count_vars	182	0x180014cc0
av_expr_eval	183	0x180014e00
av_expr_free	184	0x1800125b0
av_expr_parse	185	0x1800146b0
av_expr_parse_and_eval	186	0x180014e60
av_fast_malloc	187	0x180029240
av_fast_mallocz	188	0x180029310
av_fast_realloc	189	0x180029190
av_fifo_alloc2	190	0x180015a10
av_fifo_auto_grow_limit	191	0x180015ab0
av_fifo_can_read	192	0x180015ad0
av_fifo_can_write	193	0x180015b00
av_fifo_drain2	194	0x180016290
av_fifo_elem_size	195	0x180015ac0
av_fifo_freep2	196	0x180016320
av_fifo_grow2	197	0x180015b30
av_fifo_peek	198	0x180016180
av_fifo_peek_to_cb	199	0x180016260
av_fifo_read	200	0x180015f80
av_fifo_read_to_cb	201	0x1800160f0
av_fifo_reset2	202	0x180016300
av_fifo_write	203	0x180015c30
av_fifo_write_from_cb	204	0x180015d80
av_file_map	205	0x180016350
av_file_unmap	206	0x180016540
av_film_grain_params_alloc	207	0x180016a40
av_film_grain_params_create_side_data	208	0x180016a70
av_film_grain_params_select	209	0x180016ad0
av_find_best_pix_fmt_of_2	210	0x1800337b0
av_find_info_tag	211	0x1800315c0
av_find_nearest_q_idx	212	0x1800346f0
av_force_cpu_flags	213	0x18000cf10
av_fourcc_make_string	214	0x180084870
av_frame_alloc	215	0x180017c70
av_frame_apply_cropping	216	0x180019bd0
av_frame_clone	217	0x180019840
av_frame_copy	218	0x180019050
av_frame_copy_props	219	0x180018390
av_frame_free	220	0x180017d30
av_frame_get_buffer	221	0x180017d70
av_frame_get_plane_buffer	222	0x1800183a0
av_frame_get_side_data	223	0x180019010
av_frame_is_writable	224	0x1800182e0
av_frame_make_writable	225	0x180019950
av_frame_move_ref	226	0x180018210
av_frame_new_side_data	227	0x180018640
av_frame_new_side_data_from_buf	228	0x180018590
av_frame_ref	229	0x1800192a0
av_frame_remove_side_data	230	0x180019ac0
av_frame_replace	231	0x1800194c0
av_frame_side_data_add	232	0x180018950
av_frame_side_data_clone	233	0x180018b90
av_frame_side_data_desc	234	0x180019b80
av_frame_side_data_free	235	0x180017c00
av_frame_side_data_get_c	236	0x180018f20
av_frame_side_data_name	237	0x180019bb0
av_frame_side_data_new	238	0x180018710
av_frame_side_data_remove	239	0x180018f50
av_frame_unref	240	0x1800181f0
av_free	241	0x180028990
av_freep	242	0x1800289a0
av_gcd	243	0x180027090
av_gcd_q	244	0x1800349b0
av_get_alt_sample_fmt	245	0x180039970
av_get_bits_per_pixel	246	0x180033320
av_get_bytes_per_sample	247	0x180039aa0
av_get_cpu_flags	248	0x18000cf50
av_get_known_color_name	249	0x1800309a0
av_get_media_type_string	250	0x1800846c0
av_get_packed_sample_fmt	251	0x1800399a0
av_get_padded_bits_per_pixel	252	0x180033370
av_get_picture_type_char	253	0x180084730
av_get_pix_fmt	254	0x180033200
av_get_pix_fmt_loss	255	0x180033780
av_get_pix_fmt_name	256	0x1800331d0
av_get_pix_fmt_string	257	0x180033420
av_get_planar_sample_fmt	258	0x1800399e0
av_get_random_seed	259	0x180033e60
av_get_sample_fmt	260	0x180039800
av_get_sample_fmt_name	261	0x1800397d0
av_get_sample_fmt_string	262	0x180039a10
av_get_time_base_q	263	0x180084950
av_get_token	264	0x180005f30
av_gettime	265	0x180043800
av_gettime_relative	266	0x180043830
av_gettime_relative_is_monotonic	267	0x180043870
av_hash_alloc	268	0x180019f30
av_hash_final	269	0x18001a1e0
av_hash_final_b64	270	0x18001a410
av_hash_final_bin	271	0x18001a270
av_hash_final_hex	272	0x18001a390
av_hash_freep	273	0x18001a560
av_hash_get_name	274	0x180019ef0
av_hash_get_size	275	0x180019f10
av_hash_init	276	0x18001a020
av_hash_names	277	0x180019ec0
av_hash_update	278	0x18001a130
av_hmac_alloc	279	0x18001cee0
av_hmac_calc	280	0x18001d240
av_hmac_final	281	0x18001d180
av_hmac_free	282	0x18001d070
av_hmac_init	283	0x18001d0a0
av_hmac_update	284	0x18001d170
av_hwdevice_ctx_alloc	285	0x18001d4a0
av_hwdevice_ctx_create	286	0x18001d9d0
av_hwdevice_ctx_create_derived	287	0x18001dbf0
av_hwdevice_ctx_create_derived_opts	288	0x18001da80
av_hwdevice_ctx_init	289	0x18001d580
av_hwdevice_find_type_by_name	290	0x18001d3c0
av_hwdevice_get_hwframe_constraints	291	0x18001d900
av_hwdevice_get_type_name	292	0x18001d420
av_hwdevice_hwconfig_alloc	293	0x18001d8d0
av_hwdevice_iterate_types	294	0x18001d440
av_hwframe_constraints_free	295	0x18001d9a0
av_hwframe_ctx_alloc	296	0x18001d5a0
av_hwframe_ctx_create_derived	297	0x18001e1f0
av_hwframe_ctx_init	298	0x18001e050
av_hwframe_get_buffer	299	0x18001df00
av_hwframe_map	300	0x18001dd00
av_hwframe_transfer_data	301	0x18001d6c0
av_hwframe_transfer_get_formats	302	0x18001d6a0
av_i2int	303	0x1800250a0
av_iamf_audio_element_add_layer	304	0x180020db0
av_iamf_audio_element_alloc	305	0x180020d70
av_iamf_audio_element_free	306	0x180020e30
av_iamf_audio_element_get_class	307	0x180020d60
av_iamf_mix_presentation_add_submix	308	0x180021010
av_iamf_mix_presentation_alloc	309	0x180020fd0
av_iamf_mix_presentation_free	310	0x180021090
av_iamf_mix_presentation_get_class	311	0x180020fc0
av_iamf_param_definition_alloc	312	0x180020bb0
av_iamf_param_definition_get_class	313	0x180020ba0
av_iamf_submix_add_element	314	0x180020ec0
av_iamf_submix_add_layout	315	0x180020f40
av_image_alloc	316	0x180021ac0
av_image_check_sar	317	0x180021ec0
av_image_check_size	318	0x180021e20
av_image_check_size2	319	0x180021d30
av_image_copy	320	0x180022110
av_image_copy_plane	321	0x180022040
av_image_copy_plane_uc_from	322	0x180021f40
av_image_copy_to_buffer	323	0x180022af0
av_image_copy_uc_from	324	0x180022480
av_image_fill_arrays	325	0x1800227f0
av_image_fill_black	326	0x180023200
av_image_fill_color	327	0x180022d90
av_image_fill_linesizes	328	0x1800213c0
av_image_fill_max_pixsteps	329	0x1800211a0
av_image_fill_plane_sizes	330	0x180021720
av_image_fill_pointers	331	0x180021840
av_image_get_buffer_size	332	0x180022950
av_image_get_linesize	333	0x180021290
av_int2i	334	0x180025060
av_int_list_length_for_size	335	0x180084750
av_lfg_init	336	0x1800c5e00
av_lfg_init_from_data	337	0x1800251d0
av_log	338	0x180026610
av_log2	339	0x1800250b0
av_log2_16bit	340	0x1800250c0
av_log2_i	341	0x180023930
av_log_default_callback	342	0x180025b40
av_log_format_line	343	0x180026600
av_log_format_line2	344	0x1800262a0
av_log_get_flags	345	0x180026760
av_log_get_level	346	0x180026730
av_log_once	347	0x180026670
av_log_set_callback	348	0x180026770
av_log_set_flags	349	0x180026750
av_log_set_level	350	0x180026740
av_lzo1x_decode	351	0x1800268c0
av_malloc	352	0x180028730
av_malloc_array	353	0x180028880
av_mallocz	354	0x1800289c0
av_mastering_display_metadata_alloc	355	0x180026ef0
av_mastering_display_metadata_alloc_size	356	0x180026f40
av_mastering_display_metadata_create_side_data	357	0x180026fa0
av_match_list	358	0x1800069c0
av_match_name	359	0x180006630
av_max_alloc	360	0x180028720
av_md5_alloc	361	0x1800281d0
av_md5_final	362	0x1800283f0
av_md5_init	363	0x1800281e0
av_md5_size	364	0x1800d8b04
av_md5_sum	365	0x1800284f0
av_md5_update	366	0x180028210
av_memcpy_backptr	367	0x180028e80
av_memdup	368	0x180028bc0
av_mod_i	369	0x180024310
av_mul_i	370	0x1800239f0
av_mul_q	371	0x180034310
av_murmur3_alloc	372	0x180029410
av_murmur3_final	373	0x180029930
av_murmur3_init	374	0x180029440
av_murmur3_init_seeded	375	0x180029420
av_murmur3_update	376	0x180029460
av_nearer_q	377	0x1800345f0
av_opt_child_class_iterate	378	0x18002f140
av_opt_child_next	379	0x18002f120
av_opt_copy	380	0x18002f1e0
av_opt_eval_double	381	0x18002ef30
av_opt_eval_flags	382	0x18002edf0
av_opt_eval_float	383	0x18002eef0
av_opt_eval_int	384	0x18002ee30
av_opt_eval_int64	385	0x18002eeb0
av_opt_eval_q	386	0x18002ef70
av_opt_eval_uint	387	0x18002ee70
av_opt_find	388	0x18002d9c0
av_opt_find2	389	0x18002d7a0
av_opt_flag_is_set	390	0x18002efb0
av_opt_free	391	0x18002d490
av_opt_freep_ranges	392	0x18002f840
av_opt_get	393	0x18002c6b0
av_opt_get_chlayout	394	0x18002ce00
av_opt_get_dict_val	395	0x18002ce80
av_opt_get_double	396	0x18002c930
av_opt_get_image_size	397	0x18002cb60
av_opt_get_int	398	0x18002c810
av_opt_get_key_value	399	0x18002d100
av_opt_get_pixel_fmt	400	0x18002cd20
av_opt_get_q	401	0x18002ca30
av_opt_get_sample_fmt	402	0x18002cd90
av_opt_get_video_rate	403	0x18002cbf0
av_opt_is_set_to_default	404	0x18002f8e0
av_opt_is_set_to_default_by_name	405	0x1800301b0
av_opt_next	406	0x18002b740
av_opt_ptr	407	0x18002f160
av_opt_query_ranges	408	0x18002f7f0
av_opt_query_ranges_default	409	0x18002aa70
av_opt_serialize	410	0x1800301f0
av_opt_set	411	0x18002b790
av_opt_set_bin	412	0x18002bf70
av_opt_set_chlayout	413	0x18002c660
av_opt_set_defaults	414	0x18002ede0
av_opt_set_defaults2	415	0x18002ea70
av_opt_set_dict	416	0x18002d790
av_opt_set_dict2	417	0x18002d5e0
av_opt_set_dict_val	418	0x18002c600
av_opt_set_double	419	0x18002ba10
av_opt_set_from_string	420	0x18002d240
av_opt_set_image_size	421	0x18002c070
av_opt_set_int	422	0x18002b850
av_opt_set_pixel_fmt	423	0x18002c400
av_opt_set_q	424	0x18002bc80
av_opt_set_sample_fmt	425	0x18002c500
av_opt_set_video_rate	426	0x18002c110
av_opt_show2	427	0x18002ced0
av_parse_color	428	0x1800306d0
av_parse_cpu_caps	429	0x18000cf80
av_parse_ratio	430	0x180030340
av_parse_time	431	0x180030e80
av_parse_video_rate	432	0x1800304f0
av_parse_video_size	433	0x180030420
av_pix_fmt_count_planes	434	0x1800335d0
av_pix_fmt_desc_get	435	0x1800334f0
av_pix_fmt_desc_get_id	436	0x180033560
av_pix_fmt_desc_next	437	0x180033520
av_pix_fmt_get_chroma_sub_sample	438	0x180033590
av_pix_fmt_swap_endianness	439	0x180033680
av_pixelutils_get_sad_fn	440	0x180033d80
av_q2intfloat	441	0x180034860
av_random_bytes	442	0x180033da0
av_rc4_alloc	443	0x180034a20
av_rc4_crypt	444	0x180034b10
av_rc4_init	445	0x180034a30
av_read_image_line	446	0x180032760
av_read_image_line2	447	0x1800321c0
av_realloc	448	0x180028780
av_realloc_array	449	0x1800288d0
av_realloc_f	450	0x1800287b0
av_reallocp	451	0x180028810
av_reallocp_array	452	0x180028910
av_reduce	453	0x1800340c0
av_rescale	454	0x180027320
av_rescale_delta	455	0x180027480
av_rescale_q	456	0x180027360
av_rescale_q_rnd	457	0x180027330
av_rescale_rnd	458	0x180027110
av_ripemd_alloc	459	0x1800392e0
av_ripemd_final	460	0x1800394d0
av_ripemd_init	461	0x1800c5ee0
av_ripemd_size	462	0x1800e2604
av_ripemd_update	463	0x1800392f0
av_sample_fmt_is_planar	464	0x180039ac0
av_samples_alloc	465	0x180039cb0
av_samples_alloc_array_and_samples	466	0x180039e10
av_samples_copy	467	0x180039fd0
av_samples_fill_arrays	468	0x180039be0
av_samples_get_buffer_size	469	0x180039ae0
av_samples_set_silence	470	0x18003a140
av_set_options_string	471	0x18002cf40
av_sha512_alloc	472	0x1800420a0
av_sha512_final	473	0x180042250
av_sha512_init	474	0x1800c60f0
av_sha512_size	475	0x1800e2754
av_sha512_update	476	0x1800420b0
av_sha_alloc	477	0x18003df20
av_sha_final	478	0x18003e110
av_sha_init	479	0x1800c6010
av_sha_size	480	0x1800e2744
av_sha_update	481	0x18003df30
av_shr_i	482	0x180023e90
av_size_mult	483	0x1800293f0
av_small_strptime	484	0x1800309e0
av_spherical_alloc	485	0x180042d70
av_spherical_from_name	486	0x180042e70
av_spherical_projection_name	487	0x180042e50
av_spherical_tile_bounds	488	0x180042da0
av_sscanf	489	0x180002f50
av_stereo3d_alloc	490	0x180042ed0
av_stereo3d_alloc_size	491	0x180042f00
av_stereo3d_create_side_data	492	0x180042f40
av_stereo3d_from_name	493	0x180042fb0
av_stereo3d_primary_eye_from_name	494	0x1800430b0
av_stereo3d_primary_eye_name	495	0x180043090
av_stereo3d_type_name	496	0x180042f90
av_stereo3d_view_from_name	497	0x180043030
av_stereo3d_view_name	498	0x180043010
av_strcasecmp	499	0x180006120
av_strdup	500	0x180028ac0
av_strerror	501	0x180010cf0
av_strireplace	502	0x1800061f0
av_stristart	503	0x180005ba0
av_stristr	504	0x180005c20
av_strlcat	505	0x180005d80
av_strlcatf	506	0x180005e30
av_strlcpy	507	0x180005d10
av_strncasecmp	508	0x180006180
av_strndup	509	0x180028b30
av_strnstr	510	0x180005ca0
av_strstart	511	0x180005b50
av_strtod	512	0x180012490
av_strtok	513	0x180006080
av_sub_i	514	0x180023800
av_sub_q	515	0x180034410
av_tea_alloc	516	0x1800431b0
av_tea_crypt	517	0x1800431f0
av_tea_init	518	0x1800431c0
av_tea_size	519	0x1800e29e0
av_thread_message_flush	520	0x1800437a0
av_thread_message_queue_alloc	521	0x180043420
av_thread_message_queue_free	522	0x1800434d0
av_thread_message_queue_nb_elems	523	0x180043550
av_thread_message_queue_recv	524	0x180043650
av_thread_message_queue_send	525	0x180043590
av_thread_message_queue_set_err_recv	526	0x180043760
av_thread_message_queue_set_err_send	527	0x180043720
av_thread_message_queue_set_free_func	528	0x1800434c0
av_timecode_adjust_ntsc_framenum2	529	0x180043940
av_timecode_check_frame_rate	530	0x180044140
av_timecode_get_smpte	531	0x1800439c0
av_timecode_get_smpte_from_framenum	532	0x180043b80
av_timecode_init	533	0x1800441b0
av_timecode_init_from_components	534	0x1800442b0
av_timecode_init_from_string	535	0x1800444c0
av_timecode_make_mpeg_tc_string	536	0x1800440d0
av_timecode_make_smpte_tc_string	537	0x180043ff0
av_timecode_make_smpte_tc_string2	538	0x180043e90
av_timecode_make_string	539	0x180043ca0
av_timegm	540	0x180030dc0
av_tree_destroy	541	0x180045170
av_tree_enumerate	542	0x180045330
av_tree_find	543	0x180044970
av_tree_insert	544	0x180044a20
av_tree_node_alloc	545	0x180044960
av_tree_node_size	546	0x1800e2b60
av_ts_make_time_string2	547	0x180044770
av_twofish_alloc	548	0x180045900
av_twofish_crypt	549	0x180045910
av_twofish_init	550	0x1800c64b9
av_twofish_size	551	0x1800e2b80
av_tx_init	552	0x1800c7722
av_tx_uninit	553	0x1800c6e70
av_usleep	554	0x180043880
av_utf8_decode	555	0x1800067a0
av_util_ffversion	556	0x1800ebf00
av_uuid_parse	557	0x1800849b0
av_uuid_parse_range	558	0x180084ad0
av_uuid_unparse	559	0x180084be0
av_uuid_urn_parse	560	0x180084e60
av_vbprintf	561	0x180007fb0
av_version_info	562	0x180084ec0
av_video_enc_params_alloc	563	0x180084f00
av_video_enc_params_create_side_data	564	0x180084f60
av_video_hint_alloc	565	0x180085010
av_video_hint_create_side_data	566	0x180085070
av_vk_frame_alloc	567	0x180020a50
av_vkfmt_from_pixfmt	568	0x180020a40
av_vlog	569	0x1800266e0
av_write_image_line	570	0x180032f50
av_write_image_line2	571	0x180032bb0
av_xtea_alloc	572	0x1800aee70
av_xtea_crypt	573	0x1800aeec0
av_xtea_init	574	0x1800aee80
av_xtea_le_crypt	575	0x1800af010
av_xtea_le_init	576	0x1800aeea0
avpriv_alloc_fixed_dsp	577	0x180017160
avpriv_cga_font	578	0x1800eed00
avpriv_dict_set_timestamp	579	0x18000fc60
avpriv_float_dsp_alloc	580	0x1800c59d0
avpriv_fopen_utf8	581	0x180016990
avpriv_init_lls	582	0x1800c5e80
avpriv_open	583	0x180016580
avpriv_report_missing_feature	584	0x180026830
avpriv_request_sample	585	0x180026780
avpriv_scalarproduct_float_c	586	0x180017460
avpriv_set_systematic_pal2	587	0x180021930
avpriv_slicethread_create	588	0x180042ac0
avpriv_slicethread_execute	589	0x180042810
avpriv_slicethread_free	590	0x1800429c0
avpriv_solve_lls	591	0x180025300
avpriv_tempfile	592	0x1800168b0
avpriv_vga16_font	593	0x1800edd00
avutil_configuration	594	0x180084ee0
avutil_license	595	0x180084ef0
avutil_version	596	0x180084ed0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T17:43:27.566091+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49744	20.42.65.92	443	TCP
2024-12-03T17:43:27.567553+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49746	20.42.65.92	443	TCP
2024-12-03T17:43:27.623125+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49743	20.42.65.92	443	TCP
2024-12-03T17:43:27.624411+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49745	20.42.65.92	443	TCP
2024-12-03T17:46:46.269900+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50006	188.114.96.6	443	TCP
2024-12-03T17:46:46.275407+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.6	50006	188.114.96.6	443	TCP
2024-12-03T17:47:23.184566+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50007	20.42.73.29	443	TCP
2024-12-03T17:47:28.167489+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50008	20.42.73.29	443	TCP
2024-12-03T17:47:28.974293+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50009	20.42.73.29	443	TCP
2024-12-03T17:47:31.131851+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50010	20.42.73.29	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 17:43:07.828974962 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:07.949058056 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:07.949176073 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:07.962862015 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:08.181905031 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:08.382472038 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:08.502919912 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:08.503032923 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:08.511116028 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:08.631164074 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:09.789417982 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:09.789530993 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:09.789541006 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:09.789591074 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:09.789637089 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:09.829509020 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:09.949502945 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:10.229257107 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:10.229327917 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:10.238976955 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:10.358994007 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:14.214961052 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:14.215331078 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:15.000325918 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:15.121179104 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:15.121275902 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:15.859059095 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:15.978979111 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:16.416569948 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:16.416692019 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:16.756037951 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:16.757308006 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:16.876198053 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:16.877232075 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:17.179231882 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:17.179291964 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:17.179527044 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:17.179538965 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:17.179569960 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:17.284975052 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:17.405365944 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:17.819380999 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:17.819478035 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:17.930037975 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:18.050045967 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:20.712316990 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.712373018 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.712647915 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.712661028 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.712687969 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.712708950 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.713124990 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.713136911 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.713165998 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.713182926 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.713809967 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.713821888 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.713849068 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.713860035 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.714374065 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.714538097 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.714576960 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.715210915 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.716949940 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.720863104 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.720915079 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.832360983 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.832412958 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.914155960 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.914271116 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.914331913 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.914374113 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.916593075 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.916723967 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.916757107 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.916788101 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.924813032 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.924899101 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.924956083 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.925137043 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.933022976 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.933166027 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.933187962 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.933243036 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.941350937 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.941399097 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.941585064 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.941617966 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.949485064 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.949614048 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.949652910 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.949652910 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.957640886 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.957684040 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.957814932 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.957853079 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.965925932 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.965960979 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.966051102 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.966089010 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.974107027 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.974179029 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.974261999 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.977006912 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.981964111 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.982125044 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.982207060 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.989412069 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.989538908 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:20.989625931 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:20.997253895 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.001096010 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.034291983 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.034416914 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.034462929 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.034512997 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.119410038 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.119457006 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.119535923 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.119579077 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.121869087 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.121954918 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.122797012 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.122958899 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.123018026 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.127794027 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.127850056 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.127962112 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.128009081 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.132910967 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.133008003 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.133218050 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.133265018 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.137933969 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.138037920 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.138062000 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.138115883 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.142889023 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.142956972 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.143033028 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.143089056 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.147841930 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.147898912 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.147994041 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.148174047 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.152786970 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.152873039 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.152954102 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.152996063 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.158190966 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.158253908 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.158281088 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.158405066 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.162803888 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.162848949 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.163006067 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.163068056 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.167829037 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.168020964 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.168039083 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.168179035 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.171328068 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.171485901 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.171741009 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.171804905 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.174866915 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.174940109 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.174969912 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.175077915 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.178396940 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.178533077 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.178571939 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.178603888 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.181777954 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.181827068 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.181991100 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.182027102 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.185388088 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.185488939 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.185542107 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.185611963 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.188865900 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.188993931 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.189012051 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.189069986 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.192297935 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.192473888 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.192478895 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.192585945 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.195914984 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.195988894 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.196022987 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.196073055 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.199301004 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.199338913 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.320581913 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.320660114 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.320786953 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.320863962 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.322252035 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.322309017 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.322463989 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.322518110 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.325015068 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.325079918 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.325965881 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.326004982 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.326138020 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.326266050 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.328996897 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.329097033 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.329121113 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.329184055 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.331763029 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.331881046 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.331923008 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.332021952 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.334701061 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.334769011 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.334813118 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.334860086 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.337589979 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.337635040 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.337733984 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.337858915 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.340735912 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.340909958 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.340946913 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.340946913 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.343374968 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.343476057 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.343667984 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.346254110 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.346369982 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.346379995 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.346470118 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.349096060 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.349167109 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.349250078 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.349308968 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.351979971 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.352027893 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.352130890 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.352164984 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.354866028 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.354958057 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.355045080 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.355159044 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.357789040 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.357986927 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.358062983 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.360645056 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.360793114 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.360874891 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.363584995 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.363763094 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.363862991 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.366446972 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.366604090 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.366718054 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.369345903 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.369692087 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.369796038 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.372386932 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.372464895 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.372507095 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.373250961 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.375101089 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.375209093 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.375293016 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.377136946 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.377995968 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.378140926 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.378334045 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.380928040 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.381047010 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.381339073 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.383775949 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.383934975 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.384078026 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.386645079 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.386811018 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.387177944 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.389533997 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.389728069 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.389811039 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.392517090 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.392601013 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.392615080 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.392719030 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.395289898 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.395466089 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.395607948 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.398216009 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.398358107 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.398449898 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.401074886 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.401262045 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.401360989 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.404021025 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.404093027 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.404135942 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.404227972 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.522097111 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.522268057 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.522361040 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.522361040 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.523226976 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.523332119 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.523399115 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.523454905 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.525675058 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.525790930 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.525825024 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.526216984 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.528122902 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.528254032 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.528398991 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.528565884 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.530483007 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.530564070 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.530653000 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.530822992 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.532907009 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.532960892 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.532999992 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.533066988 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.535079956 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.535195112 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.535207033 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.535367966 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.537421942 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.537488937 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.537558079 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.537605047 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.539755106 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.539916039 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.539964914 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.539964914 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.542068005 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.542165995 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.542352915 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.542546034 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.544678926 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.544750929 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.544794083 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.544846058 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.547153950 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.547276020 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.547379971 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.547620058 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.549545050 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.549617052 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.549688101 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.549801111 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.551822901 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.551863909 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.551939011 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.552005053 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.554550886 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.554593086 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.554852009 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.554899931 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.556787014 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.556870937 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:21.556910038 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:21.557121038 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:23.284296989 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:23.404208899 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:23.404316902 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:23.413106918 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:23.534029961 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:24.693860054 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:24.693911076 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:24.694057941 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:24.694067955 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:24.694103956 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:24.694324017 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:24.694356918 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:24.714129925 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:24.834028959 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:25.116374016 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:25.117472887 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:25.239448071 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:25.360321999 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:25.463979959 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:25.464077950 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:25.465686083 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:25.586671114 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:25.586785078 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:25.587146997 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:25.707161903 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:30.762181997 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:43:30.762244940 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:43:31.153105974 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:31.274044991 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:31.274223089 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:31.274487019 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:31.405003071 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.142429113 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.142488003 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.145433903 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.146363020 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.146413088 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.146511078 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.146524906 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.146548986 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.146569967 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.149393082 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.154694080 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.265450001 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.269503117 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.274714947 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.698091030 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:34.698282957 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.698894024 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:34.819231987 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.382731915 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.382793903 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.382914066 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.382926941 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.382951975 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.382980108 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.383529902 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.383542061 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.383574009 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.385004997 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.385024071 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.385051012 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.385082006 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.385828972 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.385843039 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.385888100 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.386192083 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.386234045 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.391333103 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.391396046 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.503817081 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.503956079 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.596900940 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.597003937 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.597091913 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.597138882 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.601074934 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.601159096 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.601286888 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.601329088 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.609390020 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.609447956 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.609492064 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.609534025 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.617800951 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.617862940 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.617924929 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.617969990 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.626055956 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.626107931 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.626151085 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.626193047 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.634203911 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.634274006 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.634366989 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.634418011 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.642512083 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.642575979 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.642724037 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.642771959 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.650202990 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.650271893 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.650445938 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.650495052 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.657941103 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.657995939 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.658077002 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.658123970 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.665605068 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.665662050 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.665750027 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.665796041 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.673368931 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.673423052 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.673573971 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.673616886 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.681056976 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.681118011 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.717062950 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.717196941 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.817625046 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.817739964 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.817846060 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.820239067 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.820291042 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.820420980 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.820466042 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.825659990 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.825719118 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.825828075 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.825871944 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.830961943 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.831012011 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.831327915 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.831373930 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.836463928 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.836523056 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.836637974 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.836682081 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.841839075 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.841908932 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.841998100 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.842039108 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.847268105 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.847330093 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.847450018 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.847493887 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.852675915 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.852834940 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.852842093 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.852886915 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.856251955 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.856309891 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.856384039 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.856431007 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.859920025 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.859968901 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.860119104 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.860163927 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.863698006 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.863763094 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.863953114 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.864002943 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.867353916 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.867404938 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.867486000 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.867537975 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.871170998 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.871220112 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.871298075 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.871337891 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.874669075 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.874732971 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.874737978 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.874768972 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.878236055 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.878308058 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.878338099 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.878384113 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.881875992 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.881922960 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.881995916 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.882030010 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.885585070 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.885653019 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.885680914 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.885723114 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.889233112 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.889270067 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.889313936 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.889379978 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.892899036 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.893011093 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:43.893034935 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:43.893084049 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.019377947 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.019475937 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.019484997 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.019534111 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.020677090 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.020730019 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.020819902 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.020956993 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.023972034 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.024086952 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.024116993 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.024290085 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.027542114 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.027601004 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.027729034 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.027842999 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.030390978 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.030450106 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.030478954 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.030632973 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.032671928 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.032727957 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.032845974 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.032915115 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.035972118 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.036032915 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.036186934 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.036232948 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.039232016 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.039280891 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.039428949 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.039494991 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.042525053 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.042608976 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.042701006 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.042748928 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.045763016 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.045850992 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.045857906 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.045921087 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.049071074 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.049144983 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.049180984 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.049247026 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.052494049 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.052544117 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.052649975 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.052759886 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.055351973 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.055401087 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.055497885 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.055593014 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.058603048 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.058675051 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.058752060 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.058846951 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.061899900 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.061966896 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.062014103 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.062185049 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.065162897 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.065289021 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.065315962 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.065469980 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.068356037 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.068406105 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.068547964 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.068681002 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.071690083 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.071753979 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.071871042 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.071932077 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.074807882 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.074856043 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.075001001 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.075045109 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.078138113 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.078350067 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.078429937 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.081279039 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.081415892 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.081499100 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:44.084485054 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.084638119 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:44.084713936 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.704622030 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.704677105 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.704819918 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.704857111 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.705116034 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.705137014 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.705161095 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.705178976 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.705766916 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.705780029 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.705811977 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.706324100 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.706336975 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.706366062 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.706391096 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.707027912 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.707082033 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.707634926 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.707678080 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.707791090 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.707830906 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.710587978 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.710628986 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.710700035 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.710741043 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.713423014 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.713469982 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.713596106 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.713637114 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.713913918 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.713924885 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.713957071 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.713995934 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.716389894 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.716449022 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.717031002 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.717072010 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.719343901 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.719388008 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.722839117 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.722889900 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.722985983 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.723021030 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.732193947 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.732261896 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.732335091 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.732382059 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.906898975 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.906960011 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.913656950 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.913765907 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.914990902 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.915057898 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.915144920 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.915188074 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.917741060 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.917891979 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.917926073 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.917947054 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.919065952 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.919116020 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.919251919 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.919292927 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.922023058 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.922075987 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.922244072 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.922291994 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.923470974 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.923536062 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.923671961 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.923713923 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.925430059 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.925484896 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.925700903 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.925745010 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.928657055 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.928711891 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.928848028 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.928891897 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.931025982 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.931072950 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.931139946 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.931183100 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.931925058 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.931977987 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.932102919 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.932142019 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.933984995 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.934030056 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.934154987 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.934199095 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.937412024 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.937469006 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.937552929 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.937597036 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.940270901 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.940325975 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.940439939 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.940481901 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.941063881 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.941107988 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.941260099 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.941298008 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.942996979 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.943056107 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.943133116 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.943175077 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.945842028 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.945904970 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.946028948 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.946075916 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.948914051 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.948972940 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.949052095 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.949098110 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.949327946 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.949378967 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.949466944 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.949510098 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.958007097 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.958121061 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.958178043 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.958178043 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.966515064 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.966561079 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.966623068 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.966660023 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.975227118 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.975295067 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.975356102 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.975393057 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.983747959 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.983793974 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.983871937 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.983906031 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.992393970 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.992440939 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:53.992548943 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:53.992584944 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.001032114 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.001099110 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.001162052 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.001203060 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.009803057 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.009885073 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.124502897 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.126389027 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.126512051 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.126580000 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.127006054 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.129442930 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.129616022 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.129688025 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.130214930 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.130414963 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.130465031 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.132503033 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.132635117 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.132695913 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.139028072 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.139190912 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.139241934 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.144659996 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.144890070 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.144973993 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.151230097 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.151487112 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.151549101 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.157587051 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.157841921 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.157916069 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.164724112 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.164736986 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.164788008 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.170264006 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.170456886 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.170502901 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.176279068 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.176501989 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.176568985 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.182653904 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.182842016 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.182931900 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.188946962 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.189065933 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.189126015 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.195113897 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.195353031 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.195395947 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.201540947 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.201719046 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.201798916 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.207777977 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.207941055 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.207997084 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.214230061 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.214397907 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.214458942 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.220459938 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.220681906 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.220752001 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.226712942 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.226907015 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.227037907 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.232976913 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.233211040 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.233268023 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.239308119 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.239440918 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.239502907 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.245759010 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.245877981 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.245937109 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.249927998 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.250154972 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.250222921 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.251590014 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.251718998 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.251776934 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.252146006 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.252193928 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.252289057 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.255023003 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.258260965 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.258352995 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.258368969 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.258394957 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.334981918 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.335088015 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.335134983 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.335196018 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.336404085 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.336484909 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.336726904 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.336793900 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.341136932 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.341186047 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.342533112 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.342585087 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.342664957 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.342704058 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.345232964 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.345292091 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.345382929 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.345422983 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.350127935 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.350183010 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.350404024 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.350445032 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.354474068 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.354526043 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.354680061 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.354728937 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.358990908 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.359051943 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.359108925 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.359148979 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.363421917 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.363571882 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.363645077 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.367575884 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.367712975 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.367738962 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.367786884 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.370610952 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.370663881 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.370749950 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.370791912 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.371848106 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.371897936 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.371977091 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.371989965 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.372023106 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.372073889 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.372597933 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.372641087 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.374829054 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.374874115 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.374995947 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.375037909 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.375899076 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.375947952 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.376096010 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.376138926 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.377810001 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.377859116 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.377947092 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.377986908 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.379899025 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.379952908 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.380120993 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.380162954 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.380673885 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.380716085 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.384144068 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.384196043 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.384314060 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.384355068 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.388045073 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.388092995 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.388223886 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.388266087 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.391833067 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.391890049 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.391997099 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.392040014 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.395690918 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.395752907 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.395839930 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.395888090 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.399640083 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.399707079 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.399831057 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.399879932 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.403523922 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.403573990 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.403722048 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.404211998 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.407284021 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.407365084 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.407480001 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.407531023 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.594352961 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.594485044 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.594557047 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.595649004 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.595895052 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.595957994 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.598002911 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.598175049 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.598213911 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.600686073 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.600740910 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.600833893 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.600881100 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.603401899 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.603456974 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.603539944 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.603598118 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.606132030 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.606184959 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.606266022 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.606309891 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.608702898 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.608822107 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.608885050 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.608932972 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.611488104 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.611696959 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.611711979 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.611735106 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.614119053 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.614197969 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.614233971 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.614314079 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.616777897 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.616858959 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.616919041 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.617039919 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.619510889 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.619589090 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.619632006 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.619728088 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.622092009 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.622143030 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.622262955 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.622307062 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.626281023 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.626328945 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.626470089 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.626516104 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.627762079 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.627805948 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.627871037 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.627914906 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.630383968 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.630429983 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.630501032 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.630556107 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.632890940 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.632941008 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.633142948 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.633188009 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.635626078 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.635673046 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.635741949 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.635786057 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.638186932 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.638232946 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.638323069 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.638365030 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.641103983 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.641151905 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.641319036 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.641362906 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.643660069 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.643706083 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.643786907 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.643830061 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.646322012 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.646365881 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.646451950 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.646492958 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.648893118 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.648940086 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.649049997 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.649094105 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.651544094 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.651586056 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.651705027 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.651743889 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.654301882 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.654365063 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.654412985 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.654458046 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.656941891 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.656996965 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.657118082 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.657156944 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:43:54.659603119 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:43:54.659666061 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:44:44.353866100 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:44:44.354098082 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:44:50.877154112 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:44:50.878988028 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:44:56.177481890 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:44:56.177588940 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:44:57.655880928 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:44:57.671518087 CET	49707	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:44:57.698549986 CET	49712	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:44:57.698688984 CET	49709	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:44:57.776561975 CET	6542	49741	103.57.249.207	192.168.2.6
Dec 3, 2024 17:44:57.779011011 CET	49741	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:44:57.791474104 CET	6542	49707	103.57.249.207	192.168.2.6
Dec 3, 2024 17:44:57.818543911 CET	6542	49712	94.232.43.224	192.168.2.6
Dec 3, 2024 17:44:57.818705082 CET	6542	49709	94.232.43.224	192.168.2.6
Dec 3, 2024 17:45:00.769622087 CET	6542	49732	94.232.43.224	192.168.2.6
Dec 3, 2024 17:45:00.769740105 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:45:12.733971119 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:45:12.755294085 CET	49732	6542	192.168.2.6	94.232.43.224
Dec 3, 2024 17:45:12.854398012 CET	6542	49759	103.57.249.207	192.168.2.6
Dec 3, 2024 17:45:12.854522943 CET	49759	6542	192.168.2.6	103.57.249.207
Dec 3, 2024 17:45:12.875328064 CET	6542	49732	94.232.43.224	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 17:43:07.681756973 CET	50399	53	192.168.2.6	1.1.1.1
Dec 3, 2024 17:43:07.681756973 CET	60168	53	192.168.2.6	1.1.1.1
Dec 3, 2024 17:43:07.822453976 CET	53	60168	1.1.1.1	192.168.2.6
Dec 3, 2024 17:43:08.335484028 CET	53	50399	1.1.1.1	192.168.2.6
Dec 3, 2024 17:43:22.887890100 CET	54751	53	192.168.2.6	1.1.1.1
Dec 3, 2024 17:43:23.262953997 CET	53	54751	1.1.1.1	192.168.2.6
Dec 3, 2024 17:43:30.765247107 CET	62798	53	192.168.2.6	1.1.1.1
Dec 3, 2024 17:43:31.151848078 CET	53	62798	1.1.1.1	192.168.2.6
Dec 3, 2024 17:46:44.703170061 CET	53	63237	1.1.1.1	192.168.2.6
Dec 3, 2024 17:46:44.703188896 CET	53	63237	1.1.1.1	192.168.2.6
Dec 3, 2024 17:46:44.703247070 CET	53	63237	1.1.1.1	192.168.2.6
Dec 3, 2024 17:46:44.703452110 CET	53	63237	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 17:43:07.681756973 CET	192.168.2.6	1.1.1.1	0x4e5f	Standard query (0)	vutarf.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:07.681756973 CET	192.168.2.6	1.1.1.1	0x3582	Standard query (0)	huanvn.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:22.887890100 CET	192.168.2.6	1.1.1.1	0xd364	Standard query (0)	vutarf.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:30.765247107 CET	192.168.2.6	1.1.1.1	0xd347	Standard query (0)	huanvn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 17:43:07.822453976 CET	1.1.1.1	192.168.2.6	0x3582	No error (0)	huanvn.com		103.57.249.207	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:08.335484028 CET	1.1.1.1	192.168.2.6	0x4e5f	No error (0)	vutarf.com		94.232.43.224	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:23.262953997 CET	1.1.1.1	192.168.2.6	0xd364	No error (0)	vutarf.com		94.232.43.224	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:43:31.151848078 CET	1.1.1.1	192.168.2.6	0xd347	No error (0)	huanvn.com		103.57.249.207	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:46:44.703170061 CET	1.1.1.1	192.168.2.6	0x13d	Server failure (2)	reateberam.com	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:46:44.703188896 CET	1.1.1.1	192.168.2.6	0x13d	Server failure (2)	reateberam.com	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:46:44.703247070 CET	1.1.1.1	192.168.2.6	0x13d	Server failure (2)	reateberam.com	none	none	A (IP address)	IN (0x0001)	false
Dec 3, 2024 17:46:44.703452110 CET	1.1.1.1	192.168.2.6	0x13d	Server failure (2)	reateberam.com	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:43:02
Start date:	03/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\avutil.dll.dll"
Imagebase:	0x7ff7a7210000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:43:02
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:43:02
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1
Imagebase:	0x7ff732310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:43:02
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,DLLMain
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000002.4678724103.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000003.3250744554.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000003.2290158761.0000021E06F25000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000003.3250525715.0000021E0152D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:43:02
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",#1
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000004.00000002.4681807964.0000023B61A2C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:43:05
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_q
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:43:08
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\avutil.dll.dll,av_add_stable
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",DLLMain
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000009.00000002.4718709422.0000026D524AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000009.00000003.2620826714.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000009.00000003.2620889065.0000026D524DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_q
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_add_stable
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_version
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_license
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avutil_configuration
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_vga16_font
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_tempfile
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_solve_lls
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_free
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_execute
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_slicethread_create
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_set_systematic_pal2
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_scalarproduct_float_c
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_request_sample
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_report_missing_feature
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_open
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_init_lls
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_fopen_utf8
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_float_dsp_alloc
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_dict_set_timestamp
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_cga_font
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",avpriv_alloc_fixed_dsp
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_init
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_le_crypt
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_init
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_crypt
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_xtea_alloc
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line2
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_write_image_line
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vlog
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vkfmt_from_pixfmt
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:43:12
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\avutil.dll.dll",av_vk_frame_alloc
Imagebase:	0x7ff743440000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	98.3%
Signature Coverage:	19.7%
Total number of Nodes:	238
Total number of Limit Nodes:	11

