Edit tour

Windows Analysis Report
apilibx64.exe

Overview

General Information

Sample name:	apilibx64.exe
Analysis ID:	1570005
MD5:	bca7e8cada42a299c99380fd96e5104f
SHA1:	7d45496f1b23412425ec5c39ee5e0177a9269441
SHA256:	6e6656ae6250e35281bc76ad996849ad047f2013b633c00d49e2ff07e590a1c1
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

apilibx64.exe (PID: 7152 cmdline: "C:\Users\user\Desktop\apilibx64.exe" MD5: BCA7E8CADA42A299C99380FD96E5104F)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: apilibx64.exe PID: 7152	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: apilibx64.exe PID: 7152	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.apilibx64.exe.2b45afa0000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.apilibx64.exe.2b45afa0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:09:05.357434+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:09:05.357434+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.477481+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:09:05.357434+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.477481+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.apilibx64.exe.2b45afa0000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B011EA0 CryptUnprotectData,LocalFree,	0_2_000002B45B011EA0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFD5EE0 CryptUnprotectData,LocalFree,	0_2_000002B45AFD5EE0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0121C0 CryptProtectData,LocalFree,	0_2_000002B45B0121C0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B072090 CryptUnprotectData,	0_2_000002B45B072090

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: apilibx64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B059810 FindClose,FindFirstFileExW,GetLastError,		0_2_000002B45B059810
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0598C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002B45B0598C0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B0213B0 GetLogicalDriveStringsW,

0_2_000002B45B0213B0

Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B01E9F0 recv,recv,closesocket,WSACleanup,

0_2_000002B45B01E9F0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: apilibx64.exe, 00000000.00000003.1886809285.000002B45BE24000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1886758525.000002B45BE20000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1886727297.000002B45BE20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: apilibx64.exe, 00000000.00000003.1702540903.000002B45BE11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/RegiU
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: apilibx64.exe, 00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: apilibx64.exe, 00000000.00000003.1703039193.000002B4594A1000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000002.1887143065.000002B459484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/A%
Source: apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: apilibx64.exe, 00000000.00000003.1709121696.000002B45C8BC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2DC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B280000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C0000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C8000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2D4000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C0FF000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707840209.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B288000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: apilibx64.exe, 00000000.00000003.1704800492.000002B45C0E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: apilibx64.exe, 00000000.00000003.1704271513.000002B45C073000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C09C000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C083000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704509749.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C0C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: apilibx64.exe, 00000000.00000003.1704800492.000002B45C0E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: apilibx64.exe, 00000000.00000003.1704271513.000002B45C073000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C09C000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C083000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704509749.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C0C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: apilibx64.exe, 00000000.00000003.1709121696.000002B45C8BC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2DC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B280000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C0000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C8000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2D4000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C0FF000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707840209.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B288000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: apilibx64.exe, 00000000.00000003.1708288496.000002B45B934000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C10F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1CF000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B28F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: apilibx64.exe, 00000000.00000003.1708288496.000002B45B934000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C10F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1CF000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B28F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B01FB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_000002B45B01FB30

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0726E0 NtAllocateVirtualMemory,	0_2_000002B45B0726E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B023CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_000002B45B023CF0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0243F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_000002B45B0243F0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAA34C0 NtQueryVirtualMemory,NtProtectVirtualMemory,	0_2_00007FF65DAA34C0

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B020820	0_2_000002B45B020820
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFDB820	0_2_000002B45AFDB820
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B021660	0_2_000002B45B021660
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B02C55A	0_2_000002B45B02C55A
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B02662B	0_2_000002B45B02662B
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B03749C	0_2_000002B45B03749C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B028B70	0_2_000002B45B028B70
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B01FB30	0_2_000002B45B01FB30
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B05E968	0_2_000002B45B05E968
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFDC8C0	0_2_000002B45AFDC8C0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFCF8B0	0_2_000002B45AFCF8B0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0598C0	0_2_000002B45B0598C0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B018F60	0_2_000002B45B018F60
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B021FF0	0_2_000002B45B021FF0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFDCF60	0_2_000002B45AFDCF60
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFDACC0	0_2_000002B45AFDACC0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B001340	0_2_000002B45B001340
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFE22D0	0_2_000002B45AFE22D0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B04114C	0_2_000002B45B04114C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B01F200	0_2_000002B45B01F200
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFCF1C0	0_2_000002B45AFCF1C0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0270B0	0_2_000002B45B0270B0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B024740	0_2_000002B45B024740
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B016760	0_2_000002B45B016760
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFE86D0	0_2_000002B45AFE86D0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFF66A0	0_2_000002B45AFF66A0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B03F7F4	0_2_000002B45B03F7F4
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0347FC	0_2_000002B45B0347FC
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFEC820	0_2_000002B45AFEC820
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B02B68A	0_2_000002B45B02B68A
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0106A6	0_2_000002B45B0106A6
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B03E6F8	0_2_000002B45B03E6F8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B004710	0_2_000002B45B004710
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFC5520	0_2_000002B45AFC5520
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFC6510	0_2_000002B45AFC6510
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0345F8	0_2_000002B45B0345F8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00C600	0_2_000002B45B00C600
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B04A438	0_2_000002B45B04A438
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFA6610	0_2_000002B45AFA6610
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFF55B0	0_2_000002B45AFF55B0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0454E8	0_2_000002B45B0454E8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B020500	0_2_000002B45B020500
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFD7B8D	0_2_000002B45AFD7B8D
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B008950	0_2_000002B45B008950
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B046984	0_2_000002B45B046984
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0419B8	0_2_000002B45B0419B8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0429F4	0_2_000002B45B0429F4
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B034A00	0_2_000002B45B034A00
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFF9A10	0_2_000002B45AFF9A10
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B03088C	0_2_000002B45B03088C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0128C0	0_2_000002B45B0128C0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0358D0	0_2_000002B45B0358D0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00C930	0_2_000002B45B00C930
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00CF70	0_2_000002B45B00CF70
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFCFEE0	0_2_000002B45AFCFEE0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B01AE50	0_2_000002B45B01AE50
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B049EA0	0_2_000002B45B049EA0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFA6D20	0_2_000002B45AFA6D20
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B044D78	0_2_000002B45B044D78
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B030D98	0_2_000002B45B030D98
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00FDB0	0_2_000002B45B00FDB0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B03EE06	0_2_000002B45B03EE06
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B038C34	0_2_000002B45B038C34
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00CC50	0_2_000002B45B00CC50
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFA5DB0	0_2_000002B45AFA5DB0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B032CD0	0_2_000002B45B032CD0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFEE320	0_2_000002B45AFEE320
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFD02E0	0_2_000002B45AFD02E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0413C8	0_2_000002B45B0413C8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0243F0	0_2_000002B45B0243F0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFC83D0	0_2_000002B45AFC83D0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00D2A0	0_2_000002B45B00D2A0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B05E2CC	0_2_000002B45B05E2CC
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00C300	0_2_000002B45B00C300
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFD6130	0_2_000002B45AFD6130
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFEE130	0_2_000002B45AFEE130
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFD9090	0_2_000002B45AFD9090
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0151E0	0_2_000002B45B0151E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0101F0	0_2_000002B45B0101F0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B018230	0_2_000002B45B018230
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B00F040	0_2_000002B45B00F040
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B035044	0_2_000002B45B035044
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B037060	0_2_000002B45B037060
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFDA1F0	0_2_000002B45AFDA1F0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45AFA6180	0_2_000002B45AFA6180
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAEFF2C	0_2_00007FF65DAEFF2C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADCEB2	0_2_00007FF65DADCEB2
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DB03DA0	0_2_00007FF65DB03DA0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE4110	0_2_00007FF65DAE4110
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAC30B0	0_2_00007FF65DAC30B0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAF209C	0_2_00007FF65DAF209C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADAF56	0_2_00007FF65DADAF56
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADCFA0	0_2_00007FF65DADCFA0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD7F90	0_2_00007FF65DAD7F90
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAEFA90	0_2_00007FF65DAEFA90
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADF9F0	0_2_00007FF65DADF9F0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAB39E0	0_2_00007FF65DAB39E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADCA20	0_2_00007FF65DADCA20
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE9CD8	0_2_00007FF65DAE9CD8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE6CD8	0_2_00007FF65DAE6CD8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADFBF4	0_2_00007FF65DADFBF4
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD4C30	0_2_00007FF65DAD4C30
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD8C30	0_2_00007FF65DAD8C30
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD9C10	0_2_00007FF65DAD9C10
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD2B97	0_2_00007FF65DAD2B97
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAB66E0	0_2_00007FF65DAB66E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAB6730	0_2_00007FF65DAB6730
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADC550	0_2_00007FF65DADC550
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAF28CC	0_2_00007FF65DAF28CC
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE6844	0_2_00007FF65DAE6844
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAEC8B4	0_2_00007FF65DAEC8B4
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADF7EC	0_2_00007FF65DADF7EC
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE8758	0_2_00007FF65DAE8758
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAC27B0	0_2_00007FF65DAC27B0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE07B4	0_2_00007FF65DAE07B4
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD22E8	0_2_00007FF65DAD22E8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE02A8	0_2_00007FF65DAE02A8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAD81D0	0_2_00007FF65DAD81D0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADA140	0_2_00007FF65DADA140
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAEA448	0_2_00007FF65DAEA448
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE23EC	0_2_00007FF65DAE23EC
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE7358	0_2_00007FF65DAE7358