Executed Functions

Function 0000026CE6870024 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 484
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000026CE6870186
LoadLibraryA.KERNELBASE ref: 0000026CE687034B

Strings

., xrefs: 0000026CE6870074
k, xrefs: 0000026CE6870054
3, xrefs: 0000026CE687006D
e, xrefs: 0000026CE6870066
r, xrefs: 0000026CE687005B
l, xrefs: 0000026CE687007B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID: .$3$e$k$l$r
API String ID: 3550616410-427081609
Opcode ID: 291297bbe044f9a5b47e76894c7116349fbdee25044733f7824d139af3bc4b69
Instruction ID: ea0a942164159a61caf241467d81bb2b9d7ab423c78f97bcfab0b378217a4043
Opcode Fuzzy Hash: 291297bbe044f9a5b47e76894c7116349fbdee25044733f7824d139af3bc4b69
Instruction Fuzzy Hash: C1D1E670224F0D4BDB2DFB59D8886B5B3E2FB96315F34416ED487C7296DA32A8438790

Function 0000026CE85C4340 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026CE85C4750: GetModuleFileNameW.KERNEL32 ref: 0000026CE85C4791

GetModuleFileNameW.KERNEL32 ref: 0000026CE85C43FC
SHGetSpecialFolderPathW.SHELL32 ref: 0000026CE85C4418
lstrcatW.KERNEL32 ref: 0000026CE85C442B
lstrcatW.KERNEL32 ref: 0000026CE85C4440
lstrcatW.KERNEL32 ref: 0000026CE85C4456
lstrcatW.KERNEL32 ref: 0000026CE85C446B

Part of subcall function 0000026CE85C56E0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 0000026CE85C572D

SafeRWList.LIBCMTD ref: 0000026CE85C44A3

Part of subcall function 0000026CE85CB0A0: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CB1FC
Part of subcall function 0000026CE85CB0A0: char_traits.LIBCPMTD ref: 0000026CE85CB31E
Part of subcall function 0000026CE85CB0A0: ctype.LIBCPMTD ref: 0000026CE85CB385

Part of subcall function 0000026CE85C5540: shared_ptr.LIBCPMTD ref: 0000026CE85C5560

Part of subcall function 0000026CE85CB0A0: char_traits.LIBCPMTD ref: 0000026CE85CB3F1
Part of subcall function 0000026CE85CB0A0: char_traits.LIBCPMTD ref: 0000026CE85CB4BF
Part of subcall function 0000026CE85CB0A0: std::ios_base::width.LIBCPMTD ref: 0000026CE85CB4FF

Strings

DLLMain, xrefs: 0000026CE85C43DB
\NTUSER.DAT.Not, xrefs: 0000026CE85C43CF

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: lstrcat$char_traits$FileModuleNameProcessorVirtual$Concurrency::FolderListPathRootRoot::SafeSpecialctypeshared_ptrstd::ios_base::getlocstd::ios_base::width
String ID: DLLMain$\NTUSER.DAT.Not
API String ID: 3304544195-2041910327
Opcode ID: d30e8e5b88aad5fa04ee92c3bd5113da6591793adca71e7613593e8e8900fb11
Instruction ID: 62fb6becf574f6eca70bba12693b0e33ec9605917630a114be88902111b10c59
Opcode Fuzzy Hash: d30e8e5b88aad5fa04ee92c3bd5113da6591793adca71e7613593e8e8900fb11
Instruction Fuzzy Hash: D491017222B9C595EA20FB54F4983FA7375F7C4340FA01112D6DE87AAAEF2AC505CB40

Function 00007FFD936F1330 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocExNuma.KERNELBASE ref: 00007FFD936F13AB

Strings

+=, xrefs: 00007FFD936F1372
,=, xrefs: 00007FFD936F134D
@, xrefs: 00007FFD936F1399

Memory Dump Source

Source File: 00000000.00000002.4682694752.00007FFD936F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD936F0000, based on PE: true

Associated: 00000000.00000002.4682663036.00007FFD936F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4682925629.00007FFD937BC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4682995000.00007FFD937BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4683825189.00007FFD947FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4683844155.00007FFD94804000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4683860746.00007FFD94805000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4683877974.00007FFD94808000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd936f0000_loaddll64.jbxd

Similarity

API ID: AllocNumaVirtual
String ID: +=$,=$@
API String ID: 4233825816-2127940403
Opcode ID: 90f39fe90f72f0608001160906d043fdca6e6bb2d5c2e1c5a3b78c0ae946c4bd
Instruction ID: bbba4b2386b4a80d8c10cab31753d40dd162d69387ae24ce7f2f0fec0b22dc07
Opcode Fuzzy Hash: 90f39fe90f72f0608001160906d043fdca6e6bb2d5c2e1c5a3b78c0ae946c4bd
Instruction Fuzzy Hash: 91112FA1B0439801FFA993B9E53537D6646A716FF0EC043399D2D17BC6D96C41058340

Non-executed Functions

Function 0000026CE85F78D8 Relevance: 29.1, APIs: 19, Instructions: 555
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85F8A07

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_malloc_crt.LIBCMT ref: 0000026CE85F8A2E

Part of subcall function 0000026CE85F6398: malloc.LIBCMT ref: 0000026CE85F63C3
Part of subcall function 0000026CE85F6398: Sleep.KERNEL32(?,?,?,0000026CE85F4B14,?,?,?,0000026CE85F4A13,?,?,00000000,0000026CE85FD332,?,?,00000000,0000026CE85FD29E), ref: 0000026CE85F63D6

_invoke_watson.LIBCMT ref: 0000026CE85F9051
_invoke_watson.LIBCMT ref: 0000026CE85F9067
_invoke_watson.LIBCMT ref: 0000026CE85F907D
_invoke_watson.LIBCMT ref: 0000026CE85F9093
_invoke_watson.LIBCMT ref: 0000026CE85F90A9
_invoke_watson.LIBCMT ref: 0000026CE85F90BF
_invoke_watson.LIBCMT ref: 0000026CE85F90D5
_invoke_watson.LIBCMT ref: 0000026CE85F90EB
_invoke_watson.LIBCMT ref: 0000026CE85F9101
_invoke_watson.LIBCMT ref: 0000026CE85F9117
_invoke_watson.LIBCMT ref: 0000026CE85F912D
_invoke_watson.LIBCMT ref: 0000026CE85F9143
_invoke_watson.LIBCMT ref: 0000026CE85F9159
_invoke_watson.LIBCMT ref: 0000026CE85F916F
_invoke_watson.LIBCMT ref: 0000026CE85F9185
_invoke_watson.LIBCMT ref: 0000026CE85F919B
_invoke_watson.LIBCMT ref: 0000026CE85F91B1

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _invoke_watson$Locale$SleepUpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crtmalloc
String ID:
API String ID: 3294838543-0
Opcode ID: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction ID: 06c5418329f9265671ed8a3c7bb710817a9ab5c9685987b846ff0b57339e8320
Opcode Fuzzy Hash: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction Fuzzy Hash: 9922C13232AA4486FB64EB65E81F7BA3362F754784F649025DB8B86695DF3BD4058300

Function 0000026CE85DBE74 Relevance: 27.4, APIs: 13, Strings: 2, Instructions: 1114COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DBEEE

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D3964: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3985
Part of subcall function 0000026CE85D3964: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D39AA
Part of subcall function 0000026CE85D3964: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D39D4
Part of subcall function 0000026CE85D3964: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3A7E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DBF0F
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DBF89
_Mpunct.LIBCPMT ref: 0000026CE85DC03F
_Mpunct.LIBCPMT ref: 0000026CE85DC601
_Mpunct.LIBCPMT ref: 0000026CE85DC624
_Mpunct.LIBCPMT ref: 0000026CE85DC729
_Mpunct.LIBCPMT ref: 0000026CE85DC78E
_Mpunct.LIBCPMT ref: 0000026CE85DC7B4
_Mpunct.LIBCPMT ref: 0000026CE85DC8BB
_Mpunct.LIBCPMT ref: 0000026CE85DC921
_Mpunct.LIBCPMT ref: 0000026CE85DC966
_Mpunct.LIBCPMT ref: 0000026CE85DC9AB

Strings

0123456789-, xrefs: 0000026CE85DBFCF, 0000026CE85DC131, 0000026CE85DC35B, 0000026CE85DC544
, xrefs: 0000026CE85DCC9A

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Mpunct$Lockitstd::_$std::ios_base::getloc$Lockit::_Lockit::~_$std::locale::locale
String ID: $0123456789-
API String ID: 132018215-700845222
Opcode ID: 60c27871b8621bc0c9a776556df6c880f16a64ad241ae21a9c7b511643420f0b
Instruction ID: cb2b0dcb18529b18928c244ccbf428298da35379a61336b8ec032d5d27339167
Opcode Fuzzy Hash: 60c27871b8621bc0c9a776556df6c880f16a64ad241ae21a9c7b511643420f0b
Instruction Fuzzy Hash: FBA2473260B68085FB20AB65C4583BE37B1FB55B88F649016DE8B5BBD5CF27C895CB00

Function 0000026CE85DAED4 Relevance: 27.4, APIs: 13, Strings: 2, Instructions: 1110COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DAF4E

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D3704: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3725
Part of subcall function 0000026CE85D3704: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D374A
Part of subcall function 0000026CE85D3704: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3774
Part of subcall function 0000026CE85D3704: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D381E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DAF6F
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DAFE9
_Mpunct.LIBCPMT ref: 0000026CE85DB09F
_Mpunct.LIBCPMT ref: 0000026CE85DB661
_Mpunct.LIBCPMT ref: 0000026CE85DB684
_Mpunct.LIBCPMT ref: 0000026CE85DB789
_Mpunct.LIBCPMT ref: 0000026CE85DB7EE
_Mpunct.LIBCPMT ref: 0000026CE85DB814
_Mpunct.LIBCPMT ref: 0000026CE85DB91B
_Mpunct.LIBCPMT ref: 0000026CE85DB981
_Mpunct.LIBCPMT ref: 0000026CE85DB9C6
_Mpunct.LIBCPMT ref: 0000026CE85DBA0B

Strings

0123456789-, xrefs: 0000026CE85DB02F, 0000026CE85DB191, 0000026CE85DB3BB, 0000026CE85DB5A4
, xrefs: 0000026CE85DBCFA

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Mpunct$Lockitstd::_$std::ios_base::getloc$Lockit::_Lockit::~_$std::locale::locale
String ID: $0123456789-
API String ID: 132018215-700845222
Opcode ID: fd60dde3f0e5ed17a34b0ce817ebb90d0591360cd0ee5566e54b3aceb4ca2f06
Instruction ID: 6e88487048832587b16a835d337f59455e3be5194a3baf9436765ad7eba8c6f8
Opcode Fuzzy Hash: fd60dde3f0e5ed17a34b0ce817ebb90d0591360cd0ee5566e54b3aceb4ca2f06
Instruction Fuzzy Hash: 51A2383260B68085FB60AB65D4583BE37B2FB45B88F649015DE8A1BBD5DF37C895C301

Function 0000026CE85E9744 Relevance: 27.3, APIs: 13, Strings: 2, Instructions: 1051COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E97C2

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85E85C8: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E85E9
Part of subcall function 0000026CE85E85C8: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E860E
Part of subcall function 0000026CE85E85C8: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8638
Part of subcall function 0000026CE85E85C8: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E86E2

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E97E4
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E985F
_Mpunct.LIBCPMT ref: 0000026CE85E9909
_Mpunct.LIBCPMT ref: 0000026CE85E9E59
_Mpunct.LIBCPMT ref: 0000026CE85E9E76
_Mpunct.LIBCPMT ref: 0000026CE85E9F68
_Mpunct.LIBCPMT ref: 0000026CE85E9F9F
_Mpunct.LIBCPMT ref: 0000026CE85E9FC3
_Mpunct.LIBCPMT ref: 0000026CE85EA0B7
_Mpunct.LIBCPMT ref: 0000026CE85EA0EC
_Mpunct.LIBCPMT ref: 0000026CE85EA12C
_Mpunct.LIBCPMT ref: 0000026CE85EA16C

Strings

0123456789-, xrefs: 0000026CE85E98A5, 0000026CE85E99E6, 0000026CE85E9BEE, 0000026CE85E9DA4
, xrefs: 0000026CE85EA419

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Mpunct$Lockitstd::_$std::ios_base::getloc$Lockit::_Lockit::~_$std::locale::locale
String ID: $0123456789-
API String ID: 132018215-700845222
Opcode ID: 412ebe9269c493e5726af88abb894bace85a57de134f1800497118e7ef52c84f
Instruction ID: dfd3737ea3441d603a445db046ba0bc8c0f88242ac8f054922a7746c6e208ec1
Opcode Fuzzy Hash: 412ebe9269c493e5726af88abb894bace85a57de134f1800497118e7ef52c84f
Instruction Fuzzy Hash: A2A27D3260F68089FB25AB75C8583BD37B1F755B88F644416DE8B1BB96CF2BC8558320

Function 0000026CE6887BD8 Relevance: 13.7, APIs: 4, Strings: 3, Instructions: 1427COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE6887C33

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688394D
Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883972

_Mpunct.LIBCPMT ref: 0000026CE6887C76
std::ios_base::getloc.LIBCPMTD ref: 0000026CE6887C84
localeconv.LIBCMT ref: 0000026CE688830F

Strings

$, xrefs: 0000026CE6887FF2
$, xrefs: 0000026CE6888226
$, xrefs: 0000026CE688847D

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: $$$$$
API String ID: 280637346-798797307
Opcode ID: bdf690cb125a074a7188a53bf61b6b763a23d8da378ea9d39ed0c8cbcd31311e
Instruction ID: f3ad4c4b65ad91d165fa6fdc41e1bfc77b157d143bcf43a314b8a973b9ba29a3
Opcode Fuzzy Hash: bdf690cb125a074a7188a53bf61b6b763a23d8da378ea9d39ed0c8cbcd31311e
Instruction Fuzzy Hash: 29A26E70228A468AEB74FB1A805977977F1FF5A310FB4415AE4C6C7293DB2BDC428781

Function 0000026CE6888824 Relevance: 13.7, APIs: 4, Strings: 3, Instructions: 1427COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE688887F

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883A7D
Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883AA2

_Mpunct.LIBCPMT ref: 0000026CE68888C2
std::ios_base::getloc.LIBCPMTD ref: 0000026CE68888D0
localeconv.LIBCMT ref: 0000026CE6888F5B

Strings

$, xrefs: 0000026CE68890C9
$, xrefs: 0000026CE6888E72
$, xrefs: 0000026CE6888C3E

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: $$$$$
API String ID: 280637346-798797307
Opcode ID: eef031cd9eaabbc570829bf82e32b443498f5b3608fb8350dd4ba77db166997c
Instruction ID: 20465ee44281164cbedcfc6575f2bb89f25829d8a23b9ccd05ceaf46ef017b3f
Opcode Fuzzy Hash: eef031cd9eaabbc570829bf82e32b443498f5b3608fb8350dd4ba77db166997c
Instruction Fuzzy Hash: 2EA25D70228A4A8AEB75BB1E805877977F1FF5A300FB4515AE4CAC7293D72BD842C741

Function 0000026CE687D724 Relevance: 13.6, APIs: 4, Strings: 3, Instructions: 1364COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE687D77C

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2CD
Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2F2

_Mpunct.LIBCPMT ref: 0000026CE687D7BE
std::ios_base::getloc.LIBCPMTD ref: 0000026CE687D7CC
localeconv.LIBCMT ref: 0000026CE687DDE3

Strings

$, xrefs: 0000026CE687DD13
$, xrefs: 0000026CE687DF32
$, xrefs: 0000026CE687DAF8

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: $$$$$
API String ID: 280637346-798797307
Opcode ID: 4c18d35050e8cf8f572192a96411797e63cf445442ff4103ec6e9a0563a2ef7e
Instruction ID: f45d6ca9767fb20404ec7bdfa2d759d142bb320c856621eb176c6dc0c98d0fa1
Opcode Fuzzy Hash: 4c18d35050e8cf8f572192a96411797e63cf445442ff4103ec6e9a0563a2ef7e
Instruction Fuzzy Hash: BCA26130628B498FE775BB2A8069779F7F1FB56304F74518AD4DAC7293C623E8428781

Function 0000026CE68870B0 Relevance: 13.6, APIs: 4, Strings: 3, Instructions: 1307COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE688712C
_Mpunct.LIBCPMT ref: 0000026CE688716D
std::ios_base::getloc.LIBCPMTD ref: 0000026CE6887188

Part of subcall function 0000026CE6888824: std::ios_base::getloc.LIBCPMTD ref: 0000026CE688887F
Part of subcall function 0000026CE6888824: _Mpunct.LIBCPMT ref: 0000026CE68888C2
Part of subcall function 0000026CE6888824: std::ios_base::getloc.LIBCPMTD ref: 0000026CE68888D0

Strings

$, xrefs: 0000026CE68873A6
$, xrefs: 0000026CE6887838
$, xrefs: 0000026CE68875E1

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: $$$$$
API String ID: 4161885152-798797307
Opcode ID: 5e3a662610487c8e3ddd3b18f70fa8c9fc7be83a72ef20f7899166f84c343da3
Instruction ID: 09505198b1d932089d0f4da775fc899a8152eb3fab0de6aae1a4926dc7bc8c3c
Opcode Fuzzy Hash: 5e3a662610487c8e3ddd3b18f70fa8c9fc7be83a72ef20f7899166f84c343da3
Instruction Fuzzy Hash: 46926130228A468BEB74BB1A805A77D7BF1FF56304FB4515AE4C6C7293D72BD8428781

Function 0000026CE6886588 Relevance: 13.6, APIs: 4, Strings: 3, Instructions: 1307COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE6886604
_Mpunct.LIBCPMT ref: 0000026CE6886645
std::ios_base::getloc.LIBCPMTD ref: 0000026CE6886660

Part of subcall function 0000026CE6887BD8: std::ios_base::getloc.LIBCPMTD ref: 0000026CE6887C33
Part of subcall function 0000026CE6887BD8: _Mpunct.LIBCPMT ref: 0000026CE6887C76
Part of subcall function 0000026CE6887BD8: std::ios_base::getloc.LIBCPMTD ref: 0000026CE6887C84

Strings

$, xrefs: 0000026CE688687E
$, xrefs: 0000026CE6886D10
$, xrefs: 0000026CE6886AB9

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: $$$$$
API String ID: 4161885152-798797307
Opcode ID: fc2bbccc12045fbc8c21ef7f8c78b6684704d45146c539d2158c5cc0326641d6
Instruction ID: 846b890530e488e9da1f7c49d6a1a0ecefea73fbd1fd669d248a62ece334e264
Opcode Fuzzy Hash: fc2bbccc12045fbc8c21ef7f8c78b6684704d45146c539d2158c5cc0326641d6
Instruction Fuzzy Hash: 7E928230628A468BEB74BB19A05977977F1FF56300FB4515AE4C6C7383DB2BD8828781

Function 0000026CE687CCE8 Relevance: 13.5, APIs: 4, Strings: 3, Instructions: 1240COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE687CD63
_Mpunct.LIBCPMT ref: 0000026CE687CDA4
std::ios_base::getloc.LIBCPMTD ref: 0000026CE687CDB8

Part of subcall function 0000026CE687D724: std::ios_base::getloc.LIBCPMTD ref: 0000026CE687D77C
Part of subcall function 0000026CE687D724: _Mpunct.LIBCPMT ref: 0000026CE687D7BE
Part of subcall function 0000026CE687D724: std::ios_base::getloc.LIBCPMTD ref: 0000026CE687D7CC

Strings

$, xrefs: 0000026CE687D1BE
$, xrefs: 0000026CE687D3D0
$, xrefs: 0000026CE687CFA7

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: $$$$$
API String ID: 4161885152-798797307
Opcode ID: a8fae0d38d37e0f927b68bfab163fa84d13f2718d1e3d4a018e1805ba4bc1a7e
Instruction ID: f37c4e0b97a6e7d71891cc6a67ebfbb6994ec623193fdfd2f4d2db3ee7279362
Opcode Fuzzy Hash: a8fae0d38d37e0f927b68bfab163fa84d13f2718d1e3d4a018e1805ba4bc1a7e
Instruction Fuzzy Hash: A292AF30628A498FEB75BB2A8069778B7F1FB57304F74514AD4DAC7293C623F8428781

Function 0000026CE85D8F7C Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D8FD7

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41D5
Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41FA
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4224
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D42CE

_Mpunct.LIBCPMT ref: 0000026CE85D901A
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D9028
localeconv.LIBCMT ref: 0000026CE85D96B3

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000026CE85D906A, 0000026CE85D93AB, 0000026CE85D95DD, 0000026CE85D9826, 0000026CE85D9B3C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 1771764317-3606100449
Opcode ID: d0c935d1eb7fee9e72ae943eb111c1065fb69439d988de5b5829165648df1abe
Instruction ID: cc03b6fb9b5e4ee984c126f8ebf8e80460685f9e7d27dec4ed3fc274aa90e244
Opcode Fuzzy Hash: d0c935d1eb7fee9e72ae943eb111c1065fb69439d988de5b5829165648df1abe
Instruction Fuzzy Hash: 0692363620F680C5FA64AB6681583BE77B1FB81B84F649015DE8B0B7D5DF2BC896C311

Function 0000026CE85D8330 Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D838B

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40A5
Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40CA
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D40F4
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D419E

_Mpunct.LIBCPMT ref: 0000026CE85D83CE
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D83DC
localeconv.LIBCMT ref: 0000026CE85D8A67

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000026CE85D841E, 0000026CE85D875F, 0000026CE85D8991, 0000026CE85D8BDA, 0000026CE85D8EF0

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 1771764317-3606100449
Opcode ID: 127ee6d417b2a901dd8abde2732992d2fc45a6e8d2c9ed35a2b699a2b19159da
Instruction ID: f25180bde22641d0cab9ff4e5a2b175ddf1c8e32a0d1b7ae451544547e6e8c74
Opcode Fuzzy Hash: 127ee6d417b2a901dd8abde2732992d2fc45a6e8d2c9ed35a2b699a2b19159da
Instruction Fuzzy Hash: D0926A3620F68085FA64AB66815837E37B1FB91B84F648805DE9B2B7D5CF37C896C311

Function 0000026CE85CDE7C Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 928COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CDED4

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA25
Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA4A
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCA74
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCB1E

_Mpunct.LIBCPMT ref: 0000026CE85CDF16
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CDF24
localeconv.LIBCMT ref: 0000026CE85CE53B

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000026CE85CDF66, 0000026CE85CE265, 0000026CE85CE3FA, 0000026CE85CE618, 0000026CE85CE8ED

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::ios_base::getloc$Mpunctlocaleconvstd::locale::locale
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 1771764317-3606100449
Opcode ID: 35fd5fe3c7343d7ba8878f5d61dceb1aa3ab23820ace81f01204e0a2f043b718
Instruction ID: d7189a5fbb516f7560cf643bf095c81fe81c4fdce664eafe97a55ca0b263e7c7
Opcode Fuzzy Hash: 35fd5fe3c7343d7ba8878f5d61dceb1aa3ab23820ace81f01204e0a2f043b718
Instruction Fuzzy Hash: B6828F3630FA808AFB65AA65C1583BD3BB1B741B84F748502CADB17796DF27D856CB00

Function 0000026CE85D7808 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D7884
_Mpunct.LIBCPMT ref: 0000026CE85D78C5
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D78E0

Part of subcall function 0000026CE85D8F7C: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D8FD7
Part of subcall function 0000026CE85D8F7C: _Mpunct.LIBCPMT ref: 0000026CE85D901A
Part of subcall function 0000026CE85D8F7C: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D9028

Strings

0123456789-+Ee, xrefs: 0000026CE85D7922, 0000026CE85D7B13, 0000026CE85D7D4C, 0000026CE85D7F95, 0000026CE85D82AB

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: 0123456789-+Ee
API String ID: 4161885152-1347306980
Opcode ID: 63da71c29f913481ec287aef2007a4f8c74ad4193af97d5ee967edaa42889e0b
Instruction ID: 086240261d094958d7263428528fd7de622a4676e43b7d94a993cd38bdc2c86c
Opcode Fuzzy Hash: 63da71c29f913481ec287aef2007a4f8c74ad4193af97d5ee967edaa42889e0b
Instruction Fuzzy Hash: C0825B3220B6808AFB64AB6581583BE37B1FB81B84F649419DE8B177D5DF37C896C311

Function 0000026CE85D6CE0 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D6D5C
_Mpunct.LIBCPMT ref: 0000026CE85D6D9D
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D6DB8

Part of subcall function 0000026CE85D8330: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D838B
Part of subcall function 0000026CE85D8330: _Mpunct.LIBCPMT ref: 0000026CE85D83CE
Part of subcall function 0000026CE85D8330: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D83DC

Strings

0123456789-+Ee, xrefs: 0000026CE85D6DFA, 0000026CE85D6FEB, 0000026CE85D7224, 0000026CE85D746D, 0000026CE85D7783

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: 0123456789-+Ee
API String ID: 4161885152-1347306980
Opcode ID: e2f70bdb7614c13ac1d1ed27f86cfebf576c1c41d2762d4cf0bd4c9359251953
Instruction ID: b21d010f8484d177c2bc3619b3d2357c9a804a212ea6a931b229581bd878519c
Opcode Fuzzy Hash: e2f70bdb7614c13ac1d1ed27f86cfebf576c1c41d2762d4cf0bd4c9359251953
Instruction Fuzzy Hash: 3D826A3220B68086FB64AB6581583BE37B1FB41B88F64940ADE9B0B7D5DF37C856C351

Function 0000026CE85CD440 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 834COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CD4BB
_Mpunct.LIBCPMT ref: 0000026CE85CD4FC
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CD510

Part of subcall function 0000026CE85CDE7C: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CDED4
Part of subcall function 0000026CE85CDE7C: _Mpunct.LIBCPMT ref: 0000026CE85CDF16
Part of subcall function 0000026CE85CDE7C: std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CDF24

Strings

0123456789-+Ee, xrefs: 0000026CE85CD551, 0000026CE85CD713, 0000026CE85CD8A4, 0000026CE85CDAB6, 0000026CE85CDD8A

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID: 0123456789-+Ee
API String ID: 4161885152-1347306980
Opcode ID: 4f2a568fd0fa06215ae3915de8a3ab2ffbe2514b51c3d54fb028b4f6270e0670
Instruction ID: 780c584e590a731734c3831d1487e12aa4f52418650c8d7145e4d48b010ef1a3
Opcode Fuzzy Hash: 4f2a568fd0fa06215ae3915de8a3ab2ffbe2514b51c3d54fb028b4f6270e0670
Instruction Fuzzy Hash: D272943660F68489FB56AB6581583BC3BB1A743B84F748046CE9BA7796CF37C456CB00

Function 0000026CE85E0038 Relevance: 9.5, APIs: 6, Instructions: 543COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E00C5

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D3964: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3985
Part of subcall function 0000026CE85D3964: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D39AA
Part of subcall function 0000026CE85D3964: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D39D4
Part of subcall function 0000026CE85D3964: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3A7E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E00E2
_Mpunct.LIBCPMT ref: 0000026CE85E011B
_Mpunct.LIBCPMT ref: 0000026CE85E0235
_Mpunct.LIBCPMT ref: 0000026CE85E024E
_Mpunct.LIBCPMT ref: 0000026CE85E02BE

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: LockitMpunctstd::_$Lockit::_Lockit::~_std::ios_base::getloc$std::locale::locale
String ID:
API String ID: 947048306-0
Opcode ID: 0cea55ac70b9b642a92812e7ac831c00b23b20cabd8d84924705d018515a6540
Instruction ID: bdc253043b95d721f56834ee3dda787abddc0afc13d2ff76ff386b499d881c83
Opcode Fuzzy Hash: 0cea55ac70b9b642a92812e7ac831c00b23b20cabd8d84924705d018515a6540
Instruction Fuzzy Hash: FC32BF3260EB9086FB15AF25C8493FD73B1F794B88F644111EACA17A99EF3AC585C310

Function 0000026CE85DF84C Relevance: 9.5, APIs: 6, Instructions: 543COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DF8D9

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D3704: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3725
Part of subcall function 0000026CE85D3704: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D374A
Part of subcall function 0000026CE85D3704: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3774
Part of subcall function 0000026CE85D3704: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D381E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DF8F6
_Mpunct.LIBCPMT ref: 0000026CE85DF92F
_Mpunct.LIBCPMT ref: 0000026CE85DFA49
_Mpunct.LIBCPMT ref: 0000026CE85DFA62
_Mpunct.LIBCPMT ref: 0000026CE85DFAD2

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: LockitMpunctstd::_$Lockit::_Lockit::~_std::ios_base::getloc$std::locale::locale
String ID:
API String ID: 947048306-0
Opcode ID: 57225d8178d5a7826e752d5fdcf6b896c1117a65cce17eeac9dccfc814194e7f
Instruction ID: 0e12588422194cbc6aaa4622a5ef3324a4ffcddfaff4bddf92b89c85d102e194
Opcode Fuzzy Hash: 57225d8178d5a7826e752d5fdcf6b896c1117a65cce17eeac9dccfc814194e7f
Instruction Fuzzy Hash: 4A328D3260AA9085FB51AF25D8493FA77B1F744B8CF649111EECA17AD9EF3AC591C300

Function 0000026CE85EB074 Relevance: 9.5, APIs: 6, Instructions: 524COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85EB0F5

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85E85C8: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E85E9
Part of subcall function 0000026CE85E85C8: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E860E
Part of subcall function 0000026CE85E85C8: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8638
Part of subcall function 0000026CE85E85C8: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E86E2

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85EB112
_Mpunct.LIBCPMT ref: 0000026CE85EB14E
_Mpunct.LIBCPMT ref: 0000026CE85EB28A
_Mpunct.LIBCPMT ref: 0000026CE85EB2A6

Part of subcall function 0000026CE85C93A0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 0000026CE85C93CD
Part of subcall function 0000026CE85C93A0: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 0000026CE85C93F4
Part of subcall function 0000026CE85C93A0: char_traits.LIBCPMTD ref: 0000026CE85C9482

_Mpunct.LIBCPMT ref: 0000026CE85EB2F8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: LockitMpunctstd::_$Lockit::_Lockit::~_Mtx_guardMtx_guard::~_std::ios_base::getloc$char_traitsstd::locale::locale
String ID:
API String ID: 320299097-0
Opcode ID: 1e38ba58a473fc653b5fb7d7208e81ddcca2ae6904e5fc9c9f9c1b4a438aa956
Instruction ID: 2ab583ac3442954a3cbdca7f28dd40d3021283ef03e5ca88a0e8f17a5b32eec1
Opcode Fuzzy Hash: 1e38ba58a473fc653b5fb7d7208e81ddcca2ae6904e5fc9c9f9c1b4a438aa956
Instruction Fuzzy Hash: 9D328E3260EBC485FB219F25C8483ED3771F355B88F649112DA8A27B9ADF3AC685C351

Function 0000026CE85F7644 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85F766E

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_malloc_crt.LIBCMT ref: 0000026CE85F76AE
_invoke_watson.LIBCMT ref: 0000026CE85F776C

Part of subcall function 0000026CE85FA508: _call_reportfault.LIBCMT ref: 0000026CE85FA530

_invoke_watson.LIBCMT ref: 0000026CE85F7782

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction ID: ce0a3f8ff547a809f61503e6d98d67aaf8f7317e4aa03db7ab5914a8c118e5d6
Opcode Fuzzy Hash: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction Fuzzy Hash: C331C73272768445FB15BB25D80E7AD76A1E785BC8F688125DE8F4B79ADF3AC0018700

Function 0000026CE85DD734 Relevance: 4.8, APIs: 3, Instructions: 283COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DD7D0
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DD84C
_Mpunct.LIBCPMT ref: 0000026CE85DD886

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID:
API String ID: 4161885152-0
Opcode ID: 94a13e67048d1d6a9d8e37f184acf902a8c7ba278c4ab9bc088bfc03991e9617
Instruction ID: efed210bc34b15c8106a21d6c5c070ccd4598d66088ef5c1f2f7949c7b540d4d
Opcode Fuzzy Hash: 94a13e67048d1d6a9d8e37f184acf902a8c7ba278c4ab9bc088bfc03991e9617
Instruction Fuzzy Hash: 82C1B232B0BA808AFB12AF75D4093FD73B1AB55B48F544111DE8A6B689EF37D549C340

Function 0000026CE85DDB04 Relevance: 4.8, APIs: 3, Instructions: 283COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DDBA0
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85DDC1C
_Mpunct.LIBCPMT ref: 0000026CE85DDC56

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getloc$Mpunct
String ID:
API String ID: 4161885152-0
Opcode ID: f00c66f29c94808db36d4885cf7ef90ee5ec9d3b98dc7c305995b2eb568d4440
Instruction ID: e49227eda98dcc8ddee4d6940cbb939e73b55c4ec4924774e86e1310553a3ae3
Opcode Fuzzy Hash: f00c66f29c94808db36d4885cf7ef90ee5ec9d3b98dc7c305995b2eb568d4440
Instruction Fuzzy Hash: 92C1A23270BA808AFB11AF75D4093FD77B1AB55B88F544111DE8A67698EF3AC44AC340

Function 0000026CE85DA030 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40A5
Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40CA
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D40F4
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D419E

_Mpunct.LIBCPMT ref: 0000026CE85DA08B

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000026CE85DA0C6, 0000026CE85DA413

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1602828969-2799312399
Opcode ID: 7dbf2398d83a6101ae2da8d3b390b5f264cdba2bf70ca7d8335ce0f5fc087c69
Instruction ID: dd4e5685ca2fc395ebc6739846b94098a78049841422239640a69e4e151a7acf
Opcode Fuzzy Hash: 7dbf2398d83a6101ae2da8d3b390b5f264cdba2bf70ca7d8335ce0f5fc087c69
Instruction Fuzzy Hash: 60128E3664B68085FB22EB65D8587BF37B2A751B88F649011DE8A1B7C9DF27C885C340

Function 0000026CE85DA630 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41D5
Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41FA
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4224
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D42CE

_Mpunct.LIBCPMT ref: 0000026CE85DA68B

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000026CE85DA6C6, 0000026CE85DAA13

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1602828969-2799312399
Opcode ID: 7b3c67ad858661928af9faacf2c89209e5ecf5b10ac5bc819cddf012cd7f63ad
Instruction ID: 0727b7421a5f90d62dedc2581bc78e872609c76bee24fe5de2391097bc49a9d3
Opcode Fuzzy Hash: 7b3c67ad858661928af9faacf2c89209e5ecf5b10ac5bc819cddf012cd7f63ad
Instruction Fuzzy Hash: 13128E3674B68085FB22AB65D8143BF37B1E751B88F658115DE8A1B7C9DF2BC886C340

Function 0000026CE85CE9E8 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA25
Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA4A
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCA74
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCB1E

_Mpunct.LIBCPMT ref: 0000026CE85CEA42

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000026CE85CEA79, 0000026CE85CED7D

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1602828969-2799312399
Opcode ID: eac750de68e4787b266f5ef38c7d335a81a2325707c2c7f5fddab37cd7e7ff26
Instruction ID: 4a6cb5f2e1668fdc86047ceab8b9212e26881301cdbdf03f26b57b7e41e6fd84
Opcode Fuzzy Hash: eac750de68e4787b266f5ef38c7d335a81a2325707c2c7f5fddab37cd7e7ff26
Instruction Fuzzy Hash: 1712723270BA8089FB51AA75C0583BC3BB1A741B58F784556CE8B1B796CF3BC846CB50

Function 0000026CE68A7180 Relevance: 3.9, APIs: 2, Instructions: 885COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE68A82AF

Part of subcall function 0000026CE68A3424: _getptd.LIBCMT ref: 0000026CE68A343A
Part of subcall function 0000026CE68A3424: __updatetlocinfo.LIBCMT ref: 0000026CE68A346F
Part of subcall function 0000026CE68A3424: __updatetmbcinfo.LIBCMT ref: 0000026CE68A3496

_malloc_crt.LIBCMT ref: 0000026CE68A82D6

Part of subcall function 0000026CE68A5C40: malloc.LIBCMT ref: 0000026CE68A5C6B

Part of subcall function 0000026CE68A9A24: _errno.LIBCMT ref: 0000026CE68A9A3C
Part of subcall function 0000026CE68A9A24: _invalid_parameter_noinfo.LIBCMT ref: 0000026CE68A9A48

Part of subcall function 0000026CE68A9A24: _errno.LIBCMT ref: 0000026CE68A9A75

Part of subcall function 0000026CE68B22F0: _errno.LIBCMT ref: 0000026CE68B230C
Part of subcall function 0000026CE68B22F0: _invalid_parameter_noinfo.LIBCMT ref: 0000026CE68B2318

Part of subcall function 0000026CE68B22F0: _errno.LIBCMT ref: 0000026CE68B234B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crtmalloc
String ID:
API String ID: 2296220707-0
Opcode ID: 6aa674c8055749afedaf64fe2c3a3141dc6f8a211f07435de9dbe9f590e5f553
Instruction ID: 78e022d127ab1be2875fd971b5334d7100c9600e173e1ff578ce9eb3d2c67108
Opcode Fuzzy Hash: 6aa674c8055749afedaf64fe2c3a3141dc6f8a211f07435de9dbe9f590e5f553
Instruction Fuzzy Hash: D542C031674F084BEBB8FE2A98493BA73E1FB56314F70462E98DAC21C7DE279445C641

Function 0000026CE68898D8 Relevance: 2.2, APIs: 1, Instructions: 691COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688394D
Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883972

_Mpunct.LIBCPMT ref: 0000026CE6889933

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: 009ce831dae9a5ce6a7a4ddd12d0b70f0d4bd9197f41654b24551dadfc115c49
Instruction ID: 12e099bb82033436be2502998e3abe8ca8b29009bf2121f28703ce0133ceb691
Opcode Fuzzy Hash: 009ce831dae9a5ce6a7a4ddd12d0b70f0d4bd9197f41654b24551dadfc115c49
Instruction Fuzzy Hash: 88329130628A598FEF74BB1D809477977F1FB56300FB4419AD48ACB287D62BD846C781

Function 0000026CE6889ED8 Relevance: 2.2, APIs: 1, Instructions: 691COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883A7D
Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883AA2

_Mpunct.LIBCPMT ref: 0000026CE6889F33

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: d515880b7b93e990b9d568f8ee64ddb0c755f866ce721ed4f019a15d56ae3cde
Instruction ID: c6648523b7b071101b293a979acbf9979d2958ecc01a833155bc15c03d0409cd
Opcode Fuzzy Hash: d515880b7b93e990b9d568f8ee64ddb0c755f866ce721ed4f019a15d56ae3cde
Instruction Fuzzy Hash: F6327434628A498BEB79FB19C09877973F1EF56300FB4415AD48ACB2C7DA2BD846C741

Function 0000026CE687E290 Relevance: 2.2, APIs: 1, Instructions: 662COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2CD
Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2F2

_Mpunct.LIBCPMT ref: 0000026CE687E2EA

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID:
API String ID: 2786813426-0
Opcode ID: f2428fd340c50561f6db4ff7a0457febc66b2a7363e2f288f65a24a427b2e275
Instruction ID: b253bd44685d62a6664374454ab92b242766dbd3d2a96454b4464e42ccb3931b
Opcode Fuzzy Hash: f2428fd340c50561f6db4ff7a0457febc66b2a7363e2f288f65a24a427b2e275
Instruction Fuzzy Hash: F622D730628B488FEB75FB19809C779B7F1EB56304F78429AD4D6CB197D623E8068781

Function 0000026CE85E41DC Relevance: 2.1, APIs: 1, Instructions: 618COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E4215

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CABE0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CABF9
Part of subcall function 0000026CE85CABE0: __int64.LIBCPMTD ref: 0000026CE85CAC12
Part of subcall function 0000026CE85CABE0: std::locale::_Getfacet.LIBCPMTD ref: 0000026CE85CAC29
Part of subcall function 0000026CE85CABE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CACDA

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$GetfacetLockit::_Lockit::~___int64std::ios_base::getlocstd::locale::_std::locale::locale
String ID:
API String ID: 4021809434-0
Opcode ID: 6a765142226b2d9bac43f800b895823ec632b3642f1421cfc312e46ae7fa21ce
Instruction ID: cca580253b080f94a1d1fbe4b8a1335198781d2a4b7b7dbee4fd4d17c9696b0d
Opcode Fuzzy Hash: 6a765142226b2d9bac43f800b895823ec632b3642f1421cfc312e46ae7fa21ce
Instruction Fuzzy Hash: 5A426A7660EA8086FB24AF25DA483BD3771FB85B88F649102DF8A17B95CF3BC5558310

Function 0000026CE85E39CC Relevance: 2.1, APIs: 1, Instructions: 618COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E3A05

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D2EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2ED5
Part of subcall function 0000026CE85D2EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2EFA
Part of subcall function 0000026CE85D2EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2F24
Part of subcall function 0000026CE85D2EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2FCE

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::getlocstd::locale::locale
String ID:
API String ID: 824625536-0
Opcode ID: 67fd4645e13582e230cc2643c37768ccc5b68469e6477c4bf51e7c8c460bf56a
Instruction ID: 299f38563cd686ba5fcf7411b0f219ee005478d944ceef25f207fc14c2df132d
Opcode Fuzzy Hash: 67fd4645e13582e230cc2643c37768ccc5b68469e6477c4bf51e7c8c460bf56a
Instruction Fuzzy Hash: 77427A7260EA8086FB24AB26D9483BD3771FB85B84F248111DEDA17BA5DF3BC595C310

Function 0000026CE85EC198 Relevance: 2.1, APIs: 1, Instructions: 572COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85EC1D1

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CC674: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC695
Part of subcall function 0000026CE85CC674: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC6BA
Part of subcall function 0000026CE85CC674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC6E4
Part of subcall function 0000026CE85CC674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC78E

Part of subcall function 0000026CE85E94D4: _Stollx.LIBCPMT ref: 0000026CE85E96DC

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Stollxstd::ios_base::getlocstd::locale::locale
String ID:
API String ID: 3095835090-0
Opcode ID: 43bbc00d5fdc2421479fa4bdb99ccad7ee23ed2110236d7a3546eda68dabee41
Instruction ID: 4754fb3174c20256582f8f5d1ef2e33bab4a3fe870734b3cf44f3649efe1caab
Opcode Fuzzy Hash: 43bbc00d5fdc2421479fa4bdb99ccad7ee23ed2110236d7a3546eda68dabee41
Instruction Fuzzy Hash: 1442AE7261EA8085FB14AB29C9883BD37B1F785B84F248206DFDA07796CF3BD8558710

Function 0000026CE85F9C1C Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 0000026CE85F9C4D

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0ca195e7d1b074bf2f4b5ce76eaeb73d5cf53f4307d2a5ac3e1115a18521518f
Instruction ID: b04f6676c53ecc3901d2b77d2eeb63ba73065731e79d54f2aee05234ec27944b
Opcode Fuzzy Hash: 0ca195e7d1b074bf2f4b5ce76eaeb73d5cf53f4307d2a5ac3e1115a18521518f
Instruction Fuzzy Hash: 7DE01271A2BA45C1F750BB52FC8EB7137B4B358319FB11541C5AD86764CE7B80D58700

Function 0000026CE85F7608 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0000026CE85F7613

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 11be26dbcfdda8cd03b6d2b1e8fe4740f292b6f7e10c13c7d9c1ea55355ea2d2
Instruction ID: 9048c5691a3c7f1fba5bc6efc8f157b75c0d284556d1e384cd9770514acaeef1
Opcode Fuzzy Hash: 11be26dbcfdda8cd03b6d2b1e8fe4740f292b6f7e10c13c7d9c1ea55355ea2d2
Instruction Fuzzy Hash: 96D0126262D68482DB3A6BBA583613A3A74D319B10F6C40358F9745291891F449A8304

Function 0000026CE860F0A8 Relevance: .2, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9023e75844d7579a1f174f03874c0f8af64d5fc2987f99361e3b0206e8ada974
Instruction ID: e165c281c5e9531893b4ec4efdd05549b3311bc42284f0922282758be915e45c
Opcode Fuzzy Hash: 9023e75844d7579a1f174f03874c0f8af64d5fc2987f99361e3b0206e8ada974
Instruction Fuzzy Hash: 9D9124FB56F6C40AF2726A64586F2AD3FB8E766B14F6D408AC7C1C72C3D5470806871A

Function 0000026CE68BA47E Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 00064e2cae6b781ccd039dc32df355349fc432545892e5035897992754b165b2
Instruction ID: 992fb5e313e18c5dd878982a1b618f2d2883309f3aa1398e8dd3f59c2adaef12
Opcode Fuzzy Hash: 00064e2cae6b781ccd039dc32df355349fc432545892e5035897992754b165b2
Instruction Fuzzy Hash: 29318F352386098AFB78FA62985E3BE73E1E752300F30852B98CBC5487EE279506C741

Function 0000026CE860F0D8 Relevance: .0, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837f9116cbe3f5bb14f2c0012b83809750004cebf97b73b88b754a310a23b8da
Instruction ID: f7843c952f92f60528cfdc9367ba4c47eb1407ebbda75791c2000ca190f84de6
Opcode Fuzzy Hash: 837f9116cbe3f5bb14f2c0012b83809750004cebf97b73b88b754a310a23b8da
Instruction Fuzzy Hash: A2B0929B51E98209F1B0180408BE2A627DAAB2AA28F2990498A828B2C2E6070C060306

Function 0000026CE68A3018 Relevance: 24.2, APIs: 16, Instructions: 157
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.LIBCMT ref: 0000026CE68A3026
malloc.LIBCMT ref: 0000026CE68A3032

Part of subcall function 0000026CE68A1B50: _FF_MSGBANNER.LIBCMT ref: 0000026CE68A1B80
Part of subcall function 0000026CE68A1B50: _NMSG_WRITE.LIBCMT ref: 0000026CE68A1B8A
Part of subcall function 0000026CE68A1B50: _callnewh.LIBCMT ref: 0000026CE68A1BBE
Part of subcall function 0000026CE68A1B50: _errno.LIBCMT ref: 0000026CE68A1BC9
Part of subcall function 0000026CE68A1B50: _errno.LIBCMT ref: 0000026CE68A1BD4

_CxxThrowException.LIBCMT ref: 0000026CE68A307B
_heap_init.LIBCMT ref: 0000026CE68A3096
_mtinit.LIBCMT ref: 0000026CE68A30A6
_RTC_Initialize.LIBCMT ref: 0000026CE68A30B6
__crtGetEnvironmentStringsA.LIBCMT ref: 0000026CE68A30C8

Part of subcall function 0000026CE68AD9C8: _malloc_crt.LIBCMT ref: 0000026CE68ADA48
Part of subcall function 0000026CE68AD9C8: free.LIBCMT ref: 0000026CE68ADA80

_ioinit.LIBCMT ref: 0000026CE68A30D4

Part of subcall function 0000026CE68AA4B4: _lock.LIBCMT ref: 0000026CE68AA4DE
Part of subcall function 0000026CE68AA4B4: _calloc_crt.LIBCMT ref: 0000026CE68AA4F2

_setenvp.LIBCMT ref: 0000026CE68A30ED
_cinit.LIBCMT ref: 0000026CE68A30F8
_ioterm.LIBCMT ref: 0000026CE68A310C

Part of subcall function 0000026CE68AA7E4: free.LIBCMT ref: 0000026CE68AA835

_ioterm.LIBCMT ref: 0000026CE68A3144
_calloc_crt.LIBCMT ref: 0000026CE68A3186

Part of subcall function 0000026CE68A5BC0: _calloc_impl.LIBCMT ref: 0000026CE68A5BEE

_initptd.LIBCMT ref: 0000026CE68A31AE
free.LIBCMT ref: 0000026CE68A31C2

Part of subcall function 0000026CE68A16CC: _errno.LIBCMT ref: 0000026CE68A16EC

_freeptd.LIBCMT ref: 0000026CE68A31D3

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: _errnofree$_callnewh_calloc_crt_ioterm$EnvironmentExceptionInitializeStringsThrow__crt_calloc_impl_cinit_freeptd_heap_init_initptd_ioinit_lock_malloc_crt_mtinit_setenvpmalloc
String ID:
API String ID: 712202392-0
Opcode ID: 3899b92c9def8d1737fd4a241c48e478abdd423faa6e3756210bf445b346c25b
Instruction ID: 47660ff43ca4ca4b731106d703da1ac666a31054613a02d07901aa5d7e7903ed
Opcode Fuzzy Hash: 3899b92c9def8d1737fd4a241c48e478abdd423faa6e3756210bf445b346c25b
Instruction Fuzzy Hash: CE5107306247064BFAF4B7B7995D7B922B5EB76340F30052BAD86C61D3EA2BC8418712

Function 0000026CE85FB0E0 Relevance: 18.1, APIs: 12, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32 ref: 0000026CE85FB0F1
free.LIBCMT ref: 0000026CE85FB10E

Part of subcall function 0000026CE85F1E24: HeapFree.KERNEL32 ref: 0000026CE85F1E3A
Part of subcall function 0000026CE85F1E24: _errno.LIBCMT ref: 0000026CE85F1E44
Part of subcall function 0000026CE85F1E24: GetLastError.KERNEL32 ref: 0000026CE85F1E4C

free.LIBCMT ref: 0000026CE85FB123
free.LIBCMT ref: 0000026CE85FB144
free.LIBCMT ref: 0000026CE85FB159
free.LIBCMT ref: 0000026CE85FB16D
free.LIBCMT ref: 0000026CE85FB179
free.LIBCMT ref: 0000026CE85FB1A4
EncodePointer.KERNEL32 ref: 0000026CE85FB1AC
free.LIBCMT ref: 0000026CE85FB1C5
free.LIBCMT ref: 0000026CE85FB1DE
free.LIBCMT ref: 0000026CE85FB20F

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction ID: 21f793191116e0f3defdf0e67b1f26676d6f914d85995b0aa72c3406a8f15119
Opcode Fuzzy Hash: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction Fuzzy Hash: C0314D7166BA80C1FE55BB51F86E3B833B8AB54794F380225DADB8A2D5DF3F84448701

Function 0000026CE85E2F0C Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E2F48

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D2EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2ED5
Part of subcall function 0000026CE85D2EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2EFA
Part of subcall function 0000026CE85D2EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2F24
Part of subcall function 0000026CE85D2EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2FCE

Strings

c, xrefs: 0000026CE85E337B
%H : %M, xrefs: 0000026CE85E30B2
%d / %m / %y, xrefs: 0000026CE85E33B1
%I : %M : %S %p, xrefs: 0000026CE85E33F3
%m / %d / %y, xrefs: 0000026CE85E304D
:AM:am:PM:pm, xrefs: 0000026CE85E3403
%H : %M : S, xrefs: 0000026CE85E3156
%b %d %H : %M : %S %Y, xrefs: 0000026CE85E32A4

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::getlocstd::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 824625536-3998755201
Opcode ID: 9ea7233a1195fdad9958adce2f8bb786a2981300ba8746fa4110a12b4cbdb550
Instruction ID: d0ea431479ff68badc508799dcc9686744083913e7c45246985550e84f449339
Opcode Fuzzy Hash: 9ea7233a1195fdad9958adce2f8bb786a2981300ba8746fa4110a12b4cbdb550
Instruction Fuzzy Hash: 30E16D3251EB8486FB649F24E8487FD77B0F785788F644215EACA07AA9DF3AC645C700

Function 0000026CE85E346C Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E34A8

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CABE0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CABF9
Part of subcall function 0000026CE85CABE0: __int64.LIBCPMTD ref: 0000026CE85CAC12
Part of subcall function 0000026CE85CABE0: std::locale::_Getfacet.LIBCPMTD ref: 0000026CE85CAC29
Part of subcall function 0000026CE85CABE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CACDA

Strings

%H : %M, xrefs: 0000026CE85E3612
c, xrefs: 0000026CE85E38DB
%d / %m / %y, xrefs: 0000026CE85E3911
%I : %M : %S %p, xrefs: 0000026CE85E3953
%m / %d / %y, xrefs: 0000026CE85E35AD
:AM:am:PM:pm, xrefs: 0000026CE85E3963
%H : %M : S, xrefs: 0000026CE85E36B6
%b %d %H : %M : %S %Y, xrefs: 0000026CE85E3804

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$GetfacetLockit::_Lockit::~___int64std::ios_base::getlocstd::locale::_std::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 4021809434-3998755201
Opcode ID: 8e1deff4405f140ca104af93d567ca82f55d7d783d531e69af03a14ea99d4600
Instruction ID: 2d7db27f2412d8a2555fee1ea1857882c8e4633e44886b1d0ff88fc2907b1dc2
Opcode Fuzzy Hash: 8e1deff4405f140ca104af93d567ca82f55d7d783d531e69af03a14ea99d4600
Instruction Fuzzy Hash: 6CE16D7251EA8486FB649F24E8483FD77B1F784788F644205EACA47BA9DF3AC645C700

Function 0000026CE85EBC38 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85EBC74

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CC674: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC695
Part of subcall function 0000026CE85CC674: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC6BA
Part of subcall function 0000026CE85CC674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC6E4
Part of subcall function 0000026CE85CC674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC78E

Strings

%H : %M, xrefs: 0000026CE85EBDDE
c, xrefs: 0000026CE85EC0A7
%d / %m / %y, xrefs: 0000026CE85EC0DD
%I : %M : %S %p, xrefs: 0000026CE85EC11F
%m / %d / %y, xrefs: 0000026CE85EBD79
:AM:am:PM:pm, xrefs: 0000026CE85EC12F
%H : %M : S, xrefs: 0000026CE85EBE82
%b %d %H : %M : %S %Y, xrefs: 0000026CE85EBFD0

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::getlocstd::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 824625536-3998755201
Opcode ID: c37271404475d0014721bef1fed1c0e1cecc04706b38c11d20b1fc59747c924a
Instruction ID: 283372e0f9d7bd6c531a661917c0a39a812ecc6bdc99963a5a19811c14ac1b55
Opcode Fuzzy Hash: c37271404475d0014721bef1fed1c0e1cecc04706b38c11d20b1fc59747c924a
Instruction Fuzzy Hash: C9E19F7251EB8486FB649F24E8483BD77B0F785788F244206EACA17B59DF3AC645CB01

Function 0000026CE85D3CF4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3D15

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3D3A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3D64
messages.LIBCPMT ref: 0000026CE85D3DBD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3DD4
_CxxThrowException.LIBCMT ref: 0000026CE85D3DE5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3E0E

Strings

bad cast, xrefs: 0000026CE85D3DC8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 783429eb793c2f2f50d0740cc6b0d3dbcf1faffe9df41ccb9df6b9a803999d4c
Instruction ID: 8aa79ed0f16d92be02d00a6595211ef2986e8f3d12211317901024a265dd7f54
Opcode Fuzzy Hash: 783429eb793c2f2f50d0740cc6b0d3dbcf1faffe9df41ccb9df6b9a803999d4c
Instruction Fuzzy Hash: D7315E3220FA4081FA11FB55E4492BA7771E794BA0F780222DADA476F9EE37C845CB00

Function 0000026CE85D2D84 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2DA5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2DCA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2DF4
collate.LIBCPMT ref: 0000026CE85D2E4D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D2E64
_CxxThrowException.LIBCMT ref: 0000026CE85D2E75
std::_Facet_Register.LIBCPMT ref: 0000026CE85D2E93
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2E9E

Strings

bad cast, xrefs: 0000026CE85D2E58

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 1ff498fc3fba5fdf49fdedaaaf28a20aa44f259ac781903afc3c6c16cf0d7928
Instruction ID: 744cfa8cdc56a0add17f56f0532abf46ed14ced94c83c067f5ad5806f7419a85
Opcode Fuzzy Hash: 1ff498fc3fba5fdf49fdedaaaf28a20aa44f259ac781903afc3c6c16cf0d7928
Instruction Fuzzy Hash: 8E317E7220FA4081FA11FB55E4492BA7370F794BA4F690622DADE476E9DF37D842C700

Function 0000026CE85D3E24 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3E45

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3E6A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3E94
messages.LIBCPMT ref: 0000026CE85D3EED
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3F04
_CxxThrowException.LIBCMT ref: 0000026CE85D3F15
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3F33
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3F3E

Strings

bad cast, xrefs: 0000026CE85D3EF8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 48616abfac1a981897439173c93a6e5aaf7991275bd66df3e03a16717abd7810
Instruction ID: b2033556831db78c3604883280f8b8426d2cfb16981aaea42ae41743b58f5fac
Opcode Fuzzy Hash: 48616abfac1a981897439173c93a6e5aaf7991275bd66df3e03a16717abd7810
Instruction Fuzzy Hash: 4E31403221FA4181FA11BB55E4492BA7770F794BA4F740222DADA437E9EF7BC845C700

Function 0000026CE85D2EB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2ED5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2EFA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2F24
ctype.LIBCPMT ref: 0000026CE85D2F7D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D2F94
_CxxThrowException.LIBCMT ref: 0000026CE85D2FA5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D2FC3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2FCE

Strings

bad cast, xrefs: 0000026CE85D2F88

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 757613215-3145022300
Opcode ID: 27ff36a41daa2afd465fce565ffe5753e683ad286d1df17b1f83c21b9b33a9ce
Instruction ID: 61584996c5d14ead360616fefbbd9dbc9f59e188e6e6ebe711c73a47369a5a13
Opcode Fuzzy Hash: 27ff36a41daa2afd465fce565ffe5753e683ad286d1df17b1f83c21b9b33a9ce
Instruction Fuzzy Hash: 3031723121FB4181FA10BB55E4492BA7770F794BA4F654A22DADE436EDDF3BD4428700

Function 0000026CE85D3F54 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3F75

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3F9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3FC4
messages.LIBCPMT ref: 0000026CE85D401D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D4034
_CxxThrowException.LIBCMT ref: 0000026CE85D4045
std::_Facet_Register.LIBCPMT ref: 0000026CE85D4063
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D406E

Strings

bad cast, xrefs: 0000026CE85D4028

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: e44b50d4e94eb0d1351846dbd8529780eaeaffd3bd116e536ad6d8b979878f95
Instruction ID: 244c7dc5ef19dcf4c579cdc7e2928b10c21033d88c116bf2c50d90f9f86e4632
Opcode Fuzzy Hash: e44b50d4e94eb0d1351846dbd8529780eaeaffd3bd116e536ad6d8b979878f95
Instruction Fuzzy Hash: C1317E3221BB4181FA10FB55E5492BA7370E790BA4F780222DADE476E9DF3BC845C701

Function 0000026CE85D2FE4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3005

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D302A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3054
messages.LIBCPMT ref: 0000026CE85D30AD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D30C4
_CxxThrowException.LIBCMT ref: 0000026CE85D30D5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D30F3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D30FE

Strings

bad cast, xrefs: 0000026CE85D30B8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: b569cdc1653f4c7f6180cbb6e0faa1c39ac808a66fab2fc048e17dcba9d08f51
Instruction ID: bc6ee2cff924ef323dd2946cfe4540b6f2e253d1f05c671a05856c4605f59309
Opcode Fuzzy Hash: b569cdc1653f4c7f6180cbb6e0faa1c39ac808a66fab2fc048e17dcba9d08f51
Instruction Fuzzy Hash: ED31303261FB4181FA11FB55E4592BA7770E794BA4F780222DADA436F9EE37C846C700

Function 0000026CE85D4084 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40A5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40CA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D40F4
numpunct.LIBCPMT ref: 0000026CE85D414D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D4164
_CxxThrowException.LIBCMT ref: 0000026CE85D4175
std::_Facet_Register.LIBCPMT ref: 0000026CE85D4193
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D419E

Strings

bad cast, xrefs: 0000026CE85D4158

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4059195664-3145022300
Opcode ID: d94e50aa53ccc9d6944cd3aed90cdf3e84a64a3bd5255cb9728456337b3ddaed
Instruction ID: 330d23bb507101ae387421715f25dba0d7c227d76e19927feea10cc5fb4db108
Opcode Fuzzy Hash: d94e50aa53ccc9d6944cd3aed90cdf3e84a64a3bd5255cb9728456337b3ddaed
Instruction Fuzzy Hash: 35316D3221BB4081FA10FB55E9492BA7770F794BE4F785222DADA432E9DF27C842C701

Function 0000026CE85E8108 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8129

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E814E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8178
collate.LIBCPMT ref: 0000026CE85E81D1
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E81E8
_CxxThrowException.LIBCMT ref: 0000026CE85E81F9
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8217
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8222

Strings

bad cast, xrefs: 0000026CE85E81DC

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 4b7540098f8ea2fd8cb3a6c4dc7befb07f8a31645b2c4940871eb245c6e3b5b3
Instruction ID: f27e3bd94bb6549912b33b57fa744cd1930d9d6c313ed4a4cf7d6e003a859bef
Opcode Fuzzy Hash: 4b7540098f8ea2fd8cb3a6c4dc7befb07f8a31645b2c4940871eb245c6e3b5b3
Instruction Fuzzy Hash: F3314E3221FB40C1FE15EB55E8492B97771E794BE4F780222DADA536E9DE37C8418710

Function 0000026CE85D3114 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3135

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D315A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3184
messages.LIBCPMT ref: 0000026CE85D31DD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D31F4
_CxxThrowException.LIBCMT ref: 0000026CE85D3205
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3223
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D322E

Strings

bad cast, xrefs: 0000026CE85D31E8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: ad4db0a7af812267d7f8cad6930e3dc199e4210e7b6ad20d02838aa8ea755007
Instruction ID: 02ef77d8dbe3fac4fd9b0843edae9ffc5dc2175ccc6d119a981a3cad34d0b36a
Opcode Fuzzy Hash: ad4db0a7af812267d7f8cad6930e3dc199e4210e7b6ad20d02838aa8ea755007
Instruction Fuzzy Hash: D0315F3261FB4181FA11BB55E8492BA7770E790BA4F281222DADA472F9EE37C441C700

Function 0000026CE85D41B4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41D5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41FA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4224
numpunct.LIBCPMT ref: 0000026CE85D427D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D4294
_CxxThrowException.LIBCMT ref: 0000026CE85D42A5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D42C3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D42CE

Strings

bad cast, xrefs: 0000026CE85D4288

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4059195664-3145022300
Opcode ID: 1fe0c26a9036abef5ee95c4ac4b3fdedf737f9338d7163a728943c57dc64d707
Instruction ID: ae3387029dc321dd87e933f350b0e22243f963826229f2721dc3baa7e0984122
Opcode Fuzzy Hash: 1fe0c26a9036abef5ee95c4ac4b3fdedf737f9338d7163a728943c57dc64d707
Instruction Fuzzy Hash: 9E314C3221FA40D1FE11BB55E5482BA7770E794BA0F684222DADA436E9DE2BC8468701

Function 0000026CE85D3244 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3265

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D328A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D32B4
messages.LIBCPMT ref: 0000026CE85D330D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3324
_CxxThrowException.LIBCMT ref: 0000026CE85D3335
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3353
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D335E

Strings

bad cast, xrefs: 0000026CE85D3318

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: d82304bf4a96c8aa3365fbec0ce9b6afb946fba8665589bd6e4ea4bbafcdc822
Instruction ID: a0c314ae80b0d4497e334434fb6987bd80e79385e1902f9414ec5bcdeb77aee2
Opcode Fuzzy Hash: d82304bf4a96c8aa3365fbec0ce9b6afb946fba8665589bd6e4ea4bbafcdc822
Instruction Fuzzy Hash: CB316F3261FA41C1FE10BB55E5492BA7770E790BA0F680222DADA436F9EF37C841C700

Function 0000026CE85E8238 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8259

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E827E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E82A8
messages.LIBCPMT ref: 0000026CE85E8301
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E8318
_CxxThrowException.LIBCMT ref: 0000026CE85E8329
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8347
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8352

Strings

bad cast, xrefs: 0000026CE85E830C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: f6e975c9ed1fc811ddeed3bf09c1872f6a5632ab065b9bea6ee0b1db81a6e053
Instruction ID: e58075772238c8fb058f8761815f27f83ae00616c401565d2a075aa08207cf8a
Opcode Fuzzy Hash: f6e975c9ed1fc811ddeed3bf09c1872f6a5632ab065b9bea6ee0b1db81a6e053
Instruction Fuzzy Hash: EB316D3221FA4081FE11AB55E8482B97771F794BA4F680222DAEF536E9DF37C841C700

Function 0000026CE85E8368 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8389

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E83AE
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E83D8
messages.LIBCPMT ref: 0000026CE85E8431
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E8448
_CxxThrowException.LIBCMT ref: 0000026CE85E8459
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8477
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8482

Strings

bad cast, xrefs: 0000026CE85E843C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 5a55c19257780c8c169a156cca45b48a9cb7959a6ebe7d38ac67adaa113ab4e8
Instruction ID: 5321760b5abd00d7cc6125d76b800c1c320a0047b91acd02e2a60fa5846322f7
Opcode Fuzzy Hash: 5a55c19257780c8c169a156cca45b48a9cb7959a6ebe7d38ac67adaa113ab4e8
Instruction Fuzzy Hash: C7317E3221FB4081FA11BB15E8482B97771E794BA4F380222DAEA577E9DE3BC8418710

Function 0000026CE85D3374 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3395

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D33BA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D33E4
messages.LIBCPMT ref: 0000026CE85D343D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3454
_CxxThrowException.LIBCMT ref: 0000026CE85D3465
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3483
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D348E

Strings

bad cast, xrefs: 0000026CE85D3448

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: c69e9b5502f2b5cb16499cf93693c14af8bc71d40f19607121fcaa26e48801a2
Instruction ID: 33313cdbfa809508eac226643278b5592d8d52b5fcba64f054c69433e803977f
Opcode Fuzzy Hash: c69e9b5502f2b5cb16499cf93693c14af8bc71d40f19607121fcaa26e48801a2
Instruction Fuzzy Hash: E931423620FA4081FA11BB55E44D2BA7770F794BA4F640222DADA436EAEF3BC845C700

Function 0000026CE85D34A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D34C5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D34EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3514
messages.LIBCPMT ref: 0000026CE85D356D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3584
_CxxThrowException.LIBCMT ref: 0000026CE85D3595
std::_Facet_Register.LIBCPMT ref: 0000026CE85D35B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D35BE

Strings

bad cast, xrefs: 0000026CE85D3578

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: e92ebb4505384e37149a9af64b0ed7b997fd3b62a18224f75f4565cc40b02c60
Instruction ID: 3e2f62ba47ab72d83cf8496d49f6d1a291f3b9c13a195626fb9050dff7148a75
Opcode Fuzzy Hash: e92ebb4505384e37149a9af64b0ed7b997fd3b62a18224f75f4565cc40b02c60
Instruction Fuzzy Hash: 7C31523221FB4181FA10BB55E4492BA7770E794BA5F781222DAEB436F9EE37C445C700

Function 0000026CE85E8498 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E84B9

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E84DE
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8508
messages.LIBCPMT ref: 0000026CE85E8561
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E8578
_CxxThrowException.LIBCMT ref: 0000026CE85E8589
std::_Facet_Register.LIBCPMT ref: 0000026CE85E85A7
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E85B2

Strings

bad cast, xrefs: 0000026CE85E856C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: bb88f8af8f6ad0f94797e91181e4a5fede4ca1b0857083484043c23cb2229bcb
Instruction ID: 29ecd2406683f438c11077a04ce8b66e6405a1ea05436aca38776cb9906d1793
Opcode Fuzzy Hash: bb88f8af8f6ad0f94797e91181e4a5fede4ca1b0857083484043c23cb2229bcb
Instruction Fuzzy Hash: B031703220FA4491FA11BB15E84D2B97771F790BA4F784223DADA576E9DF3BC8418700

Function 0000026CE85CC544 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC565