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: String function: 00007FF65DAB51F0 appears 69 times
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: String function: 000002B45AFCB930 appears 32 times
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: String function: 000002B45AFE5330 appears 70 times
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: String function: 000002B45AFD4C00 appears 41 times

Source: classification engine

Classification label: mal92.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B025970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		0_2_000002B45B025970
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B072008 AdjustTokenPrivileges,CredEnumerateA,		0_2_000002B45B072008

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45AFDC8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000002B45AFDC8C0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B00F19A CoCreateInstance,

0_2_000002B45B00F19A

Source: C:\Users\user\Desktop\apilibx64.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69633E538B19

Source: apilibx64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\apilibx64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: apilibx64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: apilibx64.exe

Static file information: File size 3341824 > 1048576

Source: apilibx64.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x2bd800

Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: apilibx64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: apilibx64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: apilibx64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: apilibx64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: apilibx64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: apilibx64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: apilibx64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: apilibx64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45AFDB820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002B45AFDB820

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B01E874 push rbx; iretd	0_2_000002B45B01E875
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B01E89C push rbx; iretd	0_2_000002B45B01E89D
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADDB93 push rcx; iretd	0_2_00007FF65DADDB94
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADDB8C push rdi; ret	0_2_00007FF65DADDB90
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADD8A1 push rdi; ret	0_2_00007FF65DADD8A5
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DADD2C0 push rcx; iretd	0_2_00007FF65DADD2C1

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B016480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_000002B45B016480

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B059810 FindClose,FindFirstFileExW,GetLastError,		0_2_000002B45B059810
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0598C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_000002B45B0598C0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B0213B0 GetLogicalDriveStringsW,

0_2_000002B45B0213B0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B037348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_000002B45B037348

Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: apilibx64.exe, 00000000.00000002.1887143065.000002B459484000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.manor.infW\|Vj
Source: apilibx64.exe, 00000000.00000003.1703039193.000002B4594A1000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000002.1887143065.000002B459484000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\apilibx64.exe	API call chain: ExitProcess graph end node			graph_0-94417
Source: C:\Users\user\Desktop\apilibx64.exe	API call chain: ExitProcess graph end node			graph_0-94422

Source: C:\Users\user\Desktop\apilibx64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B0243F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_000002B45B0243F0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B05BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000002B45B05BB14

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B05BB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_000002B45B05BB14

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45AFDB820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000002B45AFDB820

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B047F00 GetProcessHeap,

0_2_000002B45B047F00

Source: C:\Users\user\Desktop\apilibx64.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B02F920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000002B45B02F920
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_000002B45B0722D8 SetUnhandledExceptionFilter,	0_2_000002B45B0722D8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAE1E68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF65DAE1E68
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: 0_2_00007FF65DAF5AC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF65DAF5AC0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B0151E0 ShellExecuteW,

0_2_000002B45B0151E0

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_00007FF65DAE9AA0 cpuid

0_2_00007FF65DAE9AA0

Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000002B45B047778
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_000002B45B047828
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_000002B45B047620
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_000002B45B059480
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_000002B45B04795C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_000002B45B046F14
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_000002B45B03BC68
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_000002B45B047340
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_000002B45B072398
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_000002B45B0473D8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_000002B45B047270
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_000002B45B03C1A8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF65DAE8E4C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF65DAECE44
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF65DAED6A8
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_00007FF65DAED550
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF65DAED88C
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_00007FF65DAED758
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF65DAED308
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF65DAED270
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: GetLocaleInfoW,	0_2_00007FF65DAE91E0
Source: C:\Users\user\Desktop\apilibx64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF65DAED1A0

Source: C:\Users\user\Desktop\apilibx64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B036718 GetSystemTimeAsFileTime,

0_2_000002B45B036718

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B020110 GetUserNameW,

0_2_000002B45B020110

Source: C:\Users\user\Desktop\apilibx64.exe

Code function: 0_2_000002B45B021660 GetTimeZoneInformation,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,

0_2_000002B45B021660

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: apilibx64.exe PID: 7152, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.apilibx64.exe.2b45afa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.apilibx64.exe.2b45afa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: apilibx64.exe PID: 7152, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\config8n=r
Source: apilibx64.exe, 00000000.00000003.1728287450.000002B45EB67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallets
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystoreofileser
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallets
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystoreofileser
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsata\*
Source: apilibx64.exe, 00000000.00000003.1711353095.000002B4594EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystoreofileser

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\apilibx64.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\apilibx64.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\apilibx64.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: apilibx64.exe PID: 7152, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.apilibx64.exe.2b45afa0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.apilibx64.exe.2b45afa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: apilibx64.exe PID: 7152, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://ns.microsoft.t/RegiU	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	apilibx64.exe, 00000000.00000003.1705880403.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B459525000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704940672.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703831234.000002B459525000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	apilibx64.exe, 00000000.00000003.1704800492.000002B45C0E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	apilibx64.exe, 00000000.00000003.1704800492.000002B45C0E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	apilibx64.exe, 00000000.00000003.1707305814.000002B45B2E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/RegiU	apilibx64.exe, 00000000.00000003.1702540903.000002B45BE11000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	apilibx64.exe, 00000000.00000003.1704271513.000002B45C073000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C09C000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C083000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704509749.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C0C2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/A%	apilibx64.exe, 00000000.00000003.1703039193.000002B4594A1000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000002.1887143065.000002B459484000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	apilibx64.exe, 00000000.00000003.1709121696.000002B45C8BC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2DC000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B280000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C0000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707697086.000002B45B1C8000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B2D4000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C0FF000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707840209.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707305814.000002B45B288000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1707570895.000002B45C107000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	apilibx64.exe, 00000000.00000003.1704271513.000002B45C073000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704601944.000002B45951F000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C09C000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C083000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704509749.000002B45AE88000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1704271513.000002B45C0C2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	apilibx64.exe, 00000000.00000003.1886809285.000002B45BE24000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1886758525.000002B45BE20000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1886727297.000002B45BE20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	apilibx64.exe, 00000000.00000003.1704004636.000002B4594BE000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1703912498.000002B45AE6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	apilibx64.exe, 00000000.00000003.1711353095.000002B4594BD000.00000004.00000020.00020000.00000000.sdmp, apilibx64.exe, 00000000.00000003.1711298182.000002B45AEBD000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570005
Start date and time:	2024-12-06 14:08:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	apilibx64.exe
Detection:	MAL
Classification:	mal92.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 102 Number of non-executed functions: 140
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: apilibx64.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
45.130.145.152	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	104.26.12.205
	Simple1.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Simple1.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Simple2.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Simple2.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Software.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.130.33
	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse	104.21.112.1
	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.204.246
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	104.26.12.205
ASBAXETNRU	venomderek.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	212.196.108.28
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	ppc.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	hmips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	unique.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	siveria.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	1732748284fd56a2da13edf4ae4b865c44fa6834581d27eb2edbfe3fc50ef131cb95db5639506.dat-decoded.exe	Get hash	malicious	Remcos	Browse	45.135.232.38
	mips.elf	Get hash	malicious	Unknown	Browse	212.192.15.158