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC58A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC5B4
messages.LIBCPMT ref: 0000026CE85CC60D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85CC624
_CxxThrowException.LIBCMT ref: 0000026CE85CC635
std::_Facet_Register.LIBCPMT ref: 0000026CE85CC653
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC65E

Strings

bad cast, xrefs: 0000026CE85CC618

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: ce52fca3fe3199b9ca64d09fb7b68cda433c6417c830918da4d940205a12b32f
Instruction ID: 110e122696ff5a625d99c237107e9d912cd5aae20dd1dc2b2a86b996c8e10112
Opcode Fuzzy Hash: ce52fca3fe3199b9ca64d09fb7b68cda433c6417c830918da4d940205a12b32f
Instruction Fuzzy Hash: 4A31723220BA4091FA10FB15E5492B97774E794BA4F781223DADA436E9DF37C842CF00

Function 0000026CE85E85C8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E85E9

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E860E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8638
moneypunct.LIBCPMT ref: 0000026CE85E8691
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E86A8
_CxxThrowException.LIBCMT ref: 0000026CE85E86B9
std::_Facet_Register.LIBCPMT ref: 0000026CE85E86D7
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E86E2

Strings

bad cast, xrefs: 0000026CE85E869C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 29cb517ef353edaf7fe96a55ad9e16f417422b8bc592340c9ae3e73a311cc7df
Instruction ID: 0be971ec8300dd78133c60c5b18072280b0fd3e2467768fa87e7f49873b81294
Opcode Fuzzy Hash: 29cb517ef353edaf7fe96a55ad9e16f417422b8bc592340c9ae3e73a311cc7df
Instruction Fuzzy Hash: EB31623221FA4082FA11BF55E84D2B97771F390BA4FA80212D6EA536E9DF37C4458700

Function 0000026CE85D35D4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D35F5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D361A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3644
messages.LIBCPMT ref: 0000026CE85D369D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D36B4
_CxxThrowException.LIBCMT ref: 0000026CE85D36C5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D36E3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D36EE

Strings

bad cast, xrefs: 0000026CE85D36A8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 536d951579794d9ac5848435dcda0d8056ecb28f286086e041b4dee6b5989298
Instruction ID: 0ba298adf4729cab63610eebbe5df36d6f5339eef9094954bfd9b9c833df47ed
Opcode Fuzzy Hash: 536d951579794d9ac5848435dcda0d8056ecb28f286086e041b4dee6b5989298
Instruction Fuzzy Hash: 7A314F3221BA4091FE11AB55E4492BAB770E794BA4F784222DA9A477F9EE3BC445C700

Function 0000026CE85CC674 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC695

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC6BA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC6E4
ctype.LIBCPMT ref: 0000026CE85CC73D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85CC754
_CxxThrowException.LIBCMT ref: 0000026CE85CC765
std::_Facet_Register.LIBCPMT ref: 0000026CE85CC783
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC78E

Strings

bad cast, xrefs: 0000026CE85CC748

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 757613215-3145022300
Opcode ID: df4a671e88b4901a954107639c9d9fabf74deb048c105a0cb1eb7e8a5d1e765f
Instruction ID: 18a142a8b39b06848479b82fbc2bfef25febcff5a3b2287827e3b2184baed0cd
Opcode Fuzzy Hash: df4a671e88b4901a954107639c9d9fabf74deb048c105a0cb1eb7e8a5d1e765f
Instruction Fuzzy Hash: C331503221FA4081FA11FB55E5592B977B0E394BA4F681227DADA436E9DF37C845CB00

Function 0000026CE85D3704 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3725

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D374A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3774
moneypunct.LIBCPMT ref: 0000026CE85D37CD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D37E4
_CxxThrowException.LIBCMT ref: 0000026CE85D37F5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3813
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D381E

Strings

bad cast, xrefs: 0000026CE85D37D8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: ae2b33eba0b5e10c670be5b46dedf71b670be409d592ec7623dc0068669dc4ac
Instruction ID: 56ae73c78c3b1e755f8e494b9eaa3075f4355faebdd14715076836eab898411c
Opcode Fuzzy Hash: ae2b33eba0b5e10c670be5b46dedf71b670be409d592ec7623dc0068669dc4ac
Instruction Fuzzy Hash: 84316F7220FA4081FA10BB55E5492BA7770F794BA4F784222DADA472F9EE37C8468700

Function 0000026CE85E86F8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8719

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E873E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8768
moneypunct.LIBCPMT ref: 0000026CE85E87C1
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E87D8
_CxxThrowException.LIBCMT ref: 0000026CE85E87E9
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8807
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8812

Strings

bad cast, xrefs: 0000026CE85E87CC

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 7e8749b240ba5670e75988a1d08956d1c9e00ca2f6b9f8a9a670e6f4b17f3c11
Instruction ID: 8545c2314f87c9ef4829d47b41f62636507c22e3974c307f22b5c748c371739e
Opcode Fuzzy Hash: 7e8749b240ba5670e75988a1d08956d1c9e00ca2f6b9f8a9a670e6f4b17f3c11
Instruction Fuzzy Hash: FC31603261FB4081FA11FB55E88D2B97771E790BA4F784222DADA536E9DE37C845C700

Function 0000026CE85CC7A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC7C5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC7EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC814
messages.LIBCPMT ref: 0000026CE85CC86D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85CC884
_CxxThrowException.LIBCMT ref: 0000026CE85CC895
std::_Facet_Register.LIBCPMT ref: 0000026CE85CC8B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC8BE

Strings

bad cast, xrefs: 0000026CE85CC878

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: cb7218c9b988feff46bbc91aa592dedbc53cea0b91ed73328e4fffe9f7b77c5a
Instruction ID: 035b3e4afc42a385c108cc6488ebdbc7c8810917ebecde044727f5e61c45e93c
Opcode Fuzzy Hash: cb7218c9b988feff46bbc91aa592dedbc53cea0b91ed73328e4fffe9f7b77c5a
Instruction Fuzzy Hash: 6A31753160FA4081FA10BB56E4592BA7374E794BA4F780213D6DE437E9DE3BC842CB00

Function 0000026CE85D3834 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3855

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D387A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D38A4
moneypunct.LIBCPMT ref: 0000026CE85D38FD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3914
_CxxThrowException.LIBCMT ref: 0000026CE85D3925
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3943
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D394E

Strings

bad cast, xrefs: 0000026CE85D3908

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 27282701b454dac3068bf00fab1c7e364559ed58de656c77c796e4e0c147b80e
Instruction ID: e9b61865726abc64dd7f23a81a28babf8d93dfe1cfd53a4b4287b9df74bee824
Opcode Fuzzy Hash: 27282701b454dac3068bf00fab1c7e364559ed58de656c77c796e4e0c147b80e
Instruction Fuzzy Hash: C8314F3261FA4081FA11BB55E4492BA7771F794BA4F784222DADB436F9DF3BC8468700

Function 0000026CE85CC8D4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC8F5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CC91A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC944
messages.LIBCPMT ref: 0000026CE85CC99D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85CC9B4
_CxxThrowException.LIBCMT ref: 0000026CE85CC9C5
std::_Facet_Register.LIBCPMT ref: 0000026CE85CC9E3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CC9EE

Strings

bad cast, xrefs: 0000026CE85CC9A8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: a319b8759b665be4c8045255bfd444d3c342c13c887630317bc6ad245192e08a
Instruction ID: b5ff1b80f7751a5758d11030647e2246abe630a0f43cc966564e55c57d493161
Opcode Fuzzy Hash: a319b8759b665be4c8045255bfd444d3c342c13c887630317bc6ad245192e08a
Instruction Fuzzy Hash: C1314B3220BA40C1FA51FB55E4492B97775F794BA4F680223DADA476E9DF2BD842CB00

Function 0000026CE85D3964 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3985

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D39AA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D39D4
moneypunct.LIBCPMT ref: 0000026CE85D3A2D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3A44
_CxxThrowException.LIBCMT ref: 0000026CE85D3A55
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3A73
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3A7E

Strings

bad cast, xrefs: 0000026CE85D3A38

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 8e39b244ec004d33a78bec66716c19fd785043de6809f57852e2fe2761deb095
Instruction ID: 3ba4943c65f4612354ac3f6d7a9d0028246c3e4ef3a0bc564917386460e84969
Opcode Fuzzy Hash: 8e39b244ec004d33a78bec66716c19fd785043de6809f57852e2fe2761deb095
Instruction Fuzzy Hash: 7D31633221FB4181FA10BB55E8492BA7771E794BA4F781222DADA536F9EE37C445C700

Function 0000026CE85CCA04 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA25

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA4A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCA74
numpunct.LIBCPMT ref: 0000026CE85CCACD
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85CCAE4
_CxxThrowException.LIBCMT ref: 0000026CE85CCAF5
std::_Facet_Register.LIBCPMT ref: 0000026CE85CCB13
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCB1E

Strings

bad cast, xrefs: 0000026CE85CCAD8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4059195664-3145022300
Opcode ID: 2041dd7da891098dc9ea848057da1134df316c48a7d12d52e319c026ea6f695a
Instruction ID: 9d20e538d1841757acace173279b780fcffbbd3cfe69c7df769e383704c12b99
Opcode Fuzzy Hash: 2041dd7da891098dc9ea848057da1134df316c48a7d12d52e319c026ea6f695a
Instruction Fuzzy Hash: 46314D3221FA4181FA11FB15E9492B97771E394BA4F684223DADA476E9DF37C8428B00

Function 0000026CE85D3A94 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3AB5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3ADA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3B04
moneypunct.LIBCPMT ref: 0000026CE85D3B5D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3B74
_CxxThrowException.LIBCMT ref: 0000026CE85D3B85
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3BA3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3BAE

Strings

bad cast, xrefs: 0000026CE85D3B68

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: cf3a473d4a2924b6d3a61fecd1b2eafc96592f01937f7426af8f1c781fe91554
Instruction ID: 7f6341e9ba8a2431410d774a54b784777fcd5790b1b19b6f90dc151fb3dff046
Opcode Fuzzy Hash: cf3a473d4a2924b6d3a61fecd1b2eafc96592f01937f7426af8f1c781fe91554
Instruction Fuzzy Hash: D0314F3221FA4081FA10FB55E9492BA7770F794BA4F680222DEDA436E9EF77C845C700

Function 0000026CE85D2B24 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2B45

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2B6A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2B94
codecvt.LIBCPMT ref: 0000026CE85D2BED
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D2C04
_CxxThrowException.LIBCMT ref: 0000026CE85D2C15
std::_Facet_Register.LIBCPMT ref: 0000026CE85D2C33
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2C3E

Strings

bad cast, xrefs: 0000026CE85D2BF8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 2760077954-3145022300
Opcode ID: dc53cec89c99da22bcd306d525d4bf72450f34741b04eaec344622fce76dc459
Instruction ID: 37281a79fe82e43f8c876870b9c5f74e02fb3828e17d92d7cf8571c04d96f2dd
Opcode Fuzzy Hash: dc53cec89c99da22bcd306d525d4bf72450f34741b04eaec344622fce76dc459
Instruction Fuzzy Hash: E531603120FB4095FA11BB55E4492BA7770E794BA0F790622DEDA436E9DE2BD8828700

Function 0000026CE85D3BC4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3BE5

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D3C0A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3C34
messages.LIBCPMT ref: 0000026CE85D3C8D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D3CA4
_CxxThrowException.LIBCMT ref: 0000026CE85D3CB5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D3CD3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D3CDE

Strings

bad cast, xrefs: 0000026CE85D3C98

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 2127f81a5437bb88b075241f3d29aaf0cf321937bbea42743d9c4b13c04cc0b3
Instruction ID: 4d9755c6d1f26e5df71ff14b7e32b7de918f3820bb74384098a7eabe11bff75d
Opcode Fuzzy Hash: 2127f81a5437bb88b075241f3d29aaf0cf321937bbea42743d9c4b13c04cc0b3
Instruction Fuzzy Hash: B731403221FB4091FA10BB55E4492BA7770E794BA4F685222DADB436F9EF37C446C700

Function 0000026CE85D2C54 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2C75

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D2C9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2CC4
collate.LIBCPMT ref: 0000026CE85D2D1D
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D2D34
_CxxThrowException.LIBCMT ref: 0000026CE85D2D45
std::_Facet_Register.LIBCPMT ref: 0000026CE85D2D63
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D2D6E

Strings

bad cast, xrefs: 0000026CE85D2D28

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 0aac932d3e7c268931cf707a4d93752f56fee1ca9c031bf76c3d673b10170def
Instruction ID: 02f49a8a0000043356dd1cec113aca238ab4d8427806f552454a706c90bb0b13
Opcode Fuzzy Hash: 0aac932d3e7c268931cf707a4d93752f56fee1ca9c031bf76c3d673b10170def
Instruction Fuzzy Hash: E6317E3220FA4081FA10FB55E5492BA7770F794BA4F794622DADA436E9DF7BD842C700

Function 0000026CE85CB560 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CB579

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

__int64.LIBCPMTD ref: 0000026CE85CB592

Part of subcall function 0000026CE85C1AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85C1B0B
Part of subcall function 0000026CE85C1AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85C1B3D

std::locale::_Getfacet.LIBCPMTD ref: 0000026CE85CB5A9
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CB65A

Strings

bad cast, xrefs: 0000026CE85CB5EC

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1666373992-3145022300
Opcode ID: 93a5699e027cb8ef89e0de3b46b91101183ef16d26cf5389666435c13f441cb5
Instruction ID: 0349bfef26122be6b4e6aeaf494d684fd782f02b815fdff2ac3128697cef238b
Opcode Fuzzy Hash: 93a5699e027cb8ef89e0de3b46b91101183ef16d26cf5389666435c13f441cb5
Instruction Fuzzy Hash: 7031EC3211EE8481EA60EB15E4853AAB774F7C57A4F640212EADE437A9DF3AC544CF00

Function 0000026CE85CABE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CABF9

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

__int64.LIBCPMTD ref: 0000026CE85CAC12

Part of subcall function 0000026CE85C1AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85C1B0B
Part of subcall function 0000026CE85C1AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85C1B3D

std::locale::_Getfacet.LIBCPMTD ref: 0000026CE85CAC29
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CACDA

Strings

bad cast, xrefs: 0000026CE85CAC6C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1666373992-3145022300
Opcode ID: d78c58cc6dc32a45fa35aa0ea62847462abab04b09d4575ad04a92c308c6451f
Instruction ID: 4aeeeabc0777b5e63068988fba7c27b486c710856961a67d6d2ab0416d549e53
Opcode Fuzzy Hash: d78c58cc6dc32a45fa35aa0ea62847462abab04b09d4575ad04a92c308c6451f
Instruction Fuzzy Hash: 0931CC7215EE8481EA60EB15E48836AB774F7847A4F600212EADE437E9DF3AC545CB04

Function 0000026CE85D42E4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D4305

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D432A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4354
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D43C4
_CxxThrowException.LIBCMT ref: 0000026CE85D43D5
std::_Facet_Register.LIBCPMT ref: 0000026CE85D43F3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D43FE

Strings

bad cast, xrefs: 0000026CE85D43B8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 9ba023ed03df909f6066c7b5c14fd05801aa9986d2c2f223f424258040ee7ccc
Instruction ID: 549ddff0caa8df397f017db55da3ea1a513b5bad600a8c3d26864ad9cd93790e
Opcode Fuzzy Hash: 9ba023ed03df909f6066c7b5c14fd05801aa9986d2c2f223f424258040ee7ccc
Instruction Fuzzy Hash: 38315F3221FB4082FA10EB19E5492BA7370F794BA4F684222DADA436E9DF37C4958741

Function 0000026CE85D4414 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D4435

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D445A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4484
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D44F4
_CxxThrowException.LIBCMT ref: 0000026CE85D4505
std::_Facet_Register.LIBCPMT ref: 0000026CE85D4523
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D452E

Strings

bad cast, xrefs: 0000026CE85D44E8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 4ee676152d8a6d3fc2897e1a750d37abcf8e05a29651dc9c84745b4ac20e915c
Instruction ID: 6da64fcae70638659419af2c9438573d5fbe834dd226e0c70d15cabc7f2699ca
Opcode Fuzzy Hash: 4ee676152d8a6d3fc2897e1a750d37abcf8e05a29651dc9c84745b4ac20e915c
Instruction Fuzzy Hash: A931903621BB4081FA10FB55E5492BA7370F790BA4F681222DADA432EADF37C842C701

Function 0000026CE85D4544 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D4565

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D458A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D45B4
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D4624
_CxxThrowException.LIBCMT ref: 0000026CE85D4635
std::_Facet_Register.LIBCPMT ref: 0000026CE85D4653
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D465E

Strings

bad cast, xrefs: 0000026CE85D4618

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 61d228dc35f4783f95f4f267f4efbd83b46e62b23daaabd50ddf3d7b4201f6b8
Instruction ID: d2e12adfac35094bfcb0eb747f0c01d793e179df46951915316f3da1dcc4acb6
Opcode Fuzzy Hash: 61d228dc35f4783f95f4f267f4efbd83b46e62b23daaabd50ddf3d7b4201f6b8
Instruction Fuzzy Hash: C8315E3221BA4081FA10FB55E5492BA7770F794BA4F784222DADB436E9DF37C846C701

Function 0000026CE85D4674 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D4695

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D46BA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D46E4
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85D4754
_CxxThrowException.LIBCMT ref: 0000026CE85D4765
std::_Facet_Register.LIBCPMT ref: 0000026CE85D4783
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D478E

Strings

bad cast, xrefs: 0000026CE85D4748

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: ace5dc31f61c09f8b1992fbad1866961798bcf55ab3e40703d2c29ce2fc2ab2b
Instruction ID: 54fe1096f11297d51604ae4f3e4838440d4675f5ff7b7f50b97201300175a1a9
Opcode Fuzzy Hash: ace5dc31f61c09f8b1992fbad1866961798bcf55ab3e40703d2c29ce2fc2ab2b
Instruction Fuzzy Hash: 04318F3260FB41C1FA10FB65E5492BA7770E791BA4F780222DADA472E9DE37D846C701

Function 0000026CE85E8828 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8849

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E886E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8898
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E8908
_CxxThrowException.LIBCMT ref: 0000026CE85E8919
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8937
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8942

Strings

bad cast, xrefs: 0000026CE85E88FC

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: f8706b51eb17ae2e159a5494a8dec2db18e3578be03e998b402b1e0e9252aa95
Instruction ID: 433dc44fb1d1b3e75627fca1581ad85ad2c3730093bfc55ec5e8bfb197c9b06e
Opcode Fuzzy Hash: f8706b51eb17ae2e159a5494a8dec2db18e3578be03e998b402b1e0e9252aa95
Instruction Fuzzy Hash: 0331A03261FB4081FA21FB15E84C2B97771E790BA4F780222DADA536E9DE37C842C700

Function 0000026CE85E8958 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E8979

Part of subcall function 0000026CE85CC2AC: _lock.LIBCMT ref: 0000026CE85CC2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85E899E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E89C8
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE85E8A38
_CxxThrowException.LIBCMT ref: 0000026CE85E8A49
std::_Facet_Register.LIBCPMT ref: 0000026CE85E8A67
std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85E8A72

Strings

bad cast, xrefs: 0000026CE85E8A2C

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 59c119c6cd78f5f12ab19a5a93b0e181c0794a7f240d0e73d8738324ff7228fb
Instruction ID: 103150c4595faff8dba9e43d22536d54caf1f2d4372af79a015ef1becdff378a
Opcode Fuzzy Hash: 59c119c6cd78f5f12ab19a5a93b0e181c0794a7f240d0e73d8738324ff7228fb
Instruction Fuzzy Hash: 80314D3261FB4081FA21AB55E84D2B97771E394BA4F680222DADA936E9DF37C841C700

Function 0000026CE68AA988 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 0000026CE68AA9B6

Part of subcall function 0000026CE68A16CC: _errno.LIBCMT ref: 0000026CE68A16EC

free.LIBCMT ref: 0000026CE68AA9CB
free.LIBCMT ref: 0000026CE68AA9EC
free.LIBCMT ref: 0000026CE68AAA01
free.LIBCMT ref: 0000026CE68AAA15
free.LIBCMT ref: 0000026CE68AAA21
free.LIBCMT ref: 0000026CE68AAA4C
free.LIBCMT ref: 0000026CE68AAA6D
free.LIBCMT ref: 0000026CE68AAA86
free.LIBCMT ref: 0000026CE68AAAB7

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction ID: 8a5b1f2d6b5f35e12fcf0a40936d7009bb73e16e8406d16b0648f8bd7c063050
Opcode Fuzzy Hash: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction Fuzzy Hash: E5415070264B0A4FFBE4FF59D899B7432F2F756311F780019DA46C22A2CBAF98458B11

Function 0000026CE85F59DF Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 0000026CE85F5A0A
RaiseException.KERNEL32 ref: 0000026CE85F5A33
__DestructExceptionObject.LIBCMT ref: 0000026CE85F5A94
_getptd.LIBCMT ref: 0000026CE85F59E7

Part of subcall function 0000026CE85FD224: _getptd_noexit.LIBCMT ref: 0000026CE85FD22A
Part of subcall function 0000026CE85FD224: _amsg_exit.LIBCMT ref: 0000026CE85FD23A

_getptd.LIBCMT ref: 0000026CE85F5A99
_getptd.LIBCMT ref: 0000026CE85F5AA5

Strings

csm, xrefs: 0000026CE85F5A67

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 1037122555-1018135373
Opcode ID: f0fb30d1909b450c6e57b082ed5d02df015822f95b1b763569599858bfad4588
Instruction ID: 133ebf49754b1aa1d1fac510b570bfab99efa242611ee22329d209935648ab34
Opcode Fuzzy Hash: f0fb30d1909b450c6e57b082ed5d02df015822f95b1b763569599858bfad4588
Instruction Fuzzy Hash: C6213E7620A68186E630EB96E04536E77B1F385BA6F154216DFDA03795CF3BD486CB00

Function 0000026CE8600310 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000026CE8600339

Part of subcall function 0000026CE85F6398: malloc.LIBCMT ref: 0000026CE85F63C3
Part of subcall function 0000026CE85F6398: Sleep.KERNEL32(?,?,?,0000026CE85F4B14,?,?,?,0000026CE85F4A13,?,?,00000000,0000026CE85FD332,?,?,00000000,0000026CE85FD29E), ref: 0000026CE85F63D6

free.LIBCMT ref: 0000026CE860043A
free.LIBCMT ref: 0000026CE8600456

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: caada0040375c754c365269c74eac08a2c7c6ecaf5709b2b132bd05a7a63ca1e
Instruction ID: f0ca27df3681ebdac76143de2b4301f34740cb8a7fd0fdd51d5a66280cf652f4
Opcode Fuzzy Hash: caada0040375c754c365269c74eac08a2c7c6ecaf5709b2b132bd05a7a63ca1e
Instruction Fuzzy Hash: D261BE3231AB4093EF21FB12E94936A33B9F788794F6441259F8D87B51DF3AC4668748

Function 0000026CE68B8C44 Relevance: 10.7, APIs: 7, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026CE68B8C6F
_errno.LIBCMT ref: 0000026CE68B8C64

Part of subcall function 0000026CE68A33B4: _getptd_noexit.LIBCMT ref: 0000026CE68A33B8

_errno.LIBCMT ref: 0000026CE68B8D12
_invalid_parameter_noinfo.LIBCMT ref: 0000026CE68B8D1D

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 54267be0af5665c456a7c7659a763348ac507c77e1cf2204fcfa820cb5cdd029
Instruction ID: a4e1064c9a2c42007bd972a66f1f9b31861480fc8cc796a49c59f415f38a0741
Opcode Fuzzy Hash: 54267be0af5665c456a7c7659a763348ac507c77e1cf2204fcfa820cb5cdd029
Instruction Fuzzy Hash: 7151FBB4534A494BEBB4BB2A90593B673F0FB25321FB8025FA8C6C71C7D6278841C745

Function 0000026CE85C8D70 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE85C4C10: shared_ptr.LIBCPMTD ref: 0000026CE85C4C2B

codecvt.LIBCPMTD ref: 0000026CE85C8EDF

Strings

bad conversion, xrefs: 0000026CE85C8FCE, 0000026CE85C90A6

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: codecvtshared_ptr
String ID: bad conversion
API String ID: 864914841-2629740042
Opcode ID: f686c19bb21e7c99195cfd856166b89ac244ed319bd7e827f4bfb7f3c19f572a
Instruction ID: 3cc803d29a6e2724ac866d9128e23f8678d854c039173d774f42f79c72419a4e
Opcode Fuzzy Hash: f686c19bb21e7c99195cfd856166b89ac244ed319bd7e827f4bfb7f3c19f572a
Instruction Fuzzy Hash: 7091E83221FAC495EA70EB15E4593FAB3B0F795780F600516D6CE83AA9DF6AC544CF40

Function 0000026CE68B262C Relevance: 10.6, APIs: 7, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026CE68B2652
_errno.LIBCMT ref: 0000026CE68B2647

Part of subcall function 0000026CE68A33B4: _getptd_noexit.LIBCMT ref: 0000026CE68A33B8

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE68B26D1
_errno.LIBCMT ref: 0000026CE68B26E2
_invalid_parameter_noinfo.LIBCMT ref: 0000026CE68B26ED

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 18b03093d7903f9cb9c0e6ccd3bd8cd556307edb59b32dac925bc1e85bd82eca
Instruction ID: b9dc661227e4f55118dd2e7809a6fb40bc92efa048499a41a9b3638279e2cb3c
Opcode Fuzzy Hash: 18b03093d7903f9cb9c0e6ccd3bd8cd556307edb59b32dac925bc1e85bd82eca
Instruction Fuzzy Hash: 72415834434A1A4BEBB8BB3A80687B6B3F0FB52321FB4021BA4D5C71D7D6678841C345

Function 0000026CE860939C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026CE86093C7
_errno.LIBCMT ref: 0000026CE86093BC

Part of subcall function 0000026CE85F3B0C: _getptd_noexit.LIBCMT ref: 0000026CE85F3B10

_errno.LIBCMT ref: 0000026CE860946A
_invalid_parameter_noinfo.LIBCMT ref: 0000026CE8609475

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: e6115aaee9bd6988ad82c43c6dd58144aeb0dd506a0ad067c6414fbe19083d80
Instruction ID: 23b0531214e93e7439e55709d636c88d832d32eb76bc24a6f47ec6dba8f56549
Opcode Fuzzy Hash: e6115aaee9bd6988ad82c43c6dd58144aeb0dd506a0ad067c6414fbe19083d80
Instruction Fuzzy Hash: 424127F2A3B29181FF75BF22A0483B972BAE740B94FA44011DAD58B6C5D73BC951C718

Function 0000026CE8602D84 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026CE8602DAA
_errno.LIBCMT ref: 0000026CE8602D9F

Part of subcall function 0000026CE85F3B0C: _getptd_noexit.LIBCMT ref: 0000026CE85F3B10

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE8602E29
_errno.LIBCMT ref: 0000026CE8602E3A
_invalid_parameter_noinfo.LIBCMT ref: 0000026CE8602E45

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: dfee2ec86327835073bb60d14cfa61aec5f3f40ef22b560a8e2aa4c0f90f1485
Instruction ID: 349c3c1edb2c2f6d7d4b4916d10fbe5ca7f7ee9812bdf6968d9cc096bf5130f1
Opcode Fuzzy Hash: dfee2ec86327835073bb60d14cfa61aec5f3f40ef22b560a8e2aa4c0f90f1485
Instruction Fuzzy Hash: 15415EB262A26085FB76771190583B933B4EB50BA4FB44026E7D8877C4DB2BC851C704

Function 0000026CE687A488 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687A4A1

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

__int64.LIBCPMTD ref: 0000026CE687A4BA

Part of subcall function 0000026CE6871398: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68713B3

std::locale::_Getfacet.LIBCPMTD ref: 0000026CE687A4D1

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID:
API String ID: 1826629674-0
Opcode ID: 475c35bb957f92cb08b03fdb3f7c4018d5127f34752569f9ef8619f3a0f66de7
Instruction ID: 059a1e36d65e5c47614b2c834f8822cd62d6d1857cb79067acf0151639d08365
Opcode Fuzzy Hash: 475c35bb957f92cb08b03fdb3f7c4018d5127f34752569f9ef8619f3a0f66de7
Instruction Fuzzy Hash: AD31143052CB488FD7A0FB18D448B6AB7F1FB99315F640A1AB0C9C31A1DB36E540CB42

Function 0000026CE687AE08 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687AE21

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

__int64.LIBCPMTD ref: 0000026CE687AE3A

Part of subcall function 0000026CE6871398: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68713B3

std::locale::_Getfacet.LIBCPMTD ref: 0000026CE687AE51

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Getfacet__int64_lockstd::locale::_
String ID:
API String ID: 1826629674-0
Opcode ID: a7a86c66bce9f8c002374eae96e0059bdcbbf72b2e3551aa10e057cb6c724dea
Instruction ID: 898397e7ba9e3d3b54ecb17fa02f82dab4897c9c298330829228d81d01ee386c
Opcode Fuzzy Hash: a7a86c66bce9f8c002374eae96e0059bdcbbf72b2e3551aa10e057cb6c724dea
Instruction Fuzzy Hash: 1931D031128B489FD794FB19C488B6AB7F1FB99315F640A1AB0C9C31A1DB36E544CB42

Function 0000026CE860BF5C Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE860BF90

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_errno.LIBCMT ref: 0000026CE860BFAB
_invalid_parameter_noinfo.LIBCMT ref: 0000026CE860BFB6

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction ID: 9066748fc31f57e6bbdbc1b6b536afc94fb170b7948f401e046d6eb2e851d1af
Opcode Fuzzy Hash: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction Fuzzy Hash: EA31B1B261A78086F731AB11948976DB7B8F744BE0F348121EED547795CB77C841CB04

Function 0000026CE85F5ADC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000026CE85F5AFD
_getptd.LIBCMT ref: 0000026CE85F5B0B
_getptd.LIBCMT ref: 0000026CE85F5B1D

Strings

csm, xrefs: 0000026CE85F5AF3
RCC, xrefs: 0000026CE85F5AE3
MOC, xrefs: 0000026CE85F5AEB

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction ID: f3ea6b90a55d46118da6eda9b8455aa487d6ea7f98e2e9b0cba2ebbd30f688b5
Opcode Fuzzy Hash: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction Fuzzy Hash: BCF0303561B104C6FB663F94804F3BC35F0F794B06FB68461E2C6027829FBF45918A52

Function 0000026CE687C4A0 Relevance: 9.5, APIs: 6, Instructions: 479stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000026CE687C548
localeconv.LIBCMT ref: 0000026CE687C55B
strcspn.LIBCMT ref: 0000026CE687C571
std::ios_base::getloc.LIBCPMTD ref: 0000026CE687C581
std::ios_base::getloc.LIBCPMTD ref: 0000026CE687C60A
_Mpunct.LIBCPMT ref: 0000026CE687C643

Part of subcall function 0000026CE6878C48: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 0000026CE6878C75
Part of subcall function 0000026CE6878C48: _Mtx_guard::~_Mtx_guard.LIBCPMTD ref: 0000026CE6878C9C
Part of subcall function 0000026CE6878C48: char_traits.LIBCPMTD ref: 0000026CE6878D2A

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Mtx_guardMtx_guard::~_std::ios_base::getlocstrcspn$Mpunctchar_traitslocaleconv
String ID:
API String ID: 1081295294-0
Opcode ID: 80fff96529f72534f19313b91b76645ccdf41dfbacd5eccac0a68e6ac0f0d792
Instruction ID: e4d24a671a56ca2c9b1a6821a2598bb681b28215733695595f657accd9612dd7
Opcode Fuzzy Hash: 80fff96529f72534f19313b91b76645ccdf41dfbacd5eccac0a68e6ac0f0d792
Instruction Fuzzy Hash: EFF1A030A28F5C8FDB64FF69C4856EDB7F1FB69300F60015AE48AD7183DA32A9458781

Function 0000026CE687A948 Relevance: 9.4, APIs: 6, Instructions: 403COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE687AAA4

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE687A488: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687A4A1
Part of subcall function 0000026CE687A488: __int64.LIBCPMTD ref: 0000026CE687A4BA
Part of subcall function 0000026CE687A488: std::locale::_Getfacet.LIBCPMTD ref: 0000026CE687A4D1

char_traits.LIBCPMTD ref: 0000026CE687ABC6
ctype.LIBCPMTD ref: 0000026CE687AC2D
char_traits.LIBCPMTD ref: 0000026CE687AC99
char_traits.LIBCPMTD ref: 0000026CE687AD67
std::ios_base::width.LIBCPMTD ref: 0000026CE687ADA7

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: char_traits$GetfacetLockitLockit::___int64ctypestd::_std::ios_base::getlocstd::ios_base::widthstd::locale::_std::locale::locale
String ID:
API String ID: 3820056732-0
Opcode ID: f7d4b075ec16be0e298c79dab2fc69bc85944e118794892976690d5cb4385092
Instruction ID: 86d93e1799712d7e7c94e48eab32cdaa6c65dc9cb9ce248a32b7114e59e6f229
Opcode Fuzzy Hash: f7d4b075ec16be0e298c79dab2fc69bc85944e118794892976690d5cb4385092
Instruction Fuzzy Hash: E9E19234118B889FE7A4FB69C0587BEB7F1FF99341F60491EA48DD7261DA76E4808702

Function 0000026CE85D53C8 Relevance: 9.3, APIs: 6, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000026CE85D5471
localeconv.LIBCMT ref: 0000026CE85D5483
strcspn.LIBCMT ref: 0000026CE85D5497
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D54A6
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D552F
_Mpunct.LIBCPMT ref: 0000026CE85D5568

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: e6d4c13a13f37a2c0e240a87e1a0af4942c429ab79be8636b1550a59db188ce2
Instruction ID: 74ed63ffb08cc1100d2827e71ad1dd519d24dd6af5fa845264bef5032519baac
Opcode Fuzzy Hash: e6d4c13a13f37a2c0e240a87e1a0af4942c429ab79be8636b1550a59db188ce2
Instruction Fuzzy Hash: 2CE1913670AA8089FB10AFA5C4493FD73B1F758B88FA44115DE8A57B99DF3AC54AC340

Function 0000026CE85D4F34 Relevance: 9.3, APIs: 6, Instructions: 331stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000026CE85D4FDD
localeconv.LIBCMT ref: 0000026CE85D4FEF
strcspn.LIBCMT ref: 0000026CE85D5003
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D5012
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D509B
_Mpunct.LIBCPMT ref: 0000026CE85D50D4

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: 519f33cb95e0d99ee0d4355dc84f9f0201176b2b605b694342907c18314ab85a
Instruction ID: de0f245bec8fe43c3b4b16257246916ee0068d6179287cd5104195402554d86f
Opcode Fuzzy Hash: 519f33cb95e0d99ee0d4355dc84f9f0201176b2b605b694342907c18314ab85a
Instruction Fuzzy Hash: C5E1903270AA80C9FB10AFA5C4493FD73B1E758B88F644115DE8A57B99EF3AC549C340

Function 0000026CE85CCBF8 Relevance: 9.3, APIs: 6, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000026CE85CCCA0
localeconv.LIBCMT ref: 0000026CE85CCCB3
strcspn.LIBCMT ref: 0000026CE85CCCC9
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CCCD9
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CCD62
_Mpunct.LIBCPMT ref: 0000026CE85CCD9B

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: 249c8184b0c50b0624f1531bd89af645a8e4f17256f81473f5670aed722e2b0a
Instruction ID: 3dea9a5c0494b2a9d5eec0dd7b84282eab17adbadcc55c804e8514702aa28de9
Opcode Fuzzy Hash: 249c8184b0c50b0624f1531bd89af645a8e4f17256f81473f5670aed722e2b0a
Instruction Fuzzy Hash: 8DD17E32B0AA8489FB109FB5D0543EC7771F749B88F645116DE8A27B8ADF3AC546CB40

Function 0000026CE6875278 Relevance: 9.3, APIs: 6, Instructions: 293COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0000026CE68752BE
char_traits.LIBCPMTD ref: 0000026CE68752D2

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 76944e2627019ce81bd9c091a5413294dd97fbccb27d42a7feae6066973e9caa
Instruction ID: 2ce055a07e505372e24e62587169e6294c43a75cad1474098e8f71104c1bbfcb
Opcode Fuzzy Hash: 76944e2627019ce81bd9c091a5413294dd97fbccb27d42a7feae6066973e9caa
Instruction Fuzzy Hash: C8C1B930128B448AE774FB25C4597BEB7F1FB96301F70092BA4CAC21A3DE76A584D752

Function 0000026CE85CB0A0 Relevance: 9.3, APIs: 6, Instructions: 253COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85CB1FC

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CABE0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CABF9
Part of subcall function 0000026CE85CABE0: __int64.LIBCPMTD ref: 0000026CE85CAC12
Part of subcall function 0000026CE85CABE0: std::locale::_Getfacet.LIBCPMTD ref: 0000026CE85CAC29
Part of subcall function 0000026CE85CABE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CACDA

char_traits.LIBCPMTD ref: 0000026CE85CB31E
ctype.LIBCPMTD ref: 0000026CE85CB385
char_traits.LIBCPMTD ref: 0000026CE85CB3F1
char_traits.LIBCPMTD ref: 0000026CE85CB4BF
std::ios_base::width.LIBCPMTD ref: 0000026CE85CB4FF

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: char_traits$Lockitstd::_$GetfacetLockit::_Lockit::~___int64ctypestd::ios_base::getlocstd::ios_base::widthstd::locale::_std::locale::locale
String ID:
API String ID: 2740546168-0
Opcode ID: a07e37d6cc49bf2a2ce72d55d671cce5715a6d797d1835dc9c2bdc10f607b4b5
Instruction ID: 7d49ecb95b6bf341de04fe357e6cc0526d4944edcdc5c775aac460fb7f6ac27b
Opcode Fuzzy Hash: a07e37d6cc49bf2a2ce72d55d671cce5715a6d797d1835dc9c2bdc10f607b4b5
Instruction Fuzzy Hash: 2CC1BB3620EBC485EA60EB55E49536EB7B0F7C4B84F604516EACE47B69DF7EC4408B01

Function 0000026CE85C59D0 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0000026CE85C5A16
char_traits.LIBCPMTD ref: 0000026CE85C5A2A

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 62264f4c2282442cdc3c1f905bd9bad1ff7143b47ade65a719556a1dd44444ed
Instruction ID: 6dd05d2d394b54298ef04e2b5b4dcd751ee00dd6dfbc07bae880cb2207e050dc
Opcode Fuzzy Hash: 62264f4c2282442cdc3c1f905bd9bad1ff7143b47ade65a719556a1dd44444ed
Instruction Fuzzy Hash: BBB1D53611F68081FA20BB95E4593FAB3B0F794784F600127E6CA87A9ADF6BC544DF50

Function 0000026CE68823CC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68823ED

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882412
codecvt.LIBCPMT ref: 0000026CE6882495
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68824AC
_CxxThrowException.LIBCMT ref: 0000026CE68824BD
std::_Facet_Register.LIBCPMT ref: 0000026CE68824DB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID:
API String ID: 2666907392-0
Opcode ID: 786228c0cbaae2e5be0ca3ccd782fa5b01697f06a74618a99b9e5aa10a8d0d32
Instruction ID: 31128ea9f9b1aa1d9a22047b799a1e5da5859688d061a3c68e626cfb3edbbd51
Opcode Fuzzy Hash: 786228c0cbaae2e5be0ca3ccd782fa5b01697f06a74618a99b9e5aa10a8d0d32
Instruction Fuzzy Hash: 74418431128E084FE774FF19D4A8A6673F1FBA5310F70065B949AC32A7CA36A845C791

Function 0000026CE6882AEC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882B0D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882B32
messages.LIBCPMT ref: 0000026CE6882BB5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6882BCC
_CxxThrowException.LIBCMT ref: 0000026CE6882BDD
std::_Facet_Register.LIBCPMT ref: 0000026CE6882BFB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 14be1b1fd9718fc3f34adfb3cbca17648e58064d730dfa3a608ea707c9c1eaf3
Instruction ID: a1db6be18de4fb7ef26d0a13727754e547b8aac5776704fd3203c2195ed593d6
Opcode Fuzzy Hash: 14be1b1fd9718fc3f34adfb3cbca17648e58064d730dfa3a608ea707c9c1eaf3
Instruction Fuzzy Hash: 02418331129A088FE778FF19D49867A73F1FB69310F70055BA595C32A7DA36E805C781

Function 0000026CE688333C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688335D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883382
moneypunct.LIBCPMT ref: 0000026CE6883405
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688341C
_CxxThrowException.LIBCMT ref: 0000026CE688342D
std::_Facet_Register.LIBCPMT ref: 0000026CE688344B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: e16598f94629519630b94ae800744cf899b351421400b9fa78f81e17fa1edaa5
Instruction ID: d089eb7743bd5a59c02804b939ce75efed1a98d80f525bdde25cf30f9638730e
Opcode Fuzzy Hash: e16598f94629519630b94ae800744cf899b351421400b9fa78f81e17fa1edaa5
Instruction Fuzzy Hash: D5418031628A094FE765FB59D498AAA73F1FB75300F70055B9086C32A6DE27EC058B81

Function 0000026CE688346C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688348D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68834B2
messages.LIBCPMT ref: 0000026CE6883535
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688354C
_CxxThrowException.LIBCMT ref: 0000026CE688355D
std::_Facet_Register.LIBCPMT ref: 0000026CE688357B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 244ef1690acba6a5cb0dd3559b1bc5566f4c94bd989e195887cab2b3b6a165ed
Instruction ID: 6725d043f821a5066b00954868a9839c39f4c7ad0dcafe82819626bd20927283
Opcode Fuzzy Hash: 244ef1690acba6a5cb0dd3559b1bc5566f4c94bd989e195887cab2b3b6a165ed
Instruction Fuzzy Hash: 64418031228B094FE775FB59D498ABA73F1FB75310F70065B9096C32A6DA27A8058B81

Function 0000026CE6897C10 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897C31

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897C56
messages.LIBCPMT ref: 0000026CE6897CD9
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6897CF0
_CxxThrowException.LIBCMT ref: 0000026CE6897D01
std::_Facet_Register.LIBCPMT ref: 0000026CE6897D1F

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: bc7c18e89f00e4146b619dee3e1b955b084c897949153250966cdf59237aa082
Instruction ID: 2b0e2b5f06a33185a9e645bbfe277bb4ac280332a0dd2bcad5420b7ea8b61116
Opcode Fuzzy Hash: bc7c18e89f00e4146b619dee3e1b955b084c897949153250966cdf59237aa082
Instruction Fuzzy Hash: 4E417131628A084FE765FB29D48867577F1FBA9310F70166A908AD32A6DA36E841C781

Function 0000026CE6882C1C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882C3D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882C62
messages.LIBCPMT ref: 0000026CE6882CE5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6882CFC
_CxxThrowException.LIBCMT ref: 0000026CE6882D0D
std::_Facet_Register.LIBCPMT ref: 0000026CE6882D2B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: e02caa4fb9f9f2feb070e3db7e870884112d88562d0c71a5ab28d0eb569987ff
Instruction ID: 106b2ccb86ef8a27c0798951f32dfc79a3aa9a050b4680ab756af6e735970075
Opcode Fuzzy Hash: e02caa4fb9f9f2feb070e3db7e870884112d88562d0c71a5ab28d0eb569987ff
Instruction Fuzzy Hash: 79416531128B098FE768FF19D4986BA77F1FB65310F70066B9496C32A7DA36E805C781

Function 0000026CE687C17C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C19D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C1C2
messages.LIBCPMT ref: 0000026CE687C245
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE687C25C
_CxxThrowException.LIBCMT ref: 0000026CE687C26D
std::_Facet_Register.LIBCPMT ref: 0000026CE687C28B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 41d49ad4b7121165f543fc67f64dc3071c0984782cb30c3a214f00ddd9751a84
Instruction ID: 09c2f945c01e52829b9006b3ec4e98af8cd2bd6d725d6c4f41ddf8d0ba78628d
Opcode Fuzzy Hash: 41d49ad4b7121165f543fc67f64dc3071c0984782cb30c3a214f00ddd9751a84
Instruction Fuzzy Hash: CD416231128B084FE765FF69D49867AB3F1FB6A310F30066B9495D32A7DA32E845C781

Function 0000026CE68979B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68979D1

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68979F6
collate.LIBCPMT ref: 0000026CE6897A79
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6897A90
_CxxThrowException.LIBCMT ref: 0000026CE6897AA1
std::_Facet_Register.LIBCPMT ref: 0000026CE6897ABF

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: b689417173be9a58d7525dd7f69df29017bd0b297875d8cf91ba4b2357bb2b2e
Instruction ID: b5678875abc645d47af5a965fbf1eb2ba26f4124e0337251de67ca22a24888f5
Opcode Fuzzy Hash: b689417173be9a58d7525dd7f69df29017bd0b297875d8cf91ba4b2357bb2b2e
Instruction Fuzzy Hash: D141A331528E084FE764FF29D488A7677F1FB65310F34155BA08ED31A7DA36E9418781

Function 0000026CE68829BC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68829DD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882A02
messages.LIBCPMT ref: 0000026CE6882A85
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6882A9C
_CxxThrowException.LIBCMT ref: 0000026CE6882AAD
std::_Facet_Register.LIBCPMT ref: 0000026CE6882ACB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: d9cb5c1c6ae06c0d428bbbd94a39445ef9bd2be3a68fcd0c49b05d0f5fcf55f6
Instruction ID: 476fcf4a7454b3a80084f87062f1fd495ab8f4b11b8538028fdf71ad360a050a
Opcode Fuzzy Hash: d9cb5c1c6ae06c0d428bbbd94a39445ef9bd2be3a68fcd0c49b05d0f5fcf55f6
Instruction Fuzzy Hash: 80418231128A084FE778FF19D498ABA73F1FB65310F70065B9495D32A7CA36E9458781

Function 0000026CE688392C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688394D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883972
numpunct.LIBCPMT ref: 0000026CE68839F5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883A0C
_CxxThrowException.LIBCMT ref: 0000026CE6883A1D
std::_Facet_Register.LIBCPMT ref: 0000026CE6883A3B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: 441b8e41e1d8b8a705fa5094bdd223caa96ea1b284aea36a97238e43f629e6f4
Instruction ID: cd878b27d2a0a3b0be2f2694d053712c3e6cc89a17d2ddfa9b5c8d01e136a462
Opcode Fuzzy Hash: 441b8e41e1d8b8a705fa5094bdd223caa96ea1b284aea36a97238e43f629e6f4
Instruction Fuzzy Hash: 10418131628E194FE764FF5AD488AA573F1FB7A300F70066B9095C32A3DA36A845C781

Function 0000026CE687C2AC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2CD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2F2
numpunct.LIBCPMT ref: 0000026CE687C375
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE687C38C
_CxxThrowException.LIBCMT ref: 0000026CE687C39D
std::_Facet_Register.LIBCPMT ref: 0000026CE687C3BB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: d3f43ab89e984d6a3700269965d375e20708ad9f940fdae27254e6f2a65f332c
Instruction ID: f6a476e4032a7c16d163e7792d01ee2bbd2dff81c5daf788681e7996d41bcd0c
Opcode Fuzzy Hash: d3f43ab89e984d6a3700269965d375e20708ad9f940fdae27254e6f2a65f332c
Instruction Fuzzy Hash: 52413231128B188FE765FF2AD49867AB3F1FB65310F30066B9499C31A7DA36E845C781

Function 0000026CE6897AE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897B01

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897B26
messages.LIBCPMT ref: 0000026CE6897BA9
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6897BC0
_CxxThrowException.LIBCMT ref: 0000026CE6897BD1
std::_Facet_Register.LIBCPMT ref: 0000026CE6897BEF

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 6f298ffa6e497c2eaaf01785e43fc4dce3c4a55519c401323b13ede0ce761a3d
Instruction ID: 4a7906617877b67f69142f0705288247350ab0711dcb0efbad98863a2d3d409c
Opcode Fuzzy Hash: 6f298ffa6e497c2eaaf01785e43fc4dce3c4a55519c401323b13ede0ce761a3d
Instruction Fuzzy Hash: 3941A231528A084FE7B4FF29D4886B977F1FB69310F30155B919AC31A7DA36E8428781

Function 0000026CE688320C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688322D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883252
moneypunct.LIBCPMT ref: 0000026CE68832D5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68832EC
_CxxThrowException.LIBCMT ref: 0000026CE68832FD
std::_Facet_Register.LIBCPMT ref: 0000026CE688331B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: f8b94c656457c1187a9d8cbcd32f96ed1970e85c5a83aee131887960ce47540c
Instruction ID: 96fa0caeaeb1df62c28fdf39ff9850325c1f9462d1a2b066953422a3576abb3a
Opcode Fuzzy Hash: f8b94c656457c1187a9d8cbcd32f96ed1970e85c5a83aee131887960ce47540c
Instruction Fuzzy Hash: 45418331128B098FE765FB5AD498AB573F1FB79311F70065B9085C32A3CA26EC05C781

Function 0000026CE6883A5C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883A7D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883AA2
numpunct.LIBCPMT ref: 0000026CE6883B25
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883B3C
_CxxThrowException.LIBCMT ref: 0000026CE6883B4D
std::_Facet_Register.LIBCPMT ref: 0000026CE6883B6B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID:
API String ID: 4068408745-0
Opcode ID: 7040e9f09c21cb0afca421e897f27dcdacf665d9cacd4426a9b98b6e033285e0
Instruction ID: 16fe4bad55847e8467a7f7bfb4c5d042078641c8b4438dd7e8dd7b80f7e924af
Opcode Fuzzy Hash: 7040e9f09c21cb0afca421e897f27dcdacf665d9cacd4426a9b98b6e033285e0
Instruction Fuzzy Hash: 96417F31128E084FE764FB69D498A7A73B1FB75310F70066B9086D32A7DA36E845C781

Function 0000026CE6897FA0 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897FC1

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897FE6
moneypunct.LIBCPMT ref: 0000026CE6898069
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6898080
_CxxThrowException.LIBCMT ref: 0000026CE6898091
std::_Facet_Register.LIBCPMT ref: 0000026CE68980AF

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: f056f9edf8a4f6c957cdc38cd9e619afd480da16a60ef54abf923e9647275c7d
Instruction ID: d4d38fcd1c6c98a4682d28e16bcce9023384559ea2b8431dfc9d541c43fcf2e2
Opcode Fuzzy Hash: f056f9edf8a4f6c957cdc38cd9e619afd480da16a60ef54abf923e9647275c7d
Instruction Fuzzy Hash: 67419271529A094FE765FF19D488A6A77F1EB59310F30096A908AC31A7CA36EC418781

Function 0000026CE6882FAC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882FCD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882FF2
moneypunct.LIBCPMT ref: 0000026CE6883075
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688308C
_CxxThrowException.LIBCMT ref: 0000026CE688309D
std::_Facet_Register.LIBCPMT ref: 0000026CE68830BB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 7860dc70e9bf5cc0d0039a70ddbee0ae88935c02dea494e287fd0833cf40dded
Instruction ID: f4c95b6b426fb9cd633292cfc633680b96417656a876cb7675513bb0d85a6ff5
Opcode Fuzzy Hash: 7860dc70e9bf5cc0d0039a70ddbee0ae88935c02dea494e287fd0833cf40dded
Instruction Fuzzy Hash: AF418131228A094FE765FF5AD498ABA73F1FB75300F70065B9089C32A7CA36E845C781

Function 0000026CE687BF1C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687BF3D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687BF62
ctype.LIBCPMT ref: 0000026CE687BFE5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE687BFFC
_CxxThrowException.LIBCMT ref: 0000026CE687C00D
std::_Facet_Register.LIBCPMT ref: 0000026CE687C02B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID:
API String ID: 3320480354-0
Opcode ID: 26618e56ba12d3068fdef7dd0408fe412cbf25b8add2ed8ae57410b806273332
Instruction ID: dac033bedde85d8a2d7463994560881055091f0a711eb17caecfe0f58c7944e9
Opcode Fuzzy Hash: 26618e56ba12d3068fdef7dd0408fe412cbf25b8add2ed8ae57410b806273332
Instruction Fuzzy Hash: 8F416571128B088FE765FF19D498A79B3F1FB6A310F30455BA085C32A7DA72E845CB81

Function 0000026CE688275C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688277D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68827A2
ctype.LIBCPMT ref: 0000026CE6882825
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688283C
_CxxThrowException.LIBCMT ref: 0000026CE688284D
std::_Facet_Register.LIBCPMT ref: 0000026CE688286B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID:
API String ID: 3320480354-0
Opcode ID: 399c9e31cdefa6e34355b3389e5769c9eacfa5db4b9d05f97f7b15c89971f269
Instruction ID: 261a889c7e804ac96e9990b369e6e0c67a8b89b6a6e121b9d5431b0cefcd7cdc
Opcode Fuzzy Hash: 399c9e31cdefa6e34355b3389e5769c9eacfa5db4b9d05f97f7b15c89971f269
Instruction Fuzzy Hash: 24417431128E084FEB69FF1AD49867673F1FB65310F70065B9495C32A7CA36E845CB81

Function 0000026CE688288C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68828AD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68828D2
messages.LIBCPMT ref: 0000026CE6882955
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688296C
_CxxThrowException.LIBCMT ref: 0000026CE688297D
std::_Facet_Register.LIBCPMT ref: 0000026CE688299B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 915cf86895ac07d937b62642654921994e7e6139a02f3fdf34537d2804a32b4b
Instruction ID: 4ed84b2cbb84f882532623bb1f06b9c8ee24ddd72622d9c00e1f9a9139cf4cd1
Opcode Fuzzy Hash: 915cf86895ac07d937b62642654921994e7e6139a02f3fdf34537d2804a32b4b
Instruction Fuzzy Hash: 54416431128B184FE764FF19D898A7A73F1FB65310F70065B9486C32A7DA36A945CB81

Function 0000026CE68830DC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68830FD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883122
moneypunct.LIBCPMT ref: 0000026CE68831A5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68831BC
_CxxThrowException.LIBCMT ref: 0000026CE68831CD
std::_Facet_Register.LIBCPMT ref: 0000026CE68831EB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 77321c750d283a068eef52474f1328485b1adbfdf4c2edc2983fef81da2ed23e
Instruction ID: 7b32dda1712ca075c16d704417ebcfed1dba0be9544bf648fce838e4d3b64ff0
Opcode Fuzzy Hash: 77321c750d283a068eef52474f1328485b1adbfdf4c2edc2983fef81da2ed23e
Instruction Fuzzy Hash: 73417331228B094FE765FB69D4986A673F1FB75310F70055BA096C32A7DA36E8058781

Function 0000026CE68837FC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688381D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883842
messages.LIBCPMT ref: 0000026CE68838C5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68838DC
_CxxThrowException.LIBCMT ref: 0000026CE68838ED
std::_Facet_Register.LIBCPMT ref: 0000026CE688390B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 5cfbe0f19a11e7d9f6b8e2c9b460ff2103601be7b6c7b550dceed3157f851894
Instruction ID: ad12bb62267941d5c03a99382913e458573948d5bf1fd28be93e022b217a8bde
Opcode Fuzzy Hash: 5cfbe0f19a11e7d9f6b8e2c9b460ff2103601be7b6c7b550dceed3157f851894
Instruction Fuzzy Hash: 95418331128B094FE765FF59D4886B973B1FB75310F70065B9096C32A6DA36E9058B81

Function 0000026CE687C04C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C06D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C092
messages.LIBCPMT ref: 0000026CE687C115
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE687C12C
_CxxThrowException.LIBCMT ref: 0000026CE687C13D
std::_Facet_Register.LIBCPMT ref: 0000026CE687C15B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: abd0f29150cea064db7ea93e3bd1444df1ce42a532174cbae03d5b6ef2ad6a86
Instruction ID: e228041d3f73474e9a104fed77578c72b48e8a74f644ba098be9d9414eb33579
Opcode Fuzzy Hash: abd0f29150cea064db7ea93e3bd1444df1ce42a532174cbae03d5b6ef2ad6a86
Instruction Fuzzy Hash: A3414371128B084FE765FF19D499A76B3F1FB66310F30066B9095D32A7DE32A8458781

Function 0000026CE688359C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68835BD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68835E2
messages.LIBCPMT ref: 0000026CE6883665
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688367C
_CxxThrowException.LIBCMT ref: 0000026CE688368D
std::_Facet_Register.LIBCPMT ref: 0000026CE68836AB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 7ad4993a8b174b8363bb7502690be3ae1b561dbc89bbd99c915c9381e914f89e
Instruction ID: 3376560b9aae028b0d7294b86fd69aee05f56809976264e0b08b5a5d1a699d68
Opcode Fuzzy Hash: 7ad4993a8b174b8363bb7502690be3ae1b561dbc89bbd99c915c9381e914f89e
Instruction Fuzzy Hash: 7041B430528A084FE764FF59D4986B573B1FB75300F70062B9196C32A7CA36E805CB81

Function 0000026CE68824FC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688251D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882542
collate.LIBCPMT ref: 0000026CE68825C5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68825DC
_CxxThrowException.LIBCMT ref: 0000026CE68825ED
std::_Facet_Register.LIBCPMT ref: 0000026CE688260B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: 76c8dbfefe16807c6c2e03d2c02e8fce80c7731968c8574b3a75b952f183e87e
Instruction ID: e8f78a4b03aa517e56fd6d7aad7f9e1fe4241e36a7761d1db5fef46261288715
Opcode Fuzzy Hash: 76c8dbfefe16807c6c2e03d2c02e8fce80c7731968c8574b3a75b952f183e87e
Instruction Fuzzy Hash: 10418331128B084FE7A4FF59D4A8A7673F1FB65300F70056BA496C32A7CA36E805CB81

Function 0000026CE6897D40 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897D61

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897D86
messages.LIBCPMT ref: 0000026CE6897E09
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6897E20
_CxxThrowException.LIBCMT ref: 0000026CE6897E31
std::_Facet_Register.LIBCPMT ref: 0000026CE6897E4F

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 3d9e32fe7dd0b0532a8a56be85dacd11b9ba7591c2a82d48e1cf92cf00c2def1
Instruction ID: 3b6232108d38f498412d9b5d8beffbffd5b6b53598510c31330df137e61e7279
Opcode Fuzzy Hash: 3d9e32fe7dd0b0532a8a56be85dacd11b9ba7591c2a82d48e1cf92cf00c2def1
Instruction Fuzzy Hash: 03417331528E084FE765FF19D488ABA77B1FB55310F30156E908ED32A6DA36A8458781

Function 0000026CE6882D4C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882D6D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882D92
messages.LIBCPMT ref: 0000026CE6882E15
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6882E2C
_CxxThrowException.LIBCMT ref: 0000026CE6882E3D
std::_Facet_Register.LIBCPMT ref: 0000026CE6882E5B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 5b16358a03fb93621077fd88fa80582328bbc92a55aaa43dc3b6893833c7adb2
Instruction ID: 1b0a2a0847eea223375278dfb29f365217dcb2c3443560156596805664f6ecaa
Opcode Fuzzy Hash: 5b16358a03fb93621077fd88fa80582328bbc92a55aaa43dc3b6893833c7adb2
Instruction Fuzzy Hash: E0418331228E094FE765FB29D498AB677B1FB69300F70056B9485C32A3CA36E845C785

Function 0000026CE6897E70 Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897E91

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6897EB6
moneypunct.LIBCPMT ref: 0000026CE6897F39
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6897F50
_CxxThrowException.LIBCMT ref: 0000026CE6897F61
std::_Facet_Register.LIBCPMT ref: 0000026CE6897F7F

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID:
API String ID: 3809448442-0
Opcode ID: 3b1c8ff64b7d1c49a48d49447f4a4cc82ffe0b5f30dff20e234f5227c1eb22de
Instruction ID: 03b84fe879c63021ec580cad9d2bd2133078128c81bfb4fdca1b54bf390cfce6
Opcode Fuzzy Hash: 3b1c8ff64b7d1c49a48d49447f4a4cc82ffe0b5f30dff20e234f5227c1eb22de
Instruction Fuzzy Hash: B6419231528A084FF765FB29D488ABA77F1FB65300F30156ED08AD32A7DA76E8418781

Function 0000026CE6882E7C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882E9D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882EC2
messages.LIBCPMT ref: 0000026CE6882F45
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6882F5C
_CxxThrowException.LIBCMT ref: 0000026CE6882F6D
std::_Facet_Register.LIBCPMT ref: 0000026CE6882F8B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: c2f1e7ce1e411251038a4074910defcb6052e1f5b50779ecea276810bcf71a42
Instruction ID: e08b586cd0149be9f365fbea7e42e670ccc8a64461ce0466c50d5a91c3eb3dea
Opcode Fuzzy Hash: c2f1e7ce1e411251038a4074910defcb6052e1f5b50779ecea276810bcf71a42
Instruction Fuzzy Hash: B4418431128E094FE775FB29D498AB673B1FB65310F70055BA485C32A7CA76EC05C781

Function 0000026CE68836CC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68836ED

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883712
messages.LIBCPMT ref: 0000026CE6883795
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68837AC
_CxxThrowException.LIBCMT ref: 0000026CE68837BD
std::_Facet_Register.LIBCPMT ref: 0000026CE68837DB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: d42b49580f59bf9ee5cacfae17bbef844d338c838c87811a0b20812210dc57c3
Instruction ID: ee8193bf96bb242219d40554f157578c2f3e3feba2da5159de2fc1470d2803d5
Opcode Fuzzy Hash: d42b49580f59bf9ee5cacfae17bbef844d338c838c87811a0b20812210dc57c3
Instruction Fuzzy Hash: 02418371128E098FE7A4FF59D4896BA73B1FB75300F71056B9096C32A7CA36E841C781

Function 0000026CE687BDEC Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687BE0D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687BE32
messages.LIBCPMT ref: 0000026CE687BEB5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE687BECC
_CxxThrowException.LIBCMT ref: 0000026CE687BEDD
std::_Facet_Register.LIBCPMT ref: 0000026CE687BEFB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID:
API String ID: 620047600-0
Opcode ID: 3e8bbe698a1bf48928fd66137138659e259b7ccdec2d8507b5c72f1779f4d2df
Instruction ID: 86dfbf217956cc2b6a968c09316161b559ff8b70caa77d9cf32b33cffb153027
Opcode Fuzzy Hash: 3e8bbe698a1bf48928fd66137138659e259b7ccdec2d8507b5c72f1779f4d2df
Instruction Fuzzy Hash: 88415331128B088FE765FF19D498A66B3B2FB66310F30455BA195C32A6DE33E945CB81

Function 0000026CE688262C Relevance: 9.1, APIs: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688264D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6882672
collate.LIBCPMT ref: 0000026CE68826F5
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE688270C
_CxxThrowException.LIBCMT ref: 0000026CE688271D
std::_Facet_Register.LIBCPMT ref: 0000026CE688273B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID:
API String ID: 3240839640-0
Opcode ID: 60f3d123f906e935d9828c950a9bb343b450096d505eb81e70dd43da5b441a09
Instruction ID: 484ab97c0355884e1fdc3fe1a30a5be9df656d622bc1d7581b161b40efee4c25
Opcode Fuzzy Hash: 60f3d123f906e935d9828c950a9bb343b450096d505eb81e70dd43da5b441a09
Instruction Fuzzy Hash: EF41A331128E084FE765FF19D4A867673F1FB69300F70065B9596C32A3CA36E841C781

Function 0000026CE85F86E4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000026CE85F8761
_invoke_watson.LIBCMT ref: 0000026CE85F8849

Part of subcall function 0000026CE85FA508: _call_reportfault.LIBCMT ref: 0000026CE85FA530

_invoke_watson.LIBCMT ref: 0000026CE85F885E
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85F8716

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

Strings

:, xrefs: 0000026CE85F877F

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction ID: 6dd0b603e660ebc09c0dde6aff7abfb29bfa5d56ba1678ec12bc6b99c657c9b5
Opcode Fuzzy Hash: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction Fuzzy Hash: 4041C13272774481FB10AB26A80A7AD37A5F784BC4F699425DF9E17745DF3AD412C304

Function 0000026CE85F8864 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85F8896

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_malloc_crt.LIBCMT ref: 0000026CE85F88E1
_invoke_watson.LIBCMT ref: 0000026CE85F89C9

Part of subcall function 0000026CE85FA508: _call_reportfault.LIBCMT ref: 0000026CE85FA530

_invoke_watson.LIBCMT ref: 0000026CE85F89DE

Strings

:, xrefs: 0000026CE85F88FF

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction ID: ce543477ee196d7ee0583854c05858ec9fdd837a49dd79d0326d3b37e1cb767f
Opcode Fuzzy Hash: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction Fuzzy Hash: 3A41CF3232674581FB10AB26A80A3AD73A6F788BC4F689425DF9E17745CF3AD412C300

Function 0000026CE6875908 Relevance: 7.8, APIs: 5, Instructions: 295COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 0000026CE68759DC

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: f74a844098648da67d21de2c32495390ab1c3596fe8d82436c96308467037ff2
Instruction ID: 72d270c901d761d562b5c460043ddae9f08f93de3d6cf9fac505d92a37eef87a
Opcode Fuzzy Hash: f74a844098648da67d21de2c32495390ab1c3596fe8d82436c96308467037ff2
Instruction Fuzzy Hash: FFB1BC30128B488AE774FB25C4597BAF7F1FB96301F60492FA4CAC3193DE76A5458B42

Function 0000026CE6892578 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE689262F
_Mpunct.LIBCPMT ref: 0000026CE689266E
std::ios_base::getloc.LIBCPMTD ref: 0000026CE68925E3

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883A7D
Part of subcall function 0000026CE6883A5C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883AA2

std::ios_base::getloc.LIBCPMTD ref: 0000026CE68926E1
_Stoulx.LIBCPMT ref: 0000026CE689271A

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_Mpunctstd::_std::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 1104148741-0
Opcode ID: 166b93a94447b86139d1c22adbbc14e30780d0c9cc7094b737ceab0ca3da017a
Instruction ID: 09863625ee6db1b87b8b367fec9f429e1698281129da51bba28e8687d021fa56
Opcode Fuzzy Hash: 166b93a94447b86139d1c22adbbc14e30780d0c9cc7094b737ceab0ca3da017a
Instruction Fuzzy Hash: 59815331628A0C9FDB68FB59D4596BDB3F1EB56300F60152EE48BD3293DE32A845C781

Function 0000026CE68918D0 Relevance: 7.8, APIs: 5, Instructions: 264COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE6891987
_Mpunct.LIBCPMT ref: 0000026CE68919C6
std::ios_base::getloc.LIBCPMTD ref: 0000026CE689193B

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE688394D
Part of subcall function 0000026CE688392C: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883972

std::ios_base::getloc.LIBCPMTD ref: 0000026CE6891A39
_Stoulx.LIBCPMT ref: 0000026CE6891A72

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_Mpunctstd::_std::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 1104148741-0
Opcode ID: 16286996adb80dee7d5b064b22652e5f05a5085a5d70cf9cb1c6c826df7b05ca
Instruction ID: 6c074eda3eeacbb9fa396c4c1d280ca67efd7f2d98905b42bb30790b49f44818
Opcode Fuzzy Hash: 16286996adb80dee7d5b064b22652e5f05a5085a5d70cf9cb1c6c826df7b05ca
Instruction Fuzzy Hash: 9F713431628A0C9FDB68FB59D4596BDB3F1EB96300F60152EE48BD3192DE32AC45C781

Function 0000026CE68800C8 Relevance: 7.8, APIs: 5, Instructions: 254COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE688017A
_Mpunct.LIBCPMT ref: 0000026CE68801B9
std::ios_base::getloc.LIBCPMTD ref: 0000026CE688012D

Part of subcall function 0000026CE68737E8: std::locale::locale.LIBCPMTD ref: 0000026CE687380C

Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2CD
Part of subcall function 0000026CE687C2AC: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE687C2F2

std::ios_base::getloc.LIBCPMTD ref: 0000026CE6880225
_Stoulx.LIBCPMT ref: 0000026CE688025C

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_Mpunctstd::_std::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 1104148741-0
Opcode ID: 3d88c636a073cdcdd73c6a924e436b277ebbf35aadf33963d9bcfa329ff9a495
Instruction ID: bc8f2057b109df405263661585af1ab0240f2b34fa814c189884df99fec8c58f
Opcode Fuzzy Hash: 3d88c636a073cdcdd73c6a924e436b277ebbf35aadf33963d9bcfa329ff9a495
Instruction Fuzzy Hash: 6B71B431628F0C4FEB68FB59D4597BDB3F1EB59310F70021AE48AD3293DE66A8458781

Function 0000026CE85C6060 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 0000026CE85C6134

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: af233356ab44033a1af5434a4fe9d0445c43cbdf01476d6f5b86da92ac9fc8ae
Instruction ID: 35ab534e45dc5b5bd29cd6182603c1901ef43f81aef5446dc3f72b07432699d8
Opcode Fuzzy Hash: af233356ab44033a1af5434a4fe9d0445c43cbdf01476d6f5b86da92ac9fc8ae
Instruction Fuzzy Hash: F0A1F93620F68084FA60FB55E4993BAB3B0E7D4790F604127E6CE47A9ADF6AC545CF40

Function 0000026CE85E2028 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE85E20DF
_Mpunct.LIBCPMT ref: 0000026CE85E211E
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E2093

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40A5
Part of subcall function 0000026CE85D4084: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D40CA
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D40F4
Part of subcall function 0000026CE85D4084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D419E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E2191
_Stoulx.LIBCPMT ref: 0000026CE85E21CA

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Mpunctstd::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 3293814644-0
Opcode ID: 1b6468ebf12914b2f0fe8338e001e18fabad8228a10c305a24cbb031952596d2
Instruction ID: 66d30812998f6e16f7ba850330ee98398104323c979bffc148e8e7de55cc3d06
Opcode Fuzzy Hash: 1b6468ebf12914b2f0fe8338e001e18fabad8228a10c305a24cbb031952596d2
Instruction Fuzzy Hash: A5519F3271BB408AFB10EBA5E8486EE73B0F785B98F500516EE9E17B99DE36C045C750

Function 0000026CE85E2CD0 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE85E2D87
_Mpunct.LIBCPMT ref: 0000026CE85E2DC6
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E2D3B

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41D5
Part of subcall function 0000026CE85D41B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85D41FA
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D4224
Part of subcall function 0000026CE85D41B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85D42CE

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E2E39
_Stoulx.LIBCPMT ref: 0000026CE85E2E72

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Mpunctstd::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 3293814644-0
Opcode ID: ba231bb55e8ad13bb8c84fadf00820e2b831a140557f64e95a63da8dc5e447dc
Instruction ID: a732a618d0cfd8c7c047a5eaf459d80b04044eb51a72ecde10c223a0927e4336
Opcode Fuzzy Hash: ba231bb55e8ad13bb8c84fadf00820e2b831a140557f64e95a63da8dc5e447dc
Instruction Fuzzy Hash: DC51BE3271BB408AFB10EBA5D8486EE7371F785B98F600516EE8E57B99DE36C005C750

Function 0000026CE85D0820 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000026CE85D08D2
_Mpunct.LIBCPMT ref: 0000026CE85D0911
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D0885

Part of subcall function 0000026CE85C3F40: std::locale::locale.LIBCPMTD ref: 0000026CE85C3F64

Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA25
Part of subcall function 0000026CE85CCA04: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85CCA4A
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCA74
Part of subcall function 0000026CE85CCA04: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85CCB1E

std::ios_base::getloc.LIBCPMTD ref: 0000026CE85D097D
_Stoulx.LIBCPMT ref: 0000026CE85D09B4

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Mpunctstd::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 3293814644-0
Opcode ID: fc64bed50a84d4864b71b968ac71fd66e0380d981a3e2c2678fe09f174b3caf6
Instruction ID: e2699760fb2d7ff261aef09d31dd991ede18dc72cf89c76dc43d7728aacb5b77
Opcode Fuzzy Hash: fc64bed50a84d4864b71b968ac71fd66e0380d981a3e2c2678fe09f174b3caf6
Instruction Fuzzy Hash: 0251CE3271BB408AFB10EB65E0487EE33B1F785B98F504516EE8A17B99DE36C444C740

Function 0000026CE6883B8C Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883BAD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883BD2
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883C6C
_CxxThrowException.LIBCMT ref: 0000026CE6883C7D
std::_Facet_Register.LIBCPMT ref: 0000026CE6883C9B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: b9b3160839c62794a2f4426fd174e2d910c5656f38ad309ad83c3aeddb3b6001
Instruction ID: 3c5b06aa5013fc6b8b96d9cdb3a4122c7e75403eac1d133574bb5fd04a5ef857
Opcode Fuzzy Hash: b9b3160839c62794a2f4426fd174e2d910c5656f38ad309ad83c3aeddb3b6001
Instruction Fuzzy Hash: F6418231128A594FE764FF5AD4986B973F2FB79300F70065B9086C32A7CA26E845CB81

Function 0000026CE6883CBC Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883CDD

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883D02
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883D9C
_CxxThrowException.LIBCMT ref: 0000026CE6883DAD
std::_Facet_Register.LIBCPMT ref: 0000026CE6883DCB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 83099b52044964ab2d8c21b0e66d69e068add0a1ffda037c7dbd6fda676a952f
Instruction ID: bd86ae1003cdffa86fc2b14e6c30c3ed1152eed557846a57bc90edc47b12fea5
Opcode Fuzzy Hash: 83099b52044964ab2d8c21b0e66d69e068add0a1ffda037c7dbd6fda676a952f
Instruction Fuzzy Hash: F8416231128A084FE7B4FF59D49867A73F1FB79310F70066BA095C32A7DA36E9458781

Function 0000026CE6898200 Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6898221

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6898246
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68982E0
_CxxThrowException.LIBCMT ref: 0000026CE68982F1
std::_Facet_Register.LIBCPMT ref: 0000026CE689830F

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: fb5e24ca2653538eeac2f84e8a1a1624b26305bbc8348ff8a181a437a36e0ba9
Instruction ID: f2a1b02e2edf7bad7f317f7990bd42ec9fe069b295b0eb1596313ab7be059696
Opcode Fuzzy Hash: fb5e24ca2653538eeac2f84e8a1a1624b26305bbc8348ff8a181a437a36e0ba9
Instruction Fuzzy Hash: 9A41C130528E094FE764FF69D488A7573F1FB69310F300A5EA08AC31A7CA36E8418781

Function 0000026CE6883F1C Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883F3D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883F62
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883FFC
_CxxThrowException.LIBCMT ref: 0000026CE688400D
std::_Facet_Register.LIBCPMT ref: 0000026CE688402B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 78f14f210944464f9e1e1c2a8d13bcf1eae8f7fb983aa7ce8c5333fa9df294e0
Instruction ID: 2d12c6ac9ea5568447bde8f49f3574d7085a950fe8cbeaa5728f1950d63b42b8
Opcode Fuzzy Hash: 78f14f210944464f9e1e1c2a8d13bcf1eae8f7fb983aa7ce8c5333fa9df294e0
Instruction Fuzzy Hash: B0417431128B184FE764FF5AD498A6673F1FB75310F70065BA085C32A7CA76E845CB81

Function 0000026CE68980D0 Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68980F1

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6898116
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE68981B0
_CxxThrowException.LIBCMT ref: 0000026CE68981C1
std::_Facet_Register.LIBCPMT ref: 0000026CE68981DF

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: bae5d00c57f016e6d8c0dc1a7b8c8c15f75d85941c89fc877493011a6d48aa01
Instruction ID: d72679b78ebfcb2d5a55c5d5a4792d7579d75a5ab275f88c02857508cdb76155
Opcode Fuzzy Hash: bae5d00c57f016e6d8c0dc1a7b8c8c15f75d85941c89fc877493011a6d48aa01
Instruction Fuzzy Hash: FC418371528A098FE765FF29D489A7573F1EB66310F30095F909EC31A7DA36E8418781

Function 0000026CE6883DEC Relevance: 7.6, APIs: 5, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883E0D

Part of subcall function 0000026CE687BB54: _lock.LIBCMT ref: 0000026CE687BB66

std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE6883E32
std::bad_exception::bad_exception.LIBCMT ref: 0000026CE6883ECC
_CxxThrowException.LIBCMT ref: 0000026CE6883EDD
std::_Facet_Register.LIBCPMT ref: 0000026CE6883EFB

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID:
API String ID: 1776536810-0
Opcode ID: 8201b41f25ef33c3613c1a68ee4a65115b9c88f9471d48fa011a91e106f7afff
Instruction ID: f35948d67663f35ab990d6648443d3aa2a4d85eb2ecd4ccadcae16e4a2ff6054
Opcode Fuzzy Hash: 8201b41f25ef33c3613c1a68ee4a65115b9c88f9471d48fa011a91e106f7afff
Instruction Fuzzy Hash: A2416031128A088FE764FB59D49867673B1FB75310F70095BA495C32A6DA37EC45CB81

Function 0000026CE68756C8 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0000026CE6875720
char_traits.LIBCPMTD ref: 0000026CE6875759
char_traits.LIBCPMTD ref: 0000026CE6875774
char_traits.LIBCPMTD ref: 0000026CE68757A6

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 138815e70514d2f135f1c707d96a860ed4914229c68fb56bc0cde8100c9a4ae3
Instruction ID: f859d46746b0fd1325775a4d171326372a88743481a6c485b9a1db7a2a350d0b
Opcode Fuzzy Hash: 138815e70514d2f135f1c707d96a860ed4914229c68fb56bc0cde8100c9a4ae3
Instruction Fuzzy Hash: 4B41FC70138B458AE764FB26C4597BAB6F0FF96341F70092BA1C6D61A3DE27E944C702

Function 0000026CE85FD46C Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85FD4CE
_isleadbyte_l.LIBCMT ref: 0000026CE85FD4FE
MultiByteToWideChar.KERNEL32 ref: 0000026CE85FD53D
MultiByteToWideChar.KERNEL32 ref: 0000026CE85FD58B
_errno.LIBCMT ref: 0000026CE85FD595

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 1d846ac782697e1626f60741b10654be5d980ecfef08fe52ee6ab297ca0a43db
Instruction ID: 521de9750e868485e8501e3c7748a11e79e2dddc08ebf7701b8466fbc8ebceb9
Opcode Fuzzy Hash: 1d846ac782697e1626f60741b10654be5d980ecfef08fe52ee6ab297ca0a43db
Instruction Fuzzy Hash: 6241C37221B78086F761AF15D149339BBB5F786B88F244125EBCA57B95CF3BC4418700

Function 0000026CE85C5E20 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0000026CE85C5E78
char_traits.LIBCPMTD ref: 0000026CE85C5EB1
char_traits.LIBCPMTD ref: 0000026CE85C5ECC
char_traits.LIBCPMTD ref: 0000026CE85C5EFE

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: efd17d778424b9709a2ebecd350b9a00f791cf1ba8a6ebccbfb2f640782f2fd7
Instruction ID: bfd074893560207bc70420e3d3d171656123fe8d7bc77e80f21a5b88196dae43
Opcode Fuzzy Hash: efd17d778424b9709a2ebecd350b9a00f791cf1ba8a6ebccbfb2f640782f2fd7
Instruction Fuzzy Hash: 9741097221F54081FA10BBA5E49937A7270FBC1785F700123E6CE87AAADE2BC9458F40

Function 0000026CE85F4448 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000026CE85F4455

Part of subcall function 0000026CE85FD224: _getptd_noexit.LIBCMT ref: 0000026CE85FD22A
Part of subcall function 0000026CE85FD224: _amsg_exit.LIBCMT ref: 0000026CE85FD23A

_inconsistency.LIBCMT ref: 0000026CE85F4463

Part of subcall function 0000026CE85FEC80: DecodePointer.KERNEL32 ref: 0000026CE85FEC8B

_getptd.LIBCMT ref: 0000026CE85F4468
_inconsistency.LIBCMT ref: 0000026CE85F4484
_getptd.LIBCMT ref: 0000026CE85F4494

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction ID: d6837c72617e9dc5a9086355b75787289452fd82f739c43470202f3fb1b193c8
Opcode Fuzzy Hash: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction Fuzzy Hash: EFF0FE3620B98080FE71BB55E24F2BD76B1A758B90F3D5521E6C61B2879F27C491C251

Function 0000026CE860E4CD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0000026CE85F4448: _getptd.LIBCMT ref: 0000026CE85F4455
Part of subcall function 0000026CE85F4448: _inconsistency.LIBCMT ref: 0000026CE85F4463
Part of subcall function 0000026CE85F4448: _getptd.LIBCMT ref: 0000026CE85F4468
Part of subcall function 0000026CE85F4448: _inconsistency.LIBCMT ref: 0000026CE85F4484

__DestructExceptionObject.LIBCMT ref: 0000026CE860E51A
_getptd.LIBCMT ref: 0000026CE860E520
_getptd.LIBCMT ref: 0000026CE860E533

Part of subcall function 0000026CE85F44D8: _getptd.LIBCMT ref: 0000026CE85F44E1

Strings

csm, xrefs: 0000026CE860E4ED

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction ID: 619e802359a56153a5ba6c6fa672da6bc170cdf5e101faed8d43a1d88848dee1
Opcode Fuzzy Hash: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction Fuzzy Hash: 710167B610764185EB32BF31E4493BD33B4E755755F251825D9C98A785EF23D881C340

Function 0000026CE85F3770 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 0000026CE85F377E
malloc.LIBCMT ref: 0000026CE85F378A

Part of subcall function 0000026CE85F22A8: _FF_MSGBANNER.LIBCMT ref: 0000026CE85F22D8
Part of subcall function 0000026CE85F22A8: _NMSG_WRITE.LIBCMT ref: 0000026CE85F22E2
Part of subcall function 0000026CE85F22A8: HeapAlloc.KERNEL32 ref: 0000026CE85F22FD
Part of subcall function 0000026CE85F22A8: _callnewh.LIBCMT ref: 0000026CE85F2316
Part of subcall function 0000026CE85F22A8: _errno.LIBCMT ref: 0000026CE85F2321
Part of subcall function 0000026CE85F22A8: _errno.LIBCMT ref: 0000026CE85F232C

_CxxThrowException.LIBCMT ref: 0000026CE85F37D3

Part of subcall function 0000026CE85F3FB8: RtlPcToFileHeader.KERNEL32 ref: 0000026CE85F4026
Part of subcall function 0000026CE85F3FB8: RaiseException.KERNEL32 ref: 0000026CE85F4065

Strings

bad allocation, xrefs: 0000026CE85F379A

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: b642b03be230f377a94fb8bf127ac4337ba363d888bade25789cd85e7bf78fa8
Instruction ID: 2faa049ac7401391b90ee4164b37fbf6d1f86f798834320d2f46fcbecf3796c5
Opcode Fuzzy Hash: b642b03be230f377a94fb8bf127ac4337ba363d888bade25789cd85e7bf78fa8
Instruction Fuzzy Hash: 29F062B522BB4A90FE60B751A00A2F573B4E784384F640410D9CE0B6A6EF2FC249CB01

Function 0000026CE6880EB8 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 0000026CE6880E4D
fclose.LIBCMT ref: 0000026CE6880E5A
_wfsopen.LIBCMT ref: 0000026CE6880E6F
fseek.LIBCMT ref: 0000026CE6880E89

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction ID: f2453651b8b2ddb29171693b9a6e50b24d12217b93c60b2f70a38ff27dd7458e
Opcode Fuzzy Hash: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction Fuzzy Hash: 7531D931234A094EE7F8BA5D949A37672E1E746304F74446E94CBC3393D52BDC418741

Function 0000026CE6886398 Relevance: 6.1, APIs: 4, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE68A3018: malloc.LIBCMT ref: 0000026CE68A3032

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE6886414
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE688643C
free.LIBCMT ref: 0000026CE6886454
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE688646B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: c2fdb474924eb8315d998c80493699ed0ab12c0f657938f58dd9487b9441d48b
Instruction ID: 4f8c2cee3bee104706fa6f9f69cb611ca514dc0f068064f9ae4ffcc3289397ba
Opcode Fuzzy Hash: c2fdb474924eb8315d998c80493699ed0ab12c0f657938f58dd9487b9441d48b
Instruction Fuzzy Hash: 7531A470128B098FD7B5FF19D099BA673F0FBA9310F60029A9489C7293DB36D840C781

Function 0000026CE6886490 Relevance: 6.1, APIs: 4, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE68A3018: malloc.LIBCMT ref: 0000026CE68A3032

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE688650C
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE6886534
free.LIBCMT ref: 0000026CE688654C
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE6886563

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: b0350cc8b461ada8f143b32dd75d94f1cb74beae973b0a62e1c342981cbefe1a
Instruction ID: 64c3f222815dda6e391982aeb79ab84fdf8591d8073db8ea0ed02a00aaa51ea8
Opcode Fuzzy Hash: b0350cc8b461ada8f143b32dd75d94f1cb74beae973b0a62e1c342981cbefe1a
Instruction Fuzzy Hash: DB318171128B098FDB65FF19D089BA673F0FB69311F60029A9489C72A7DB76D840C781

Function 0000026CE6898A6C Relevance: 6.1, APIs: 4, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE68A3018: malloc.LIBCMT ref: 0000026CE68A3032

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE6898AE8
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE6898B10
free.LIBCMT ref: 0000026CE6898B28
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE6898B3F

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: 0c3ddc91d2b006acc8b60784553b8ba10a7dca4d57a8f93519ec96857e636940
Instruction ID: 9e0b74d32815f0fa05a0358af4d9f9cb747e39763a0cc2a47cfda1ab3d86faca
Opcode Fuzzy Hash: 0c3ddc91d2b006acc8b60784553b8ba10a7dca4d57a8f93519ec96857e636940
Instruction Fuzzy Hash: A93172B1128B098FDB75FF19C089BA673F0FB69311F64069AD48AC7196DB72D800C781

Function 0000026CE85F7788 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE85F77B2

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_malloc_crt.LIBCMT ref: 0000026CE85F77F5
_invoke_watson.LIBCMT ref: 0000026CE85F78BA

Part of subcall function 0000026CE85FA508: _call_reportfault.LIBCMT ref: 0000026CE85FA530

_invoke_watson.LIBCMT ref: 0000026CE85F78D0

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction ID: 43c327ce2324fa99c5c3bc0c41da99ab21e124dfb699758aecd2b43606d45757
Opcode Fuzzy Hash: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction Fuzzy Hash: 7631933271768582FB15AB25D91A3AD77B1E785BC4F188125DB8A0BB99DF3AD002C704

Function 0000026CE6875E28 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000026CE6875EBC

Part of subcall function 0000026CE68A1DBC: _errno.LIBCMT ref: 0000026CE68A1DE5
Part of subcall function 0000026CE68A1DBC: _invalid_parameter_noinfo.LIBCMT ref: 0000026CE68A1DF0

fgetpos.LIBCMT ref: 0000026CE6875ED6
fpos.LIBCPMTD ref: 0000026CE6875EEB
fpos.LIBCPMTD ref: 0000026CE6875F2B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: fpos$_errno_fseeki64_invalid_parameter_noinfofgetpos
String ID:
API String ID: 3188862907-0
Opcode ID: c6c53303b0747acdde5ada9e622c71b4572c09a9b9df7f851f5bf6a1ead528d1
Instruction ID: acc42888dbbc029fafe7740f9e51aff14ac5c3c684bd75a713055d5a3ffd29b0
Opcode Fuzzy Hash: c6c53303b0747acdde5ada9e622c71b4572c09a9b9df7f851f5bf6a1ead528d1
Instruction Fuzzy Hash: BB31E2701287488FD754FB19C44876AB7F1FB9A344F64052EE4C9C32A7DA76E841C742

Function 0000026CE6875D18 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000026CE6875DB1
fgetpos.LIBCMT ref: 0000026CE6875DCB
fpos.LIBCPMTD ref: 0000026CE6875DE0
fpos.LIBCPMTD ref: 0000026CE6875E0B

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: fpos$_fseeki64fgetpos
String ID:
API String ID: 1811617113-0
Opcode ID: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction ID: e331e0e1c30a978874cd9fc596b89851680cf20187a193ec49d2efbbefe5fad7
Opcode Fuzzy Hash: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction Fuzzy Hash: BA319D305287448FD7A4FB19C44DB6AB7F1FB96345F60096AE589C31A2CA72E841CB46

Function 0000026CE85D1610 Relevance: 6.1, APIs: 4, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 0000026CE85D15A5
fclose.LIBCMT ref: 0000026CE85D15B2
_wfsopen.LIBCMT ref: 0000026CE85D15C7
fseek.LIBCMT ref: 0000026CE85D15E1

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction ID: a81b63d5c30d2e77febaa69f39e839f69f69ba2df5a4e7d6159d1a1ec074751a
Opcode Fuzzy Hash: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction Fuzzy Hash: 1121EF3176BA4084FA64EA0A954977BB2B1A785B86F384121CE8B837D1DE3FC4418B40

Function 0000026CE860CB40 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE860CB64

Part of subcall function 0000026CE85F3B7C: _getptd.LIBCMT ref: 0000026CE85F3B92
Part of subcall function 0000026CE85F3B7C: __updatetlocinfo.LIBCMT ref: 0000026CE85F3BC7
Part of subcall function 0000026CE85F3B7C: __updatetmbcinfo.LIBCMT ref: 0000026CE85F3BEE

_errno.LIBCMT ref: 0000026CE860CB70

Part of subcall function 0000026CE85F3B0C: _getptd_noexit.LIBCMT ref: 0000026CE85F3B10

_invalid_parameter_noinfo.LIBCMT ref: 0000026CE860CB7B
strchr.LIBCMT ref: 0000026CE860CB91

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction ID: 6665ad2adc0e62ec26389b02a83b465f4607a928cb23fdbcae9995c27ad6925e
Opcode Fuzzy Hash: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction Fuzzy Hash: E221D4F212E2A441F6703615905837DBBA6E344B94F384125E6C6C66C5DB2FC6418718

Function 0000026CE85E91C4 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE85F3770: malloc.LIBCMT ref: 0000026CE85F378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE85E9240
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE85E9268
free.LIBCMT ref: 0000026CE85E9280
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE85E9297

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: d8e69efa26ad0008533831846f76d24351a0b3f39eb347073c5dfcd3e47a997e
Instruction ID: 8157f6a66430312105eeea8a646d9999093434632803c4d691630d329b6a28c2
Opcode Fuzzy Hash: d8e69efa26ad0008533831846f76d24351a0b3f39eb347073c5dfcd3e47a997e
Instruction Fuzzy Hash: 7A218B7220BB4081FF24EF11E4583A9B3B4F794BA4FA44222CA9E47395DF3AC945C790

Function 0000026CE85C6580 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000026CE85C6614

Part of subcall function 0000026CE85F2514: _errno.LIBCMT ref: 0000026CE85F253D
Part of subcall function 0000026CE85F2514: _invalid_parameter_noinfo.LIBCMT ref: 0000026CE85F2548

fgetpos.LIBCMT ref: 0000026CE85C662E
fpos.LIBCPMTD ref: 0000026CE85C6643
fpos.LIBCPMTD ref: 0000026CE85C6683

Part of subcall function 0000026CE85F2AA4: _errno.LIBCMT ref: 0000026CE85F2AAD
Part of subcall function 0000026CE85F2AA4: _invalid_parameter_noinfo.LIBCMT ref: 0000026CE85F2AB8

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfofpos$_fseeki64fgetpos
String ID:
API String ID: 1989672365-0
Opcode ID: e02842f5a42da3625d84d50036dede68edc7dbfdcb998bdce8beb25ad7a6383a
Instruction ID: 8b5897c9f7e31a8e799708fd1f658afcd9aadc23f076df318efad3ae7051483b
Opcode Fuzzy Hash: e02842f5a42da3625d84d50036dede68edc7dbfdcb998bdce8beb25ad7a6383a
Instruction Fuzzy Hash: 0E31DE7620AA8485EA10EB15E49536AB7B0F7C5784F604027EBCE47B6ADF7BC5408F40

Function 0000026CE85D6AF0 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE85F3770: malloc.LIBCMT ref: 0000026CE85F378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE85D6B6C
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE85D6B94
free.LIBCMT ref: 0000026CE85D6BAC
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE85D6BC3

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: ee97dc229c5cd99bb1ca05c9355866ee283a5751f5faa2f00eedab80158d67f4
Instruction ID: 1a36e8b2f4b0bb83064d078cd329d859985da403fe0b3a2580263660e2730760
Opcode Fuzzy Hash: ee97dc229c5cd99bb1ca05c9355866ee283a5751f5faa2f00eedab80158d67f4
Instruction Fuzzy Hash: 7E219A7220BB4485FB20EF11D0583AA73B4F784B94FA14226CE9A873D5DF3AC906C780

Function 0000026CE85D6BE8 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000026CE85F3770: malloc.LIBCMT ref: 0000026CE85F378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE85D6C64
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000026CE85D6C8C
free.LIBCMT ref: 0000026CE85D6CA4
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE85D6CBB

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: 1c985824af1acae9496c5e71a96abd0544d665edfd3f96118f34935afdf6e220
Instruction ID: c4105a1accb166e75157ac8164c591b7e953f6df5d8e099688f92f8a88feefe2
Opcode Fuzzy Hash: 1c985824af1acae9496c5e71a96abd0544d665edfd3f96118f34935afdf6e220
Instruction Fuzzy Hash: 50217C3221BB4081FB24EF11D8583AA77B4F784B90F654222CA9E473E5DF3AC946C780

Function 0000026CE85C6470 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000026CE85C6509
fgetpos.LIBCMT ref: 0000026CE85C6523
fpos.LIBCPMTD ref: 0000026CE85C6538
fpos.LIBCPMTD ref: 0000026CE85C6563

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: fpos$_fseeki64fgetpos
String ID:
API String ID: 1811617113-0
Opcode ID: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction ID: 29570da0b1d710a80458a1c2636bcee3f14fc6ca793bc3eff4cc586accc2f3f3
Opcode Fuzzy Hash: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction Fuzzy Hash: 9E31AD7620AA8485EA50EB15E49536AB7B0F7C5784F600417EBCE47BA9CF7BC944CF40

Function 0000026CE687AF88 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0000026CE687AFA3

Part of subcall function 0000026CE687B6C0: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0000026CE687B6EE

__int64.LIBCPMTD ref: 0000026CE687AFBF

Part of subcall function 0000026CE6871398: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68713B3

_aligned_msize.LIBCMTD ref: 0000026CE687AFD4

Part of subcall function 0000026CE68714D8: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0000026CE68714FA

codecvt.LIBCPMTD ref: 0000026CE687AFDD

Part of subcall function 0000026CE6871B18: std::locale::c_str.LIBCPMTD ref: 0000026CE6871B7A
Part of subcall function 0000026CE6871B18: std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE6871B87
Part of subcall function 0000026CE6871B18: collate.LIBCPMTD ref: 0000026CE6871BB3
Part of subcall function 0000026CE6871B18: std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE6871BF7

Part of subcall function 0000026CE6874778: Concurrency::cancellation_token::_Clear.LIBCPMTD ref: 0000026CE68747A0
Part of subcall function 0000026CE6874778: malloc.LIBCMT ref: 0000026CE68747F9

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Locimp::_std::_std::locale::_$LocimpLocinfo$AddfacClearConcurrency::cancellation_token::_Locimp_Locinfo::_Locinfo::~_LockitLockit::_New___int64_aligned_msizecodecvtcollatemallocstd::locale::c_str
String ID:
API String ID: 2541660624-0
Opcode ID: 58eda042d10801f7b57768f629ec788ac31b79f2513f95b0baad2b10f0f1f92d
Instruction ID: af58ac42eb0edf0db781cee118c5335a3e428419e65b19b38853ec89c4b59521
Opcode Fuzzy Hash: 58eda042d10801f7b57768f629ec788ac31b79f2513f95b0baad2b10f0f1f92d
Instruction Fuzzy Hash: 9D11B174228B489FD794FF2DC489B69B7F1FB99300FA40559B485C72A1D736E844C741

Function 0000026CE6871A28 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 0000026CE6871A52

Part of subcall function 0000026CE6871808: std::locale::facet::facet.LIBCPMTD ref: 0000026CE6871820

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE6871A76

Part of subcall function 0000026CE6871088: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE68710A9
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE68710BB
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE68710CD
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE68710DF
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE68710F1
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE6871103
Part of subcall function 0000026CE6871088: _Yarn.LIBCPMTD ref: 0000026CE6871115
Part of subcall function 0000026CE6871088: std::bad_exception::bad_exception.LIBCMTD ref: 0000026CE687112F
Part of subcall function 0000026CE6871088: _CxxThrowException.LIBCMT ref: 0000026CE6871140

codecvt.LIBCPMTD ref: 0000026CE6871A89

Part of subcall function 0000026CE6871C48: std::_Locinfo::_Getcvt.LIBCPMTD ref: 0000026CE6871C74

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE6871A94

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_std::bad_exception::bad_exception$ExceptionGetcvtLocinfo::~_LockitLockit::_Throwcodecvtstd::locale::facet::facet
String ID:
API String ID: 3485682108-0
Opcode ID: 3871120677c23c23d88de505935f11af323c157f0d755e3ee0aa1d801b5552f5
Instruction ID: 934e12a09ea7c84f736c1366ad4926d39610ca4148cc09f42e5eacebf0102378
Opcode Fuzzy Hash: 3871120677c23c23d88de505935f11af323c157f0d755e3ee0aa1d801b5552f5
Instruction Fuzzy Hash: DD013630128B8C8FD7A4FB18D445BDBB3E1FB95300FA0561EA0D9C3191DB76A909CB42

Function 0000026CE85CB6E0 Relevance: 6.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0000026CE85CB6FB

Part of subcall function 0000026CE85CBE18: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0000026CE85CBE46

__int64.LIBCPMTD ref: 0000026CE85CB717

Part of subcall function 0000026CE85C1AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85C1B0B
Part of subcall function 0000026CE85C1AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85C1B3D

_aligned_msize.LIBCMTD ref: 0000026CE85CB72C

Part of subcall function 0000026CE85C1C30: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0000026CE85C1C52

codecvt.LIBCPMTD ref: 0000026CE85CB735

Part of subcall function 0000026CE85C2270: std::locale::c_str.LIBCPMTD ref: 0000026CE85C22D2
Part of subcall function 0000026CE85C2270: std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE85C22DF
Part of subcall function 0000026CE85C2270: collate.LIBCPMTD ref: 0000026CE85C230B
Part of subcall function 0000026CE85C2270: std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE85C234F

Part of subcall function 0000026CE85C4ED0: Concurrency::cancellation_token::_Clear.LIBCPMTD ref: 0000026CE85C4EF8
Part of subcall function 0000026CE85C4ED0: malloc.LIBCMT ref: 0000026CE85C4F51

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Locimp::_std::locale::_$LocimpLocinfoLockit$AddfacClearConcurrency::cancellation_token::_Locimp_Locinfo::_Locinfo::~_Lockit::_Lockit::~_New___int64_aligned_msizecodecvtcollatemallocstd::locale::c_str
String ID:
API String ID: 1811419688-0
Opcode ID: 7af322f36f17e67862f741fc24bfc0139ff588b013d2130c712c45a990bd171e
Instruction ID: 63586966cb18da2ea76861c47a9452d22c972d73f6cf35a03d092fa487c26908
Opcode Fuzzy Hash: 7af322f36f17e67862f741fc24bfc0139ff588b013d2130c712c45a990bd171e
Instruction Fuzzy Hash: 0901403622BB4481EB40EF1AE49936A7370F7C4B90F605612FE9E437A5CF3AC0558B00

Function 0000026CE85C2180 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 0000026CE85C21AA

Part of subcall function 0000026CE85C1F60: std::locale::facet::facet.LIBCPMTD ref: 0000026CE85C1F78

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000026CE85C21CE

Part of subcall function 0000026CE85C17E0: std::_Lockit::_Lockit.LIBCPMT ref: 0000026CE85C1801
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C1813
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C1825
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C1837
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C1849
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C185B
Part of subcall function 0000026CE85C17E0: _Yarn.LIBCPMTD ref: 0000026CE85C186D
Part of subcall function 0000026CE85C17E0: std::bad_exception::bad_exception.LIBCMTD ref: 0000026CE85C1887
Part of subcall function 0000026CE85C17E0: _CxxThrowException.LIBCMT ref: 0000026CE85C1898
Part of subcall function 0000026CE85C17E0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000026CE85C18A7

codecvt.LIBCPMTD ref: 0000026CE85C21E1

Part of subcall function 0000026CE85C23A0: std::_Locinfo::_Getcvt.LIBCPMTD ref: 0000026CE85C23CC

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000026CE85C21EC

Part of subcall function 0000026CE85C18C0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0000026CE85C18CE
Part of subcall function 0000026CE85C18C0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000026CE85C1941

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::_$Yarn$Locinfo::_$LocinfoLockitstd::bad_exception::bad_exception$ExceptionGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwcodecvtstd::locale::facet::facet
String ID:
API String ID: 2580637281-0
Opcode ID: adcdcac3d387f150fc2c396cd21c3c6a73979b2da0c270e4eb99f33f457a8872
Instruction ID: 433cffe447fdc7e65e75d1f5a406d9ec4101b98ca97a64acad43622aed6582c4
Opcode Fuzzy Hash: adcdcac3d387f150fc2c396cd21c3c6a73979b2da0c270e4eb99f33f457a8872
Instruction Fuzzy Hash: E7F0FF7226BBC191DA60EB14E4553AA7331F7C17A0F505612E6EE436E9CF2EC508CB01

Function 0000026CE68A810C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE68A813E

Part of subcall function 0000026CE68A3424: _getptd.LIBCMT ref: 0000026CE68A343A
Part of subcall function 0000026CE68A3424: __updatetlocinfo.LIBCMT ref: 0000026CE68A346F
Part of subcall function 0000026CE68A3424: __updatetmbcinfo.LIBCMT ref: 0000026CE68A3496

_malloc_crt.LIBCMT ref: 0000026CE68A8189

Strings

:, xrefs: 0000026CE68A81A8

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crt
String ID: :
API String ID: 875692556-336475711
Opcode ID: 87dcd81199e5c75fe6f4eb1ed4ca3c3cad752f6282d2ad23c1f32017a9299fd6
Instruction ID: 2c2defc41c69439aac48cbcba5c6ebc1de53352cd080a8c3fb0ffa77b2a3992d
Opcode Fuzzy Hash: 87dcd81199e5c75fe6f4eb1ed4ca3c3cad752f6282d2ad23c1f32017a9299fd6
Instruction Fuzzy Hash: 9441C931628F0C4FDB68FF29988A6B573E1F759310F65426BD89AC3197DE22D8428781

Function 0000026CE68A7F8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000026CE68A8009
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000026CE68A7FBE

Part of subcall function 0000026CE68A3424: _getptd.LIBCMT ref: 0000026CE68A343A
Part of subcall function 0000026CE68A3424: __updatetlocinfo.LIBCMT ref: 0000026CE68A346F
Part of subcall function 0000026CE68A3424: __updatetmbcinfo.LIBCMT ref: 0000026CE68A3496

Strings

:, xrefs: 0000026CE68A8028

Memory Dump Source

Source File: 00000000.00000002.4679454490.0000026CE6870000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE6870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce6870000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crt
String ID: :
API String ID: 875692556-336475711
Opcode ID: b6f76ccc677749e7e47c8f1fd9208b4adf8ad809ee0fda7590a67167e05195a0
Instruction ID: bcaba9007c2e35076e079000ae3a7fc8dc65a600effbd61fbc4ab45142d0646e
Opcode Fuzzy Hash: b6f76ccc677749e7e47c8f1fd9208b4adf8ad809ee0fda7590a67167e05195a0
Instruction Fuzzy Hash: 6E41B831628E0C4FDB68FF2998896B573E1F759310F65426BE89AC3197DE32D8428781

Function 0000026CE85E5D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0000026CE85E5E01
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E5E22

Strings

%.0Lf, xrefs: 0000026CE85E5DF1

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocswprintf
String ID: %.0Lf
API String ID: 2734600178-1402515088
Opcode ID: 0b52692e544fc50670088c299cef916147423b381afed6a016f19d8ad1928563
Instruction ID: cc614d453e4d09f8796b91ae72acbc466fda47d166d24b8f0d972e084cca9283
Opcode Fuzzy Hash: 0b52692e544fc50670088c299cef916147423b381afed6a016f19d8ad1928563
Instruction Fuzzy Hash: 36516D32A1AB8089F711DBA5E8443ED7374F784798F604216EE9E57B99EF3AC446C700

Function 0000026CE85E5944 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0000026CE85E59E5
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85E5A06

Strings

%.0Lf, xrefs: 0000026CE85E59D5

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocswprintf
String ID: %.0Lf
API String ID: 2734600178-1402515088
Opcode ID: 4d8b598d66f7e2c92a40726d1b63a1af653c1d6d07b5135ad9993eb8cba31dca
Instruction ID: c909e8626668e633c53071a3e1f21c1a55a1a9e905a856b1016e199dd5a0f14e
Opcode Fuzzy Hash: 4d8b598d66f7e2c92a40726d1b63a1af653c1d6d07b5135ad9993eb8cba31dca
Instruction Fuzzy Hash: BB516D32A1AB8089F711DBA5D8443ED7371F784798F604216EE9E57B99EF3AC046C710

Function 0000026CE85ECF6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0000026CE85ED00B
std::ios_base::getloc.LIBCPMTD ref: 0000026CE85ED02C

Strings

%.0Lf, xrefs: 0000026CE85ECFFB

Memory Dump Source

Source File: 00000000.00000002.4681374131.0000026CE85C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000026CE85C0000, based on PE: true

Associated: 00000000.00000002.4681374131.0000026CE8668000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26ce85c0000_loaddll64.jbxd

Similarity

API ID: std::ios_base::getlocswprintf
String ID: %.0Lf
API String ID: 2734600178-1402515088
Opcode ID: 4ecb6063488c6e6240f3922736982e1e2cd0c6d48fa5f7eaa1debd812ab1ff6c
Instruction ID: c8730af22bc3a2db763cdfae707bc7b1e45ceb334a785f135c7b605b2f987c57
Opcode Fuzzy Hash: 4ecb6063488c6e6240f3922736982e1e2cd0c6d48fa5f7eaa1debd812ab1ff6c
Instruction Fuzzy Hash: CA519132B1AA8089F711DB75D8483ED7770E785798F605216EE9A27B99DF3AC046C700

Analysis Process: rundll32.exePID: 2304, Parent PID: 3268COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.9%
Total number of Nodes:	1121
Total number of Limit Nodes:	56

Executed Functions

Function 0000021E02F20024 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 484
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000021E02F20186
LoadLibraryA.KERNELBASE ref: 0000021E02F2034B

Strings

r, xrefs: 0000021E02F2005B
e, xrefs: 0000021E02F20066
3, xrefs: 0000021E02F2006D
k, xrefs: 0000021E02F20054
., xrefs: 0000021E02F20074
l, xrefs: 0000021E02F2007B

Memory Dump Source

Source File: 00000003.00000002.4682959280.0000021E02F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e02f20000_rundll32.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID: .$3$e$k$l$r
API String ID: 3550616410-427081609
Opcode ID: 291297bbe044f9a5b47e76894c7116349fbdee25044733f7824d139af3bc4b69
Instruction ID: a428c31bc572f21cb7bbd5da00477b9635ac3412494f486d043dffcf8dbb1858
Opcode Fuzzy Hash: 291297bbe044f9a5b47e76894c7116349fbdee25044733f7824d139af3bc4b69
Instruction Fuzzy Hash: E7D12931218E0E4BDB1DDB18CC886F5B3E2FBBA345F15416ED897E7196DE7098878680

Function 0000021E016D4D00 Relevance: 10.8, APIs: 7, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 0000021E016D4D92
GetComputerNameExW.KERNELBASE ref: 0000021E016D4DA7
GetComputerNameExW.KERNELBASE ref: 0000021E016D4DD6
GetTokenInformation.KERNELBASE ref: 0000021E016D4E12
GetNativeSystemInfo.KERNELBASE ref: 0000021E016D4EC4
GetAdaptersInfo.IPHLPAPI ref: 0000021E016D4FB0
GetAdaptersInfo.IPHLPAPI ref: 0000021E016D4FF5

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: InfoName$AdaptersComputer$InformationNativeSystemTokenUser
String ID:
API String ID: 1596153048-0
Opcode ID: fc5f4ac56282d7f6b4db6a693f909165f7ae7dee8b8a3528bbb2850199aa6824
Instruction ID: e3f9a5d4df2ee7f971ea483ea70a60405994f7941375ca19d9ee8567f28a0e38
Opcode Fuzzy Hash: fc5f4ac56282d7f6b4db6a693f909165f7ae7dee8b8a3528bbb2850199aa6824
Instruction Fuzzy Hash: 2EA1E531618B084FEF54EB18EC597DAB3E1FBA8300F41452DE88AD7295DEB4D945CB82

Function 00007DF40CCA0100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF40CCA0237

Memory Dump Source

Source File: 00000003.00000003.2301569551.00007DF40CCA0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF40CCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_7df40cca0000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: fee07c7912eccc77b8bdc9f0c84a49a7d98d8cc655870ecadf8a5a8510b0c4c4
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: D571D031618A4C8FEF94EF5CC898BE937E1FB98355F104226E91ED72A0DB749954CB80

Function 00007DF40CCA0000 Relevance: 6.1, APIs: 4, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF40CCA0052
Process32First.KERNEL32 ref: 00007DF40CCA008B
CloseHandle.KERNELBASE ref: 00007DF40CCA00C1

Memory Dump Source

Source File: 00000003.00000003.2301569551.00007DF40CCA0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF40CCA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_7df40cca0000_rundll32.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: 28acdb015e6c2751a6e8fcd33746c477b72efbb045d92c3a4bf06edee4853473
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: 2021FC3061894C8FEBA0EB6CCD58BEA33E1FBA8314F404226D41EDB2D0DE34EA448750

Function 0000021E016B1600 Relevance: 1.7, APIs: 1, Instructions: 169
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 0000021E016B1794

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c7cfbd4c28cfd34a067c4dec962a0dff76d3cfd4b019f48227f7b9b53671fbdc
Instruction ID: 50a4de6fa52023747b6fd48046cc43fc6bef496c6746f5a05b084bdc71412b7c
Opcode Fuzzy Hash: c7cfbd4c28cfd34a067c4dec962a0dff76d3cfd4b019f48227f7b9b53671fbdc
Instruction Fuzzy Hash: A451F574108A085FEB48EF28EC597F577E1FB6A310F11025DE497D72A2CE68E842C745

Function 0000021E016BCCE0 Relevance: 1.6, APIs: 1, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 0000021E016BCDB2

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction ID: 6ef8522ff07b364f0e889efba758058921934fffbcaf5ae6d2aadc7c49a40adb
Opcode Fuzzy Hash: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction Fuzzy Hash: 4331C675118B084BDB649F08EC8A7FAB7E0FB99310F51061EE986C7251D670E98587C7

Function 0000021E016B17B0 Relevance: .4, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d85227a09238635517778710c27d9bdfaca49e187fecf1b6975c65beea9fa4
Instruction ID: df90a6825115a671331ff9687ce5083c1e68962bd54515441fa897accab84705
Opcode Fuzzy Hash: 81d85227a09238635517778710c27d9bdfaca49e187fecf1b6975c65beea9fa4
Instruction Fuzzy Hash: 51C10A3011CA494FEB55EF28EC987E9B7E1FB6A300F510269D88AC7296DBB4D981C741

Function 0000021E016B71B0 Relevance: .1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d6cbcc5dfeb1084a9cc122a67364a682b6f2504e530092aaea3ef2afdda240
Instruction ID: 49821f5c49afd0bafdb4036cdbfbc91ac84b4f2929794a48ea0b6e8b4c5fbbc1
Opcode Fuzzy Hash: 62d6cbcc5dfeb1084a9cc122a67364a682b6f2504e530092aaea3ef2afdda240
Instruction Fuzzy Hash: 4A4193701286088FF748DF28EC897A6B7E1FB58304F50466DE45AD72D6CBB8C881CB41

Function 0000021E016E4360 Relevance: .1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction ID: 36a4dfa0785bd0ca6c407cba225719eaaa0b7d96f427306193e08b7f73eab423
Opcode Fuzzy Hash: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction Fuzzy Hash: 19412C7151CB488FE6749F18AC467EAB7E0FB99720F004A1FD5C9C2255DA75A4428BC2

Function 0000021E016E3F40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction ID: f3416f578c883371e23f660dc529b61e00f8a5d26d24cb978623efb3f8456456
Opcode Fuzzy Hash: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction Fuzzy Hash: D311723061D7449FEB549B1CAC8A7E6B7E0FBA9321F00491FE889C7350D675D4908783

Function 0000021E016E4BE0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction ID: 4d10deee2f6f40aa7f32dd345bbdd44a1183788cd5dce03191e2e19f8c0f56d7
Opcode Fuzzy Hash: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction Fuzzy Hash: 8511823065CB498FEA549F58AC4A7A973D4E75D715F40051EE849C3290DAB5D880CB83

Function 0000021E016C7A50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction ID: 3504363d14e0d86cd57cf48e2b2d8e485dddc6870a1b89a05d794b233c42d65e
Opcode Fuzzy Hash: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction Fuzzy Hash: A9110430118B484FFB609B9CAC4A3FA72C0F79C314F50051DEC89D61C1DBF695488A43

Function 0000021E016E4FF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction ID: 1af61b9a99bf48e5c0f917a102c59e3be5ba49bb7a588362efc237331adc4596
Opcode Fuzzy Hash: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction Fuzzy Hash: 4211A73062CB458FEB549F08AC4ABE977E0F75C715F40051EE84AC7690D6B5D480CAC3

Function 0000021E016E4740 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction ID: 848c44afa03e5f47afb37d6ce14d3e3f4185a1ebd4b5492712658fc04d316fae
Opcode Fuzzy Hash: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction Fuzzy Hash: F101C43066CB054FEF48AB28AC4B3F673E1F79D710F10461EE84AD3291DA65D9808AC3

Function 0000021E06BFD2B6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2141899261.0000021E06BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21e06bc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction ID: 59bbd28852dbbbc8e160da1686dce8536bcb31dfd4461d8114c33bf6552d11ab
Opcode Fuzzy Hash: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction Fuzzy Hash: 6EF081B0A28B408BE7449F1884C967577E1FBDC655F24452EE88A97371CB319842CA83

Function 0000021E06BFD326 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2141899261.0000021E06BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21e06bc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction ID: 184f734ccd17575b3610ff01874b90a98128593bedad8d86fb7f07e6a9330900
Opcode Fuzzy Hash: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction Fuzzy Hash: 99F0B4B0A24F044BCB04AF2C884A67533D1FBAC605F54052EE848D3361DB35E4428B83

Function 0000021E016C8149 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction ID: 9df20a4c0140fa38e8bab9ec7d0402f95e383c5740966ed0a16b506c1ebaba14
Opcode Fuzzy Hash: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction Fuzzy Hash: 33D0A97248DB188EEB209BA8FC873E8B3D0F790328F50882EC18DC2043D67E80468706

Function 0000021E04C74340 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021E04C74750: GetModuleFileNameW.KERNEL32 ref: 0000021E04C74791

GetModuleFileNameW.KERNEL32 ref: 0000021E04C743FC
SHGetSpecialFolderPathW.SHELL32 ref: 0000021E04C74418
lstrcatW.KERNEL32 ref: 0000021E04C7442B
lstrcatW.KERNEL32 ref: 0000021E04C74440
lstrcatW.KERNEL32 ref: 0000021E04C74456
lstrcatW.KERNEL32 ref: 0000021E04C7446B

Part of subcall function 0000021E04C756E0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 0000021E04C7572D

SafeRWList.LIBCMTD ref: 0000021E04C744A3

Part of subcall function 0000021E04C7B0A0: std::ios_base::getloc.LIBCPMTD ref: 0000021E04C7B1FC
Part of subcall function 0000021E04C7B0A0: char_traits.LIBCPMTD ref: 0000021E04C7B31E
Part of subcall function 0000021E04C7B0A0: ctype.LIBCPMTD ref: 0000021E04C7B385

Part of subcall function 0000021E04C75540: shared_ptr.LIBCPMTD ref: 0000021E04C75560

Part of subcall function 0000021E04C7B0A0: char_traits.LIBCPMTD ref: 0000021E04C7B3F1
Part of subcall function 0000021E04C7B0A0: char_traits.LIBCPMTD ref: 0000021E04C7B4BF
Part of subcall function 0000021E04C7B0A0: std::ios_base::width.LIBCPMTD ref: 0000021E04C7B4FF

Strings

DLLMain, xrefs: 0000021E04C743DB
\NTUSER.DAT.Not, xrefs: 0000021E04C743CF

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: lstrcat$char_traits$FileModuleNameProcessorVirtual$Concurrency::FolderListPathRootRoot::SafeSpecialctypeshared_ptrstd::ios_base::getlocstd::ios_base::width
String ID: DLLMain$\NTUSER.DAT.Not
API String ID: 3304544195-2041910327
Opcode ID: d30e8e5b88aad5fa04ee92c3bd5113da6591793adca71e7613593e8e8900fb11
Instruction ID: 54042deff46ebc8a10c5d3b5386f0826ef7fbcd5f9cae5f71c19aad0ab155aa0
Opcode Fuzzy Hash: d30e8e5b88aad5fa04ee92c3bd5113da6591793adca71e7613593e8e8900fb11
Instruction Fuzzy Hash: 959139712159C5A2FE24DB14FDD93DE63A1FBD8340F814122DA9D97AAAEF68C604CB40

Function 0000021E016B7830 Relevance: 10.8, APIs: 7, Instructions: 340
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000021E016B788A
InternetConnectW.WININET ref: 0000021E016B78CB
HttpOpenRequestW.WININET ref: 0000021E016B791F
HttpSendRequestA.WININET ref: 0000021E016B79DA
InternetQueryDataAvailable.WININET ref: 0000021E016B7A53
RtlReAllocateHeap.NTDLL ref: 0000021E016B7AA4

Part of subcall function 0000021E016DB4E0: RtlFreeHeap.NTDLL ref: 0000021E016DB51D

InternetCloseHandle.WININET ref: 0000021E016B7B11

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: Internet$HeapHttpOpenRequest$AllocateAvailableCloseConnectDataFreeHandleQuerySend
String ID:
API String ID: 3737532752-0
Opcode ID: bbb038b860022ece9c615c8651eb51f5b0c4a447bc3b9e1814cb5cd5c2ae45f2
Instruction ID: 9c547be6be6c3dc1a469a2c8d130403eeb7a7c00952ef6f0c617e0ffcf5931a7
Opcode Fuzzy Hash: bbb038b860022ece9c615c8651eb51f5b0c4a447bc3b9e1814cb5cd5c2ae45f2
Instruction Fuzzy Hash: BFB19630218A088FEB54EF58EC997AAB7D5FBA8300F05456DEC46DB2D5DFB4D8418782

Function 0000021E04C74AF0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocExNuma.KERNEL32 ref: 0000021E04C74B3E

Strings

@, xrefs: 0000021E04C74B24

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: AllocNumaVirtual
String ID: @
API String ID: 4233825816-2766056989
Opcode ID: 3ad4501b3b3753825116e2f3eb18c4c8e9e85a26242c0a199b5a9ca851232d8f
Instruction ID: 139f036806e609bbdc3d2f6bde52d0f0705d01c07c83c5222b2aaf46ea7901aa
Opcode Fuzzy Hash: 3ad4501b3b3753825116e2f3eb18c4c8e9e85a26242c0a199b5a9ca851232d8f
Instruction Fuzzy Hash: 50112172219A8087DB54CB15F89431ABBA1F789794F101214FB9F43B98DB7DC5448B04

Function 0000021E016B8ED0 Relevance: 1.9, APIs: 1, Instructions: 410
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNELBASE ref: 0000021E016B8F00

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction ID: 30598eb97c4120d198205c251d2f528d0124d32f0a60218240781c502664ff3c
Opcode Fuzzy Hash: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction Fuzzy Hash: 3CE12A71408A0D8FE751EF14EC94BE6BBF4F768340F20027BE84AC6265DB799245CB86

Function 0000021E016DB4E0 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 0000021E016DB51D

Memory Dump Source

Source File: 00000003.00000002.4682272693.0000021E016B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021E016B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e016b1000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction ID: acf4b7ee660b28af038955c53abf7a5f5f19f5e222855cd56b4d7866fefe53ec
Opcode Fuzzy Hash: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction Fuzzy Hash: 1AF01C30710A088BFF58EBBAACC97A137E2FB9D341B868054E845CA194DB78D841C701

Function 0000021E06BFCA56 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2141899261.0000021E06BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E06BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_21e06bc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction ID: c38f77ae54f7af5afcf6fec8464ea512bff1abd1fb266e775fbea39fd5d97e0c
Opcode Fuzzy Hash: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction Fuzzy Hash: 32014970209D2E0BEBD9E7686CC47E37AC2F7EC300F595055DC0AE729ACA66C98146C0

Non-executed Functions

Function 0000021E04CA7644 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CA766E

Part of subcall function 0000021E04CA3B7C: _getptd.LIBCMT ref: 0000021E04CA3B92
Part of subcall function 0000021E04CA3B7C: __updatetlocinfo.LIBCMT ref: 0000021E04CA3BC7
Part of subcall function 0000021E04CA3B7C: __updatetmbcinfo.LIBCMT ref: 0000021E04CA3BEE

_malloc_crt.LIBCMT ref: 0000021E04CA76AE
_invoke_watson.LIBCMT ref: 0000021E04CA776C

Part of subcall function 0000021E04CAA508: _call_reportfault.LIBCMT ref: 0000021E04CAA530

_invoke_watson.LIBCMT ref: 0000021E04CA7782

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction ID: 17f3d9ac44a5c3c2535c7f20e23367e84e313769d50176eef51f33f68e6f2fb3
Opcode Fuzzy Hash: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction Fuzzy Hash: 8331073232068445FF199B269E5D3DD76D1FBA9BC8F0A4125DF4E5BB9ACE78C0128700

Function 0000021E04CAB0E0 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 0000021E04CAB0F1
free.LIBCMT ref: 0000021E04CAB10E

Part of subcall function 0000021E04CA1E24: HeapFree.KERNEL32 ref: 0000021E04CA1E3A
Part of subcall function 0000021E04CA1E24: _errno.LIBCMT ref: 0000021E04CA1E44
Part of subcall function 0000021E04CA1E24: GetLastError.KERNEL32 ref: 0000021E04CA1E4C

free.LIBCMT ref: 0000021E04CAB123
free.LIBCMT ref: 0000021E04CAB144
free.LIBCMT ref: 0000021E04CAB159
free.LIBCMT ref: 0000021E04CAB16D
free.LIBCMT ref: 0000021E04CAB179
free.LIBCMT ref: 0000021E04CAB1A4
EncodePointer.KERNEL32 ref: 0000021E04CAB1AC
free.LIBCMT ref: 0000021E04CAB1C5
free.LIBCMT ref: 0000021E04CAB1DE
free.LIBCMT ref: 0000021E04CAB20F

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction ID: ddd60f417b7c39a2725dfbbbbb643f26302bddbee4904a28a99e3796cae6ac4a
Opcode Fuzzy Hash: b4bc968d3c6e0ca3411d4d7c887ffc2f2a0207fe4ca6a95d778c9ae964d27bd5
Instruction Fuzzy Hash: 3231BE75201A4065FF589B11FFED3E422E0AFBD758F4A1226DE19262E5EFFCD8508241

Function 0000021E04C9346C Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C934A8

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C7ABE0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7ABF9
Part of subcall function 0000021E04C7ABE0: __int64.LIBCPMTD ref: 0000021E04C7AC12
Part of subcall function 0000021E04C7ABE0: std::locale::_Getfacet.LIBCPMTD ref: 0000021E04C7AC29
Part of subcall function 0000021E04C7ABE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7ACDA

Strings

%m / %d / %y, xrefs: 0000021E04C935AD
%I : %M : %S %p, xrefs: 0000021E04C93953
%H : %M, xrefs: 0000021E04C93612
%b %d %H : %M : %S %Y, xrefs: 0000021E04C93804
%H : %M : S, xrefs: 0000021E04C936B6
%d / %m / %y, xrefs: 0000021E04C93911
:AM:am:PM:pm, xrefs: 0000021E04C93963
c, xrefs: 0000021E04C938DB

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$GetfacetLockit::_Lockit::~___int64std::ios_base::getlocstd::locale::_std::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 4021809434-3998755201
Opcode ID: 8e1deff4405f140ca104af93d567ca82f55d7d783d531e69af03a14ea99d4600
Instruction ID: 7498ae447e8c7143f74b1d93f3cac1e513b591931d0b433d80b0b6425546df75
Opcode Fuzzy Hash: 8e1deff4405f140ca104af93d567ca82f55d7d783d531e69af03a14ea99d4600
Instruction Fuzzy Hash: 37E17032508BC496FB688F24E98C7ED77E0FB9C788F154209DE8927A69DB78C645C704

Function 0000021E04C92F0C Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C92F48

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C82EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82ED5
Part of subcall function 0000021E04C82EB4: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82EFA
Part of subcall function 0000021E04C82EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82F24
Part of subcall function 0000021E04C82EB4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82FCE

Strings

%m / %d / %y, xrefs: 0000021E04C9304D
c, xrefs: 0000021E04C9337B
%I : %M : %S %p, xrefs: 0000021E04C933F3
%H : %M, xrefs: 0000021E04C930B2
%b %d %H : %M : %S %Y, xrefs: 0000021E04C932A4
%H : %M : S, xrefs: 0000021E04C93156
%d / %m / %y, xrefs: 0000021E04C933B1
:AM:am:PM:pm, xrefs: 0000021E04C93403

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::getlocstd::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 824625536-3998755201
Opcode ID: 9ea7233a1195fdad9958adce2f8bb786a2981300ba8746fa4110a12b4cbdb550
Instruction ID: 2bf0ba75c2d9394cdd38bcf3e108d53e14d50b79c07f76e22b3a897ec2c8597a
Opcode Fuzzy Hash: 9ea7233a1195fdad9958adce2f8bb786a2981300ba8746fa4110a12b4cbdb550
Instruction Fuzzy Hash: CEE1A332504BC496FF688F24DA887ED77E0FBAC788F554205DE8927A69DB78CA45C700

Function 0000021E04C9BC38 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 326COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C9BC74

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C7C674: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7C695
Part of subcall function 0000021E04C7C674: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7C6BA
Part of subcall function 0000021E04C7C674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7C6E4
Part of subcall function 0000021E04C7C674: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7C78E

Strings

%m / %d / %y, xrefs: 0000021E04C9BD79
c, xrefs: 0000021E04C9C0A7
%I : %M : %S %p, xrefs: 0000021E04C9C11F
%H : %M, xrefs: 0000021E04C9BDDE
%b %d %H : %M : %S %Y, xrefs: 0000021E04C9BFD0
%H : %M : S, xrefs: 0000021E04C9BE82
%d / %m / %y, xrefs: 0000021E04C9C0DD
:AM:am:PM:pm, xrefs: 0000021E04C9C12F

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::ios_base::getlocstd::locale::locale
String ID: %H : %M$%H : %M : S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm$c
API String ID: 824625536-3998755201
Opcode ID: c37271404475d0014721bef1fed1c0e1cecc04706b38c11d20b1fc59747c924a
Instruction ID: a7115a9d9c1b7edfb23793490436534ea8bc453d3fe2891e397b65fd3a4370b0
Opcode Fuzzy Hash: c37271404475d0014721bef1fed1c0e1cecc04706b38c11d20b1fc59747c924a
Instruction Fuzzy Hash: A9E1B532504B85A6FF688F24EA887ED77E0FB59788F054105EF8917B59DB78CA45C700

Function 0000021E04C98368 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C98389

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C983AE
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C983D8
messages.LIBCPMT ref: 0000021E04C98431
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C98448
_CxxThrowException.LIBCMT ref: 0000021E04C98459
std::_Facet_Register.LIBCPMT ref: 0000021E04C98477
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98482

Strings

bad cast, xrefs: 0000021E04C9843C

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 5a55c19257780c8c169a156cca45b48a9cb7959a6ebe7d38ac67adaa113ab4e8
Instruction ID: f4c06e53fb8c699b8fd9ebc80c52528c6a60a460ad48f0ecbeffcc13cf4504e5
Opcode Fuzzy Hash: 5a55c19257780c8c169a156cca45b48a9cb7959a6ebe7d38ac67adaa113ab4e8
Instruction Fuzzy Hash: F531CA31210A00A1FE18EB15FEDC2D963A0FFB97A0F164222DE69272F5DAB8C841C710

Function 0000021E04C83374 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83395

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C833BA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C833E4
messages.LIBCPMT ref: 0000021E04C8343D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83454
_CxxThrowException.LIBCMT ref: 0000021E04C83465
std::_Facet_Register.LIBCPMT ref: 0000021E04C83483
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8348E

Strings

bad cast, xrefs: 0000021E04C83448

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: c69e9b5502f2b5cb16499cf93693c14af8bc71d40f19607121fcaa26e48801a2
Instruction ID: 2a639dac41e3da5a61e92f97d360d38481a5247775257dad4ad3d11e7df1c78c
Opcode Fuzzy Hash: c69e9b5502f2b5cb16499cf93693c14af8bc71d40f19607121fcaa26e48801a2
Instruction Fuzzy Hash: 6E31B131204A4091FF19DB55EE982D967A0FBE8BA0F871226DE59636F5DFB9C842C300

Function 0000021E04C7C544 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7C565

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7C58A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7C5B4
messages.LIBCPMT ref: 0000021E04C7C60D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C7C624
_CxxThrowException.LIBCMT ref: 0000021E04C7C635
std::_Facet_Register.LIBCPMT ref: 0000021E04C7C653
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7C65E

Strings

bad cast, xrefs: 0000021E04C7C618

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: ce52fca3fe3199b9ca64d09fb7b68cda433c6417c830918da4d940205a12b32f
Instruction ID: eeb2f35b08498b5d7d3a7ec227b7e120294e9bc54afe64f66f17cf94ef3de251
Opcode Fuzzy Hash: ce52fca3fe3199b9ca64d09fb7b68cda433c6417c830918da4d940205a12b32f
Instruction Fuzzy Hash: CC318372204B41A2FE18DB15FED82D967A0FBAC7A0F564222DE59636F5DEB8C542C700

Function 0000021E04C834A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C834C5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C834EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83514
messages.LIBCPMT ref: 0000021E04C8356D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83584
_CxxThrowException.LIBCMT ref: 0000021E04C83595
std::_Facet_Register.LIBCPMT ref: 0000021E04C835B3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C835BE

Strings

bad cast, xrefs: 0000021E04C83578

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: e92ebb4505384e37149a9af64b0ed7b997fd3b62a18224f75f4565cc40b02c60
Instruction ID: 15a06edaeb40bfb2c4ae53a5eb8b5d599480c9b8e15547224c9d45a74b6dcfaa
Opcode Fuzzy Hash: e92ebb4505384e37149a9af64b0ed7b997fd3b62a18224f75f4565cc40b02c60
Instruction Fuzzy Hash: 0431A471204B81A1FF18DB15EE982D963A0FBA8BA0F571226DE69236F5DFB9C445C300

Function 0000021E04C98498 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C984B9

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C984DE
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98508
messages.LIBCPMT ref: 0000021E04C98561
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C98578
_CxxThrowException.LIBCMT ref: 0000021E04C98589
std::_Facet_Register.LIBCPMT ref: 0000021E04C985A7
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C985B2

Strings

bad cast, xrefs: 0000021E04C9856C

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: bb88f8af8f6ad0f94797e91181e4a5fede4ca1b0857083484043c23cb2229bcb
Instruction ID: f19a5d45a07fba35dd6407bb71f22cba98924b7d368f86e4cd9d2e0e931bdb7d
Opcode Fuzzy Hash: bb88f8af8f6ad0f94797e91181e4a5fede4ca1b0857083484043c23cb2229bcb
Instruction Fuzzy Hash: 5F31C471210A00A1FE59EF15EE9C2D963A1FFA97A0F564321DE59636F9DFB8C845C300

Function 0000021E04C985C8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C985E9

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C9860E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98638
moneypunct.LIBCPMT ref: 0000021E04C98691
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C986A8
_CxxThrowException.LIBCMT ref: 0000021E04C986B9
std::_Facet_Register.LIBCPMT ref: 0000021E04C986D7
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C986E2

Strings

bad cast, xrefs: 0000021E04C9869C

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 29cb517ef353edaf7fe96a55ad9e16f417422b8bc592340c9ae3e73a311cc7df
Instruction ID: 4f10359d048627d89fcec22182a6a1f052a60d8cf04fae9e555dc9f6c361c1a6
Opcode Fuzzy Hash: 29cb517ef353edaf7fe96a55ad9e16f417422b8bc592340c9ae3e73a311cc7df
Instruction Fuzzy Hash: 5031E671210B00A2FE18EB15EE9C3D927A1FBB9B90F460621DE69676F5DBB8C941C700

Function 0000021E04C835D4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C835F5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8361A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83644
messages.LIBCPMT ref: 0000021E04C8369D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C836B4
_CxxThrowException.LIBCMT ref: 0000021E04C836C5
std::_Facet_Register.LIBCPMT ref: 0000021E04C836E3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C836EE

Strings

bad cast, xrefs: 0000021E04C836A8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 536d951579794d9ac5848435dcda0d8056ecb28f286086e041b4dee6b5989298
Instruction ID: 4cc6556bde175b3826ccc35589ab7fdbd4f6a769af74d9c8c8eb0d4a1d664780
Opcode Fuzzy Hash: 536d951579794d9ac5848435dcda0d8056ecb28f286086e041b4dee6b5989298
Instruction Fuzzy Hash: EB31A271204B40A1FF189B19EE982D963E0FFA8BA4F5B1226DE59633F5DEB9C445C300

Function 0000021E04C83F54 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83F75

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83F9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83FC4
messages.LIBCPMT ref: 0000021E04C8401D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C84034
_CxxThrowException.LIBCMT ref: 0000021E04C84045
std::_Facet_Register.LIBCPMT ref: 0000021E04C84063
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8406E

Strings

bad cast, xrefs: 0000021E04C84028

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: e44b50d4e94eb0d1351846dbd8529780eaeaffd3bd116e536ad6d8b979878f95
Instruction ID: f7c685aecbefdfe2b3c7e69de6dfbd9ac5a0ee35be3806d11224f7258815b7b0
Opcode Fuzzy Hash: e44b50d4e94eb0d1351846dbd8529780eaeaffd3bd116e536ad6d8b979878f95
Instruction Fuzzy Hash: 20319171204B4191FF18DB15EE982DA63A0EBA8BA4F574226DE59276F6DFB8C841C300

Function 0000021E04C82EB4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82ED5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82EFA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82F24
ctype.LIBCPMT ref: 0000021E04C82F7D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C82F94
_CxxThrowException.LIBCMT ref: 0000021E04C82FA5
std::_Facet_Register.LIBCPMT ref: 0000021E04C82FC3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82FCE

Strings

bad cast, xrefs: 0000021E04C82F88

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 757613215-3145022300
Opcode ID: 27ff36a41daa2afd465fce565ffe5753e683ad286d1df17b1f83c21b9b33a9ce
Instruction ID: 359a31679262560487b5c02c3a45ae31c6b7d91a3a73ee7e3b008a5fa00fde44
Opcode Fuzzy Hash: 27ff36a41daa2afd465fce565ffe5753e683ad286d1df17b1f83c21b9b33a9ce
Instruction Fuzzy Hash: 89319271204B5091FF199B55EE9C2D963E0FBACBA4F474226DE5D236FADAB8C841C300

Function 0000021E04C82FE4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83005

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8302A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83054
messages.LIBCPMT ref: 0000021E04C830AD
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C830C4
_CxxThrowException.LIBCMT ref: 0000021E04C830D5
std::_Facet_Register.LIBCPMT ref: 0000021E04C830F3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C830FE

Strings

bad cast, xrefs: 0000021E04C830B8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: b569cdc1653f4c7f6180cbb6e0faa1c39ac808a66fab2fc048e17dcba9d08f51
Instruction ID: fb4dc5c0484d00056a182ab722e2bf3b0633e4bb861c7e72a4cd4a972a2a9c1e
Opcode Fuzzy Hash: b569cdc1653f4c7f6180cbb6e0faa1c39ac808a66fab2fc048e17dcba9d08f51
Instruction Fuzzy Hash: 72319071204B4091FF18DB15EE982D967E0EBA8BA4F575226DE59232F5DFB9C841C300

Function 0000021E04C98108 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C98129

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C9814E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98178
collate.LIBCPMT ref: 0000021E04C981D1
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C981E8
_CxxThrowException.LIBCMT ref: 0000021E04C981F9
std::_Facet_Register.LIBCPMT ref: 0000021E04C98217
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98222

Strings

bad cast, xrefs: 0000021E04C981DC

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 4b7540098f8ea2fd8cb3a6c4dc7befb07f8a31645b2c4940871eb245c6e3b5b3
Instruction ID: 0269e624da69ebceb8614017e485def6846ed320c3a818ec9a0448cdf06ee5c1
Opcode Fuzzy Hash: 4b7540098f8ea2fd8cb3a6c4dc7befb07f8a31645b2c4940871eb245c6e3b5b3
Instruction Fuzzy Hash: 8631A671210B00A1FE19EB15EE9C2D963E1EFA9BA0F564221DE59237F5DEB8C941C700

Function 0000021E04C83114 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83135

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8315A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83184
messages.LIBCPMT ref: 0000021E04C831DD
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C831F4
_CxxThrowException.LIBCMT ref: 0000021E04C83205
std::_Facet_Register.LIBCPMT ref: 0000021E04C83223
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8322E

Strings

bad cast, xrefs: 0000021E04C831E8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: ad4db0a7af812267d7f8cad6930e3dc199e4210e7b6ad20d02838aa8ea755007
Instruction ID: a768204ef49e43425e0ffc805ace8eae393176569d1b6d78ab1631a15bb4bed0
Opcode Fuzzy Hash: ad4db0a7af812267d7f8cad6930e3dc199e4210e7b6ad20d02838aa8ea755007
Instruction Fuzzy Hash: 76319F72204B4091FF19DB15EE982D967A0FBE8FA0F5B1226DE59232F5DEB9C442C300

Function 0000021E04C84084 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C840A5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C840CA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C840F4
numpunct.LIBCPMT ref: 0000021E04C8414D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C84164
_CxxThrowException.LIBCMT ref: 0000021E04C84175
std::_Facet_Register.LIBCPMT ref: 0000021E04C84193
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8419E

Strings

bad cast, xrefs: 0000021E04C84158

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4059195664-3145022300
Opcode ID: d94e50aa53ccc9d6944cd3aed90cdf3e84a64a3bd5255cb9728456337b3ddaed
Instruction ID: cbf0b9081897e53d16ae8631c3de8b8bcb4b1d6aa63a7fa4a14ecb3f0e6e4979
Opcode Fuzzy Hash: d94e50aa53ccc9d6944cd3aed90cdf3e84a64a3bd5255cb9728456337b3ddaed
Instruction Fuzzy Hash: 22318175204B0191FF18DB15EE982D967A1EBB8BA4F574226DE5D233E5EBB8C441C700

Function 0000021E04C98238 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C98259

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C9827E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C982A8
messages.LIBCPMT ref: 0000021E04C98301
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C98318
_CxxThrowException.LIBCMT ref: 0000021E04C98329
std::_Facet_Register.LIBCPMT ref: 0000021E04C98347
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98352

Strings

bad cast, xrefs: 0000021E04C9830C

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: f6e975c9ed1fc811ddeed3bf09c1872f6a5632ab065b9bea6ee0b1db81a6e053
Instruction ID: ec065f56cc3ea391e80672e1c853649002f72e233a557602864f0f0132bf02ed
Opcode Fuzzy Hash: f6e975c9ed1fc811ddeed3bf09c1872f6a5632ab065b9bea6ee0b1db81a6e053
Instruction Fuzzy Hash: 08319671214F01A1FE18AB19EE9C2E967A0FBB9794F564212DE5E636F5DAB8C841C300

Function 0000021E04C83244 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83265

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8328A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C832B4
messages.LIBCPMT ref: 0000021E04C8330D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83324
_CxxThrowException.LIBCMT ref: 0000021E04C83335
std::_Facet_Register.LIBCPMT ref: 0000021E04C83353
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8335E

Strings

bad cast, xrefs: 0000021E04C83318

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: d82304bf4a96c8aa3365fbec0ce9b6afb946fba8665589bd6e4ea4bbafcdc822
Instruction ID: d8c1682fcd12efc7f437927e36dc46fb0e6878ffe1e8bbea2792015ef24911df
Opcode Fuzzy Hash: d82304bf4a96c8aa3365fbec0ce9b6afb946fba8665589bd6e4ea4bbafcdc822
Instruction Fuzzy Hash: 1D31C831204A4191FF18DB15EE982E963A0FBA8BA0F4B5226DE59636F5DFB9C442C300

Function 0000021E04C841B4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C841D5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C841FA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C84224
numpunct.LIBCPMT ref: 0000021E04C8427D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C84294
_CxxThrowException.LIBCMT ref: 0000021E04C842A5
std::_Facet_Register.LIBCPMT ref: 0000021E04C842C3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C842CE

Strings

bad cast, xrefs: 0000021E04C84288

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4059195664-3145022300
Opcode ID: 1fe0c26a9036abef5ee95c4ac4b3fdedf737f9338d7163a728943c57dc64d707
Instruction ID: 071c06da19ba80f1764aa241438b3a926bd7cffcf39003d2e3b4a3380dda79d7
Opcode Fuzzy Hash: 1fe0c26a9036abef5ee95c4ac4b3fdedf737f9338d7163a728943c57dc64d707
Instruction Fuzzy Hash: 2A31A671208B0192FF1CDB15EE882E967A0FBB87A4F574225DE59636F5EEB4C441C300

Function 0000021E04C82B24 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82B45

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82B6A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82B94
codecvt.LIBCPMT ref: 0000021E04C82BED
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C82C04
_CxxThrowException.LIBCMT ref: 0000021E04C82C15
std::_Facet_Register.LIBCPMT ref: 0000021E04C82C33
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82C3E

Strings

bad cast, xrefs: 0000021E04C82BF8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 2760077954-3145022300
Opcode ID: dc53cec89c99da22bcd306d525d4bf72450f34741b04eaec344622fce76dc459
Instruction ID: 0f351e83068318956508a3e40f223ea892675a372086301f8adc48da81818fe6
Opcode Fuzzy Hash: dc53cec89c99da22bcd306d525d4bf72450f34741b04eaec344622fce76dc459
Instruction Fuzzy Hash: 22319271205B00A1FF199F15EE9C2E967E0FBBC7A4F570266DE59232E5DAB8C481C700

Function 0000021E04C83A94 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83AB5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83ADA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83B04
moneypunct.LIBCPMT ref: 0000021E04C83B5D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83B74
_CxxThrowException.LIBCMT ref: 0000021E04C83B85
std::_Facet_Register.LIBCPMT ref: 0000021E04C83BA3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83BAE

Strings

bad cast, xrefs: 0000021E04C83B68

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: cf3a473d4a2924b6d3a61fecd1b2eafc96592f01937f7426af8f1c781fe91554
Instruction ID: 5c43b2dd988a13b84ce7390f7f119c4131c976ad078df70ce7d11ee456e48bf8
Opcode Fuzzy Hash: cf3a473d4a2924b6d3a61fecd1b2eafc96592f01937f7426af8f1c781fe91554
Instruction Fuzzy Hash: 46318371204A8091FF18DB15EE982E963A0FBE8BA4F575226DE59232F5DBB9C441C300

Function 0000021E04C82C54 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82C75

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82C9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82CC4
collate.LIBCPMT ref: 0000021E04C82D1D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C82D34
_CxxThrowException.LIBCMT ref: 0000021E04C82D45
std::_Facet_Register.LIBCPMT ref: 0000021E04C82D63
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82D6E

Strings

bad cast, xrefs: 0000021E04C82D28

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 0aac932d3e7c268931cf707a4d93752f56fee1ca9c031bf76c3d673b10170def
Instruction ID: 76f7863f544f35a29b041285e781d887ff50f26dcd0c70356e7c9b64c0565869
Opcode Fuzzy Hash: 0aac932d3e7c268931cf707a4d93752f56fee1ca9c031bf76c3d673b10170def
Instruction Fuzzy Hash: 1B318171204A4091FF18DB15EE9C2D967E0FBBC7A0F574226DE59236F5DAB8C841C300

Function 0000021E04C83BC4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83BE5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83C0A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83C34
messages.LIBCPMT ref: 0000021E04C83C8D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83CA4
_CxxThrowException.LIBCMT ref: 0000021E04C83CB5
std::_Facet_Register.LIBCPMT ref: 0000021E04C83CD3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83CDE

Strings

bad cast, xrefs: 0000021E04C83C98

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 2127f81a5437bb88b075241f3d29aaf0cf321937bbea42743d9c4b13c04cc0b3
Instruction ID: 2929b8afbad2cbb317daf8da86e3c03f93241f48af02d8928d8a4d56965088dd
Opcode Fuzzy Hash: 2127f81a5437bb88b075241f3d29aaf0cf321937bbea42743d9c4b13c04cc0b3
Instruction Fuzzy Hash: C531CE72204B40A1FF189B15EE982D973A0FBB8BA0F4B5326DE59232F5DBB9C451C300

Function 0000021E04C83CF4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83D15

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83D3A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83D64
messages.LIBCPMT ref: 0000021E04C83DBD
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83DD4
_CxxThrowException.LIBCMT ref: 0000021E04C83DE5
std::_Facet_Register.LIBCPMT ref: 0000021E04C83E03
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83E0E

Strings

bad cast, xrefs: 0000021E04C83DC8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 783429eb793c2f2f50d0740cc6b0d3dbcf1faffe9df41ccb9df6b9a803999d4c
Instruction ID: 2873de9f1ed39deefdeca74eac1660b120447a4516e882c4cbbac1e0305b22fb
Opcode Fuzzy Hash: 783429eb793c2f2f50d0740cc6b0d3dbcf1faffe9df41ccb9df6b9a803999d4c
Instruction Fuzzy Hash: B331B172204B4091FF18DB15EE982D967A0FBACBA0F575226EE59632F5DEB8C841C700

Function 0000021E04C83E24 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83E45

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C83E6A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83E94
messages.LIBCPMT ref: 0000021E04C83EED
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C83F04
_CxxThrowException.LIBCMT ref: 0000021E04C83F15
std::_Facet_Register.LIBCPMT ref: 0000021E04C83F33
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C83F3E

Strings

bad cast, xrefs: 0000021E04C83EF8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 662288457-3145022300
Opcode ID: 48616abfac1a981897439173c93a6e5aaf7991275bd66df3e03a16717abd7810
Instruction ID: d6599b8346b26e1536f0db14468457997ff595ba00b29eb8cb7a0e6e36d703b7
Opcode Fuzzy Hash: 48616abfac1a981897439173c93a6e5aaf7991275bd66df3e03a16717abd7810
Instruction Fuzzy Hash: F531B371204A8091FF19DB15FE982D963A0FBA8BA0F975225EE59272F5DEB9C841C700

Function 0000021E04C82D84 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82DA5

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C82DCA
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82DF4
collate.LIBCPMT ref: 0000021E04C82E4D
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C82E64
_CxxThrowException.LIBCMT ref: 0000021E04C82E75
std::_Facet_Register.LIBCPMT ref: 0000021E04C82E93
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C82E9E

Strings

bad cast, xrefs: 0000021E04C82E58

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4217240666-3145022300
Opcode ID: 1ff498fc3fba5fdf49fdedaaaf28a20aa44f259ac781903afc3c6c16cf0d7928
Instruction ID: cf20141ce3a34c2f870fde248da74980dc3a829e72f0087d2cbf3168db13513f
Opcode Fuzzy Hash: 1ff498fc3fba5fdf49fdedaaaf28a20aa44f259ac781903afc3c6c16cf0d7928
Instruction Fuzzy Hash: 08317071204A0091FF28DB15EE9C2D967A0FBA8BA5F474226DE59276E5DBB8C842C700

Function 0000021E04C986F8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C98719

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C9873E
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98768
moneypunct.LIBCPMT ref: 0000021E04C987C1
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C987D8
_CxxThrowException.LIBCMT ref: 0000021E04C987E9
std::_Facet_Register.LIBCPMT ref: 0000021E04C98807
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C98812

Strings

bad cast, xrefs: 0000021E04C987CC

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 560648410-3145022300
Opcode ID: 7e8749b240ba5670e75988a1d08956d1c9e00ca2f6b9f8a9a670e6f4b17f3c11
Instruction ID: 50fbb8fbfbee27f14a0ac6a313127ada4b271025dca01a20add21c0f715cf4f0
Opcode Fuzzy Hash: 7e8749b240ba5670e75988a1d08956d1c9e00ca2f6b9f8a9a670e6f4b17f3c11
Instruction Fuzzy Hash: 4C31A871210B00A1FE18EF15EEDC2D963E1EBA9BA0F564311DE59636F9DAB8C941C700

Function 0000021E04C7B560 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7B579

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

__int64.LIBCPMTD ref: 0000021E04C7B592

Part of subcall function 0000021E04C71AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C71B0B
Part of subcall function 0000021E04C71AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C71B3D

std::locale::_Getfacet.LIBCPMTD ref: 0000021E04C7B5A9
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7B65A

Strings

bad cast, xrefs: 0000021E04C7B5EC

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1666373992-3145022300
Opcode ID: 93a5699e027cb8ef89e0de3b46b91101183ef16d26cf5389666435c13f441cb5
Instruction ID: 0e203d4bb6cdd5eecb94d26d0595394c8edcf9aaf2d3888e3e546ff655183fc2
Opcode Fuzzy Hash: 93a5699e027cb8ef89e0de3b46b91101183ef16d26cf5389666435c13f441cb5
Instruction Fuzzy Hash: DC312C32119E8482EE64DB14E9C839AB7A0FB987A4F550211EEDD537A9DF78C654CB00

Function 0000021E04C7ABE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7ABF9

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

__int64.LIBCPMTD ref: 0000021E04C7AC12

Part of subcall function 0000021E04C71AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C71B0B
Part of subcall function 0000021E04C71AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C71B3D

std::locale::_Getfacet.LIBCPMTD ref: 0000021E04C7AC29
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7ACDA

Strings

bad cast, xrefs: 0000021E04C7AC6C

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacet__int64_lockstd::locale::_
String ID: bad cast
API String ID: 1666373992-3145022300
Opcode ID: d78c58cc6dc32a45fa35aa0ea62847462abab04b09d4575ad04a92c308c6451f
Instruction ID: d9dcf29c395782fb6d05e6e9d2d968b0b25c9a9593855663970458252f08a661
Opcode Fuzzy Hash: d78c58cc6dc32a45fa35aa0ea62847462abab04b09d4575ad04a92c308c6451f
Instruction Fuzzy Hash: 3031FA32118A8492EE649B15E98839EB7A0FBD87A4F510211EEDE537A9DF79C244CB00

Function 0000021E04C842E4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C84305

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8432A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C84354
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C843C4
_CxxThrowException.LIBCMT ref: 0000021E04C843D5
std::_Facet_Register.LIBCPMT ref: 0000021E04C843F3
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C843FE

Strings

bad cast, xrefs: 0000021E04C843B8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 9ba023ed03df909f6066c7b5c14fd05801aa9986d2c2f223f424258040ee7ccc
Instruction ID: dc535fd1ab7b686b7279b34ac6bd70b4770575e9a22d622f209aacf1a57028bb
Opcode Fuzzy Hash: 9ba023ed03df909f6066c7b5c14fd05801aa9986d2c2f223f424258040ee7ccc
Instruction Fuzzy Hash: D2319071204B0192FF18DB15EE982D967A0FBA87A4F4B4226DE69632F5EAB8C441C300

Function 0000021E04C84414 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C84435

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8445A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C84484
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C844F4
_CxxThrowException.LIBCMT ref: 0000021E04C84505
std::_Facet_Register.LIBCPMT ref: 0000021E04C84523
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8452E

Strings

bad cast, xrefs: 0000021E04C844E8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 4ee676152d8a6d3fc2897e1a750d37abcf8e05a29651dc9c84745b4ac20e915c
Instruction ID: 67a5e8cb822a087ca7210aaa04c2a819fc8f4cf21c3dc9ed4ea7c2b8211a905c
Opcode Fuzzy Hash: 4ee676152d8a6d3fc2897e1a750d37abcf8e05a29651dc9c84745b4ac20e915c
Instruction Fuzzy Hash: 1E316F72204B4191FF18DB15FE982D967A0FBA87A4F4B4226DE59632F5EAB8C4428700

Function 0000021E04C84544 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C84565

Part of subcall function 0000021E04C7C2AC: _lock.LIBCMT ref: 0000021E04C7C2BE

std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C8458A
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C845B4
std::bad_exception::bad_exception.LIBCMT ref: 0000021E04C84624
_CxxThrowException.LIBCMT ref: 0000021E04C84635
std::_Facet_Register.LIBCPMT ref: 0000021E04C84653
std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8465E

Strings

bad cast, xrefs: 0000021E04C84618

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 885392049-3145022300
Opcode ID: 61d228dc35f4783f95f4f267f4efbd83b46e62b23daaabd50ddf3d7b4201f6b8
Instruction ID: 678e7a917330b0ff60048b9697d77cda5bfa93de7beea0eaec39c8b581aecd59
Opcode Fuzzy Hash: 61d228dc35f4783f95f4f267f4efbd83b46e62b23daaabd50ddf3d7b4201f6b8
Instruction Fuzzy Hash: D9319371204A4191FF18DB15EED82D963A0EBB87A4F5B4226DE59232E5EEB8C445C700

Function 0000021E04CB0310 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021E04CB0339

Part of subcall function 0000021E04CA6398: malloc.LIBCMT ref: 0000021E04CA63C3
Part of subcall function 0000021E04CA6398: Sleep.KERNEL32(?,?,?,0000021E04CA4B14,?,?,?,0000021E04CA4A13,?,?,00000000,0000021E04CAD332,?,?,00000000,0000021E04CAD29E), ref: 0000021E04CA63D6

free.LIBCMT ref: 0000021E04CB043A
free.LIBCMT ref: 0000021E04CB0456

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: caada0040375c754c365269c74eac08a2c7c6ecaf5709b2b132bd05a7a63ca1e
Instruction ID: fed4e2a26c53fb897ddbc2f3ae2e0420f99ef3847fb558fa13997109fd096ea6
Opcode Fuzzy Hash: caada0040375c754c365269c74eac08a2c7c6ecaf5709b2b132bd05a7a63ca1e
Instruction Fuzzy Hash: EA617132301B4092FF28EB16EE9879A73E0FB58798F5A4125DE4D17B51DFB8C4658780

Function 0000021E04C78D70 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021E04C74C10: shared_ptr.LIBCPMTD ref: 0000021E04C74C2B

codecvt.LIBCPMTD ref: 0000021E04C78EDF

Strings

bad conversion, xrefs: 0000021E04C78FCE, 0000021E04C790A6

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: codecvtshared_ptr
String ID: bad conversion
API String ID: 864914841-2629740042
Opcode ID: f686c19bb21e7c99195cfd856166b89ac244ed319bd7e827f4bfb7f3c19f572a
Instruction ID: 711973c32c7423069f81b50ff20dfcd9e1f7e334c96268e03272493047297479
Opcode Fuzzy Hash: f686c19bb21e7c99195cfd856166b89ac244ed319bd7e827f4bfb7f3c19f572a
Instruction Fuzzy Hash: 8F912372219AC496FE78DB15E9853DEA3A0FBE9780F510112DACD53BA9DFB8C544CB00

Function 0000021E04CB939C Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CB93C7
_errno.LIBCMT ref: 0000021E04CB93BC

Part of subcall function 0000021E04CA3B0C: _getptd_noexit.LIBCMT ref: 0000021E04CA3B10

_errno.LIBCMT ref: 0000021E04CB946A
_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CB9475

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: e6115aaee9bd6988ad82c43c6dd58144aeb0dd506a0ad067c6414fbe19083d80
Instruction ID: 73edfe043e39a0ef7c57a236c037b2fd2ae72b4917a723f5a0d091964a556de6
Opcode Fuzzy Hash: e6115aaee9bd6988ad82c43c6dd58144aeb0dd506a0ad067c6414fbe19083d80
Instruction Fuzzy Hash: 4D4115F26002A181FF6C9B11AAC83F976E0EF68B94FA64111EF84276D5D7B8C951C750

Function 0000021E04CB2D84 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CB2DAA
_errno.LIBCMT ref: 0000021E04CB2D9F

Part of subcall function 0000021E04CA3B0C: _getptd_noexit.LIBCMT ref: 0000021E04CA3B10

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CB2E29
_errno.LIBCMT ref: 0000021E04CB2E3A
_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CB2E45

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: dfee2ec86327835073bb60d14cfa61aec5f3f40ef22b560a8e2aa4c0f90f1485
Instruction ID: 4342de4fbd4844649b6e7624534b2f91bb384828f7f7f836dc25dfb052eac83f
Opcode Fuzzy Hash: dfee2ec86327835073bb60d14cfa61aec5f3f40ef22b560a8e2aa4c0f90f1485
Instruction Fuzzy Hash: D2413A726102E041FF6C6B129EDC3F933E0EB78BA5FA64026EE94276C4D7A8C851D740

Function 0000021E04CBBF5C Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CBBF90

Part of subcall function 0000021E04CA3B7C: _getptd.LIBCMT ref: 0000021E04CA3B92
Part of subcall function 0000021E04CA3B7C: __updatetlocinfo.LIBCMT ref: 0000021E04CA3BC7
Part of subcall function 0000021E04CA3B7C: __updatetmbcinfo.LIBCMT ref: 0000021E04CA3BEE

_errno.LIBCMT ref: 0000021E04CBBFAB
_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CBBFB6

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction ID: 9f651e50367f1261f9d8d78e6e368b3066b7e8d8ff2f046c6dd2b236f61a6eab
Opcode Fuzzy Hash: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction Fuzzy Hash: 0131A27160478085FF249B11AAC87DD77E4EBACBE0F264125EE5427B95DBB4C841CB80

Function 0000021E04CA5ADC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021E04CA5AFD
_getptd.LIBCMT ref: 0000021E04CA5B0B
_getptd.LIBCMT ref: 0000021E04CA5B1D

Strings

RCC, xrefs: 0000021E04CA5AE3
csm, xrefs: 0000021E04CA5AF3
MOC, xrefs: 0000021E04CA5AEB

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction ID: f6381a537bde3cc05dcb3aaea48f669003612e7541ca17c78bc43cab69cc7a07
Opcode Fuzzy Hash: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction Fuzzy Hash: 5EF0F835610104DAFE692B549A893E821D1ABBCB0EF87C561DA052268297FC49A5CB12

Function 0000021E04C853C8 Relevance: 9.3, APIs: 6, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000021E04C85471
localeconv.LIBCMT ref: 0000021E04C85483
strcspn.LIBCMT ref: 0000021E04C85497
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C854A6
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C8552F
_Mpunct.LIBCPMT ref: 0000021E04C85568

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: e6d4c13a13f37a2c0e240a87e1a0af4942c429ab79be8636b1550a59db188ce2
Instruction ID: f355cf0e2c9783e46565b2eba670e54e53272f8a30d331a443df5e3a3512bf11
Opcode Fuzzy Hash: e6d4c13a13f37a2c0e240a87e1a0af4942c429ab79be8636b1550a59db188ce2
Instruction Fuzzy Hash: 21E1D032704A8099FF188F65C9892EC73F1EB6CB88F564119DE4967B88EFB8C546C344

Function 0000021E04C84F34 Relevance: 9.3, APIs: 6, Instructions: 331stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000021E04C84FDD
localeconv.LIBCMT ref: 0000021E04C84FEF
strcspn.LIBCMT ref: 0000021E04C85003
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C85012
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C8509B
_Mpunct.LIBCPMT ref: 0000021E04C850D4

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: 519f33cb95e0d99ee0d4355dc84f9f0201176b2b605b694342907c18314ab85a
Instruction ID: b5eb2b49eae42b311d221d4dc139a673a80938b26429afc6e1957ffa8a49916b
Opcode Fuzzy Hash: 519f33cb95e0d99ee0d4355dc84f9f0201176b2b605b694342907c18314ab85a
Instruction Fuzzy Hash: BBE1D232704A8099FF188FA5C9893EC63F1FB68B88F564119DE4967B89EFB8C545C344

Function 0000021E04C7CBF8 Relevance: 9.3, APIs: 6, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000021E04C7CCA0
localeconv.LIBCMT ref: 0000021E04C7CCB3
strcspn.LIBCMT ref: 0000021E04C7CCC9
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C7CCD9
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C7CD62
_Mpunct.LIBCPMT ref: 0000021E04C7CD9B

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::ios_base::getlocstrcspn$Mpunctlocaleconv
String ID:
API String ID: 897058063-0
Opcode ID: 249c8184b0c50b0624f1531bd89af645a8e4f17256f81473f5670aed722e2b0a
Instruction ID: d1de79735f78e1b40d12cb3ecccb95e22e0cce8ef8e68c3606b3158ee562e0af
Opcode Fuzzy Hash: 249c8184b0c50b0624f1531bd89af645a8e4f17256f81473f5670aed722e2b0a
Instruction Fuzzy Hash: 72D19E32B04A858AFF148FB5D9942DC27B1FB6DB88F955115DE8A27B8ACF78C146C340

Function 0000021E04C7B0A0 Relevance: 9.3, APIs: 6, Instructions: 253COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C7B1FC

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C7ABE0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C7ABF9
Part of subcall function 0000021E04C7ABE0: __int64.LIBCPMTD ref: 0000021E04C7AC12
Part of subcall function 0000021E04C7ABE0: std::locale::_Getfacet.LIBCPMTD ref: 0000021E04C7AC29
Part of subcall function 0000021E04C7ABE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C7ACDA

char_traits.LIBCPMTD ref: 0000021E04C7B31E
ctype.LIBCPMTD ref: 0000021E04C7B385
char_traits.LIBCPMTD ref: 0000021E04C7B3F1
char_traits.LIBCPMTD ref: 0000021E04C7B4BF
std::ios_base::width.LIBCPMTD ref: 0000021E04C7B4FF

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: char_traits$Lockitstd::_$GetfacetLockit::_Lockit::~___int64ctypestd::ios_base::getlocstd::ios_base::widthstd::locale::_std::locale::locale
String ID:
API String ID: 2740546168-0
Opcode ID: a07e37d6cc49bf2a2ce72d55d671cce5715a6d797d1835dc9c2bdc10f607b4b5
Instruction ID: 2f3addf84ea29b484498d632f135c20348e552cd6f30660a28a718464e8d2d66
Opcode Fuzzy Hash: a07e37d6cc49bf2a2ce72d55d671cce5715a6d797d1835dc9c2bdc10f607b4b5
Instruction Fuzzy Hash: ECC1EC36208BC486EE74DB15E5953AEB7A0FBD8784F418516EE8E53B69DF7CC5408B00

Function 0000021E04CA86E4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000021E04CA8761
_invoke_watson.LIBCMT ref: 0000021E04CA8849

Part of subcall function 0000021E04CAA508: _call_reportfault.LIBCMT ref: 0000021E04CAA530

_invoke_watson.LIBCMT ref: 0000021E04CA885E
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CA8716

Part of subcall function 0000021E04CA3B7C: _getptd.LIBCMT ref: 0000021E04CA3B92
Part of subcall function 0000021E04CA3B7C: __updatetlocinfo.LIBCMT ref: 0000021E04CA3BC7
Part of subcall function 0000021E04CA3B7C: __updatetmbcinfo.LIBCMT ref: 0000021E04CA3BEE

Strings

:, xrefs: 0000021E04CA877F

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction ID: 213073ed2545693c53a590898a5a734a02024ffd9cd2056aa9dddb9828cc72d4
Opcode Fuzzy Hash: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction Fuzzy Hash: DB41BD32721B4482FE08AB26AA897DD63E5FB58BC8F4A9425DF5D27745DE74D422C300

Function 0000021E04C76060 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 0000021E04C76134

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: af233356ab44033a1af5434a4fe9d0445c43cbdf01476d6f5b86da92ac9fc8ae
Instruction ID: cbf4492061977f0743162293471f451a54141dd81655eb69b24b0602207f5e04
Opcode Fuzzy Hash: af233356ab44033a1af5434a4fe9d0445c43cbdf01476d6f5b86da92ac9fc8ae
Instruction Fuzzy Hash: 9CA16B31209A8086FE64DB11ED993EFB3E0FBE8790F514121EA8D5369ADFB8C545CB00

Function 0000021E04C92028 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000021E04C920DF
_Mpunct.LIBCPMT ref: 0000021E04C9211E
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C92093

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C84084: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C840A5
Part of subcall function 0000021E04C84084: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C840CA
Part of subcall function 0000021E04C84084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C840F4
Part of subcall function 0000021E04C84084: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C8419E

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C92191
_Stoulx.LIBCPMT ref: 0000021E04C921CA

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Mpunctstd::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 3293814644-0
Opcode ID: 1b6468ebf12914b2f0fe8338e001e18fabad8228a10c305a24cbb031952596d2
Instruction ID: ea41c785ae6342edc8bd5a49e65bd879c244b1cac69db417a7680f9749b4a433
Opcode Fuzzy Hash: 1b6468ebf12914b2f0fe8338e001e18fabad8228a10c305a24cbb031952596d2
Instruction Fuzzy Hash: 9B51F132701A80A6FF18DBA5E9886DE73B0FB99B98F020516EE4927B98DE74C405C740

Function 0000021E04C92CD0 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000021E04C92D87
_Mpunct.LIBCPMT ref: 0000021E04C92DC6
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C92D3B

Part of subcall function 0000021E04C73F40: std::locale::locale.LIBCPMTD ref: 0000021E04C73F64

Part of subcall function 0000021E04C841B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C841D5
Part of subcall function 0000021E04C841B4: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C841FA
Part of subcall function 0000021E04C841B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C84224
Part of subcall function 0000021E04C841B4: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C842CE

std::ios_base::getloc.LIBCPMTD ref: 0000021E04C92E39
_Stoulx.LIBCPMT ref: 0000021E04C92E72

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Mpunctstd::ios_base::getloc$Stoulxstd::locale::locale
String ID:
API String ID: 3293814644-0
Opcode ID: ba231bb55e8ad13bb8c84fadf00820e2b831a140557f64e95a63da8dc5e447dc
Instruction ID: 7a4d8ed864b14cd8cb0c5ad9da132b0b79717bd26bb6438af9328590b8c1d360
Opcode Fuzzy Hash: ba231bb55e8ad13bb8c84fadf00820e2b831a140557f64e95a63da8dc5e447dc
Instruction Fuzzy Hash: A651CC36710A40A6FF18DFA6D9886DE73F0FB99B98F020516EE4927B98DE74C405C740

Function 0000021E04CAD46C Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CAD4CE
_isleadbyte_l.LIBCMT ref: 0000021E04CAD4FE
MultiByteToWideChar.KERNEL32 ref: 0000021E04CAD53D
MultiByteToWideChar.KERNEL32 ref: 0000021E04CAD58B
_errno.LIBCMT ref: 0000021E04CAD595

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 1d846ac782697e1626f60741b10654be5d980ecfef08fe52ee6ab297ca0a43db
Instruction ID: cc932a5d8f087ad41b0ffa36bbe1af79002c7cd2181a816ba9519a02606114ba
Opcode Fuzzy Hash: 1d846ac782697e1626f60741b10654be5d980ecfef08fe52ee6ab297ca0a43db
Instruction Fuzzy Hash: CA41C57121478086FF648F15EAC83A977E6FFA8B88F154115EF4A67FA5CB74C4618700

Function 0000021E04C75E20 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 0000021E04C75E78
char_traits.LIBCPMTD ref: 0000021E04C75EB1
char_traits.LIBCPMTD ref: 0000021E04C75ECC
char_traits.LIBCPMTD ref: 0000021E04C75EFE

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: efd17d778424b9709a2ebecd350b9a00f791cf1ba8a6ebccbfb2f640782f2fd7
Instruction ID: e735e58ac5b20e5a4becc451439917a5948736ee6def139c5859b7de95fe4ffd
Opcode Fuzzy Hash: efd17d778424b9709a2ebecd350b9a00f791cf1ba8a6ebccbfb2f640782f2fd7
Instruction Fuzzy Hash: F441533211454492FE18EB15E9993EA63F0FFE9784F550012FB8D97AEADFA8CA04C740

Function 0000021E04CA4448 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0000021E04CA4455

Part of subcall function 0000021E04CAD224: _getptd_noexit.LIBCMT ref: 0000021E04CAD22A
Part of subcall function 0000021E04CAD224: _amsg_exit.LIBCMT ref: 0000021E04CAD23A

_inconsistency.LIBCMT ref: 0000021E04CA4463

Part of subcall function 0000021E04CAEC80: DecodePointer.KERNEL32 ref: 0000021E04CAEC8B

_getptd.LIBCMT ref: 0000021E04CA4468
_inconsistency.LIBCMT ref: 0000021E04CA4484
_getptd.LIBCMT ref: 0000021E04CA4494

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction ID: 302e82750eadd484d11e154dcda343012944853f7781bc4d32bf9748f46fa5b3
Opcode Fuzzy Hash: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction Fuzzy Hash: CBF0543120058080FE6CAB51E7C92EC52D19F7CB4CF0E4521EE45276879EF0C871C354

Function 0000021E04CBE4CD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0000021E04CA4448: _getptd.LIBCMT ref: 0000021E04CA4455
Part of subcall function 0000021E04CA4448: _inconsistency.LIBCMT ref: 0000021E04CA4463
Part of subcall function 0000021E04CA4448: _getptd.LIBCMT ref: 0000021E04CA4468
Part of subcall function 0000021E04CA4448: _inconsistency.LIBCMT ref: 0000021E04CA4484

__DestructExceptionObject.LIBCMT ref: 0000021E04CBE51A
_getptd.LIBCMT ref: 0000021E04CBE520
_getptd.LIBCMT ref: 0000021E04CBE533

Part of subcall function 0000021E04CA44D8: _getptd.LIBCMT ref: 0000021E04CA44E1

Strings

csm, xrefs: 0000021E04CBE4ED

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction ID: 76b754e320b09a59e6074dfb8de8a5323a43c42b20e290a4e162413a7e31635f
Opcode Fuzzy Hash: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction Fuzzy Hash: B1014F3210164189FF289F31ADC93ED33E4EB68B5DF1A6521ED0A5A645EEB0D895C390

Function 0000021E04C81610 Relevance: 6.1, APIs: 4, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 0000021E04C815A5
fclose.LIBCMT ref: 0000021E04C815B2
_wfsopen.LIBCMT ref: 0000021E04C815C7
fseek.LIBCMT ref: 0000021E04C815E1

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction ID: e76c0561fcf1a5bdcae2eae08a4dd340ed30c57f18b5fcdf034f937ff3985cf3
Opcode Fuzzy Hash: 66608ed3d9a3b7f166453832a9f1b2a902d53ff026ec2d0a3286f5d598873d35
Instruction Fuzzy Hash: 1E21E13172065084FF6CCB069AC97EA23D1AFACB84F1F4128CE4BA3791DEB9C4028740

Function 0000021E04CBCB40 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000021E04CBCB64

Part of subcall function 0000021E04CA3B7C: _getptd.LIBCMT ref: 0000021E04CA3B92
Part of subcall function 0000021E04CA3B7C: __updatetlocinfo.LIBCMT ref: 0000021E04CA3BC7
Part of subcall function 0000021E04CA3B7C: __updatetmbcinfo.LIBCMT ref: 0000021E04CA3BEE

_errno.LIBCMT ref: 0000021E04CBCB70

Part of subcall function 0000021E04CA3B0C: _getptd_noexit.LIBCMT ref: 0000021E04CA3B10

_invalid_parameter_noinfo.LIBCMT ref: 0000021E04CBCB7B
strchr.LIBCMT ref: 0000021E04CBCB91

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction ID: fb5789cb64487bd73aa304beb16634342626ddc9766856ecfbceed18c9b2fdf6
Opcode Fuzzy Hash: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction Fuzzy Hash: EF212B721082B440FF6816159AD83FDB7D0EB6CBD4F3A4169EE86676C5C9ACC4418750

Function 0000021E04C76580 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000021E04C76614

Part of subcall function 0000021E04CA2514: _errno.LIBCMT ref: 0000021E04CA253D
Part of subcall function 0000021E04CA2514: _invalid_parameter_noinfo.LIBCMT ref: 0000021E04CA2548

fgetpos.LIBCMT ref: 0000021E04C7662E
fpos.LIBCPMTD ref: 0000021E04C76643
fpos.LIBCPMTD ref: 0000021E04C76683

Part of subcall function 0000021E04CA2AA4: _errno.LIBCMT ref: 0000021E04CA2AAD
Part of subcall function 0000021E04CA2AA4: _invalid_parameter_noinfo.LIBCMT ref: 0000021E04CA2AB8

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfofpos$_fseeki64fgetpos
String ID:
API String ID: 1989672365-0
Opcode ID: e02842f5a42da3625d84d50036dede68edc7dbfdcb998bdce8beb25ad7a6383a
Instruction ID: 16380b2a70ff03ba3a4d236e92eba8c210a008efff6bae3a6b71b9df082a8eaf
Opcode Fuzzy Hash: e02842f5a42da3625d84d50036dede68edc7dbfdcb998bdce8beb25ad7a6383a
Instruction Fuzzy Hash: 3631FF76204A8082EE14DB16E9C839A67F0FBD97D4F554025EF8C57B6ACFB9C610CB40

Function 0000021E04C991C4 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021E04CA3770: malloc.LIBCMT ref: 0000021E04CA378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000021E04C99240
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000021E04C99268
free.LIBCMT ref: 0000021E04C99280
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000021E04C99297

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: d8e69efa26ad0008533831846f76d24351a0b3f39eb347073c5dfcd3e47a997e
Instruction ID: af617c822b44380bb9c0f10be5d5a5182f0b2eb652a74e7e7add4228a24d5b68
Opcode Fuzzy Hash: d8e69efa26ad0008533831846f76d24351a0b3f39eb347073c5dfcd3e47a997e
Instruction Fuzzy Hash: 4C216872201F4091FF28CF11EA983A973E4FBA8BA4F864225CE5857794DFB8C911C380

Function 0000021E04C86AF0 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021E04CA3770: malloc.LIBCMT ref: 0000021E04CA378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000021E04C86B6C
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000021E04C86B94
free.LIBCMT ref: 0000021E04C86BAC
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000021E04C86BC3

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: ee97dc229c5cd99bb1ca05c9355866ee283a5751f5faa2f00eedab80158d67f4
Instruction ID: 0c0eb3bb659011b88cd4c0e76447a23f09a4c1fef0be779599cee38a55cac23b
Opcode Fuzzy Hash: ee97dc229c5cd99bb1ca05c9355866ee283a5751f5faa2f00eedab80158d67f4
Instruction Fuzzy Hash: BB215A72301B4481FF28CF11DA983E963E4FBA8B98F864269CE5857395DFB8C915C780

Function 0000021E04C86BE8 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000021E04CA3770: malloc.LIBCMT ref: 0000021E04CA378A

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000021E04C86C64
std::_Locinfo::_Gettnames.LIBCPMT ref: 0000021E04C86C8C
free.LIBCMT ref: 0000021E04C86CA4
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000021E04C86CBB

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$LocinfoLocinfo::_$GettnamesLocinfo::~_freemalloc
String ID:
API String ID: 409281135-0
Opcode ID: 1c985824af1acae9496c5e71a96abd0544d665edfd3f96118f34935afdf6e220
Instruction ID: dddbcc8d82365a4bfdb9a4681ebfc64875a8a0246a635004a3f727f1fa51b0d8
Opcode Fuzzy Hash: 1c985824af1acae9496c5e71a96abd0544d665edfd3f96118f34935afdf6e220
Instruction Fuzzy Hash: 4C216972301B4481FF28CF15DA9839963E4FBA8BA4F874229CE6857395DFB8C955C740

Function 0000021E04C76470 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_fseeki64.LIBCMT ref: 0000021E04C76509
fgetpos.LIBCMT ref: 0000021E04C76523
fpos.LIBCPMTD ref: 0000021E04C76538
fpos.LIBCPMTD ref: 0000021E04C76563

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: fpos$_fseeki64fgetpos
String ID:
API String ID: 1811617113-0
Opcode ID: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction ID: 6ce51f498b8cd1f4d07879dcba5afbcd844e500cd73fd0587b1798890fdd7086
Opcode Fuzzy Hash: 4dd5a6bf44b4f08af2fe84d530f4457cc968653dd13fc1324dcdb608c86c5414
Instruction Fuzzy Hash: 31312172204A8486FE54DB15E98839AA7F0FBE9794F114011EF8C53BAACFB9C944CB40

Function 0000021E04C7B6E0 Relevance: 6.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0000021E04C7B6FB

Part of subcall function 0000021E04C7BE18: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0000021E04C7BE46

__int64.LIBCPMTD ref: 0000021E04C7B717

Part of subcall function 0000021E04C71AF0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C71B0B
Part of subcall function 0000021E04C71AF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C71B3D

_aligned_msize.LIBCMTD ref: 0000021E04C7B72C

Part of subcall function 0000021E04C71C30: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0000021E04C71C52

codecvt.LIBCPMTD ref: 0000021E04C7B735

Part of subcall function 0000021E04C72270: std::locale::c_str.LIBCPMTD ref: 0000021E04C722D2
Part of subcall function 0000021E04C72270: std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000021E04C722DF
Part of subcall function 0000021E04C72270: collate.LIBCPMTD ref: 0000021E04C7230B
Part of subcall function 0000021E04C72270: std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000021E04C7234F

Part of subcall function 0000021E04C74ED0: Concurrency::cancellation_token::_Clear.LIBCPMTD ref: 0000021E04C74EF8
Part of subcall function 0000021E04C74ED0: malloc.LIBCMT ref: 0000021E04C74F51

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Locimp::_std::locale::_$LocimpLocinfoLockit$AddfacClearConcurrency::cancellation_token::_Locimp_Locinfo::_Locinfo::~_Lockit::_Lockit::~_New___int64_aligned_msizecodecvtcollatemallocstd::locale::c_str
String ID:
API String ID: 1811419688-0
Opcode ID: 7af322f36f17e67862f741fc24bfc0139ff588b013d2130c712c45a990bd171e
Instruction ID: 5e67eaffbaccd1017c4181b8bbb842b917a46f76dc74a666a0001e287d54ffa4
Opcode Fuzzy Hash: 7af322f36f17e67862f741fc24bfc0139ff588b013d2130c712c45a990bd171e
Instruction Fuzzy Hash: 5A018032215B4482EE48DB2AE9D938A73A0FBD8BE4F414211EE9E137A5CF78C5548700

Function 0000021E04C72180 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 0000021E04C721AA

Part of subcall function 0000021E04C71F60: std::locale::facet::facet.LIBCPMTD ref: 0000021E04C71F78

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0000021E04C721CE

Part of subcall function 0000021E04C717E0: std::_Lockit::_Lockit.LIBCPMT ref: 0000021E04C71801
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C71813
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C71825
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C71837
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C71849
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C7185B
Part of subcall function 0000021E04C717E0: _Yarn.LIBCPMTD ref: 0000021E04C7186D
Part of subcall function 0000021E04C717E0: std::bad_exception::bad_exception.LIBCMTD ref: 0000021E04C71887
Part of subcall function 0000021E04C717E0: _CxxThrowException.LIBCMT ref: 0000021E04C71898
Part of subcall function 0000021E04C717E0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000021E04C718A7

codecvt.LIBCPMTD ref: 0000021E04C721E1

Part of subcall function 0000021E04C723A0: std::_Locinfo::_Getcvt.LIBCPMTD ref: 0000021E04C723CC

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0000021E04C721EC

Part of subcall function 0000021E04C718C0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0000021E04C718CE
Part of subcall function 0000021E04C718C0: std::_Lockit::~_Lockit.LIBCPMT ref: 0000021E04C71941

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::_$Yarn$Locinfo::_$LocinfoLockitstd::bad_exception::bad_exception$ExceptionGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwcodecvtstd::locale::facet::facet
String ID:
API String ID: 2580637281-0
Opcode ID: adcdcac3d387f150fc2c396cd21c3c6a73979b2da0c270e4eb99f33f457a8872
Instruction ID: 593049bd70d016f61c31e625f00b8cdb191f9f7d1cb48db898dd6fe46b6b753d
Opcode Fuzzy Hash: adcdcac3d387f150fc2c396cd21c3c6a73979b2da0c270e4eb99f33f457a8872
Instruction Fuzzy Hash: 08F04932225BC092EE60DB24E8853DA7361FBD57A0F415211EAED53BE9CF6CC208CB01

Function 0000021E04C95D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0000021E04C95E01
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C95E22

Strings

%.0Lf, xrefs: 0000021E04C95DF1

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::ios_base::getlocswprintf
String ID: %.0Lf
API String ID: 2734600178-1402515088
Opcode ID: 0b52692e544fc50670088c299cef916147423b381afed6a016f19d8ad1928563
Instruction ID: a2e3283749ed12073c435030a0ba7c6d747c35d896ac06a0e7d85ce050d83213
Opcode Fuzzy Hash: 0b52692e544fc50670088c299cef916147423b381afed6a016f19d8ad1928563
Instruction Fuzzy Hash: 35519B33714B8096FB01CBA6E9883DD63B0EB98798F114216EE5D67B98DF78C44AC700

Function 0000021E04C9CF6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0000021E04C9D00B
std::ios_base::getloc.LIBCPMTD ref: 0000021E04C9D02C

Strings

%.0Lf, xrefs: 0000021E04C9CFFB

Memory Dump Source

Source File: 00000003.00000002.4684051974.0000021E04C70000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000021E04C70000, based on PE: true

Associated: 00000003.00000002.4684051974.0000021E04D18000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_21e04c70000_rundll32.jbxd

Similarity

API ID: std::ios_base::getlocswprintf
String ID: %.0Lf
API String ID: 2734600178-1402515088
Opcode ID: 4ecb6063488c6e6240f3922736982e1e2cd0c6d48fa5f7eaa1debd812ab1ff6c
Instruction ID: 9ab9041f503ddbcff8c23c98e0fac9fc4f9dda570b37eba108142905b82c4fa8
Opcode Fuzzy Hash: 4ecb6063488c6e6240f3922736982e1e2cd0c6d48fa5f7eaa1debd812ab1ff6c
Instruction Fuzzy Hash: 3651FF32704B8096FB11CB75E9883DD67B0EBA9798F510212EE5A37B99DF78C04AC700

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report avutil.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\NTUSER.DAT.Not

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
avutil.dll.dll