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Setup.msi	Get hash	malicious	Unknown	Browse	104.26.12.205
	Document_PDF.vbs	Get hash	malicious	FormBook	Browse	104.26.12.205
	Pr9cqW75nY.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	G3vWD786PN.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	hTXtTJXdLt.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	fqufh5EOJr.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	NGVW0QXQSn.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	EU2Yvx0L9q.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	0XyV1vWJn6.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.217119721003012
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	apilibx64.exe
File size:	3'341'824 bytes
MD5:	bca7e8cada42a299c99380fd96e5104f
SHA1:	7d45496f1b23412425ec5c39ee5e0177a9269441
SHA256:	6e6656ae6250e35281bc76ad996849ad047f2013b633c00d49e2ff07e590a1c1
SHA512:	e62a2c0c26fecbbf550621c7410dd141a1ef549b01446a4d3d6d2f16a5e31ee696392cbb00b382a8c32358fb018fa04dc85ad78bf7e5725333dfd7e63269920f
SSDEEP:	24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWusIIiDCVQ9owotOgbZr37SIes:KfrmzI7OXBGuDIiHitOgpLS
TLSH:	04F5AD67EA9064F3D874C13488A3076BBA767481C37183875798672A5F52BE43F3AF84
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N..f...5...5...5.x.4...5.x.4...5.x.4V..5A..4...5A..4...5A..4...52\|.4$..52\|.4...5By.4...5A..4...5...5...5Ay.4...5AyH5...5Ay.4...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140055a30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67451F50 [Tue Nov 26 01:07:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	de1751741e7d5e07ce98493d3f0130fc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD5F91DE9BCh
dec eax
add esp, 28h
jmp 00007FD5F91DDD3Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FD5F91DDED2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FD5F91DDED5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FD5F91DDECDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007FD5F91DD906h
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001563Fh]
dec eax
mov ecx, ebx
call dword ptr [0001562Eh]
call dword ptr [000155B0h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00015624h]
dec eax
mov dword ptr [esp+00h], ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x327b9c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x332000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x32c000	0x57e4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x333000	0x1d38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x320ef0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x321100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x320db0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b000	0x330	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x692f0	0x69400	201d673c76ad9fae647f8cd6a278e333	False	0.4342200489904988	data	6.181155425260236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6b000	0x2bd696	0x2bd800	5f98071d1dca5045e2419fee0cd6b127	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x329000	0x2f1c	0x1600	8e0cf2168d43982c322bc34eed94de2b	False	0.18980823863636365	data	3.2059756111359152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x32c000	0x57e4	0x5800	4c0d14150dd6a4ac35b35408d7a8233d	False	0.47767223011363635	data	5.711183919097264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x332000	0x1e0	0x200	0c1ab865bc43ec75ebd479502575ccef	False	0.525390625	data	4.700456763479242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x333000	0x1d38	0x1e00	3d9cd06dc9d02c11c130514ad02ec0c5	False	0.6712239583333334	data	6.471011674882192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x332060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
ntdll.dll	RtlImageDirectoryEntryToData, RtlLeaveCriticalSection, RtlEnterCriticalSection, RtlCompareMemory, NtProtectVirtualMemory, RtlImageNtHeader, NtQueryVirtualMemory, RtlGetNtVersionNumbers
KERNEL32.dll	GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, FindNextFileW, FindFirstFileExW, FindClose, VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, CloseHandle, GetProcAddress, GetCurrentProcess, VirtualQuery, EnterCriticalSection, GetModuleFileNameW, LeaveCriticalSection, MultiByteToWideChar, ExitProcess, WideCharToMultiByte, GetLastError, DeleteCriticalSection, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, FreeEnvironmentStringsW, RaiseException, HeapReAlloc, HeapSize, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, EnumSystemLocalesW, GetCPInfo, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetModuleHandleExW, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, GetProcessHeap, SetStdHandle, ReadConsoleW, FlushFileBuffers, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetUserDefaultLCID, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx
USER32.dll	LoadAcceleratorsA, LoadAcceleratorsW
ADVAPI32.dll	GetTokenInformation, OpenProcessToken

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T14:09:05.357434+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.357434+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.357434+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.477481+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-12-06T14:09:05.477481+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 14:09:00.314306974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:00.434163094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:00.435638905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:00.642592907 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:00.642627954 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:00.642699957 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:00.651736021 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:00.651748896 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:01.915719032 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:01.915868998 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.170137882 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.170167923 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:02.170536995 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:02.170598030 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.171569109 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.215339899 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:02.502363920 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:02.502427101 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:02.502433062 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.502474070 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.502732038 CET	49731	443	192.168.2.4	104.26.12.205
Dec 6, 2024 14:09:02.502748013 CET	443	49731	104.26.12.205	192.168.2.4
Dec 6, 2024 14:09:05.357434034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.477385044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477401972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477411985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477421999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477437019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477480888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.477494955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477576971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.477626085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477679014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.477719069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477874041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477922916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.477925062 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.481647968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.597353935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597364902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597409964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597424030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597498894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597553968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.597575903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.597630024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.606712103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.609822035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.717745066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.717818975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.717962980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.718051910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.718077898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.718106031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.718142986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.718168974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.718173027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.718203068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.718228102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.718256950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.729700089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.729841948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.729909897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730007887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730148077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730214119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730288982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730375051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730385065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730429888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730460882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730503082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730511904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730565071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730602026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730631113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730654001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730690002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730752945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730801105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730839968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730849981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730870008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.730895996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.730947018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.837703943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.837721109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.837802887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.837948084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.837996960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838059902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838064909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838125944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838135958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838164091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838207006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838228941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838248014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838284016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838293076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838301897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838331938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838331938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838392973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838406086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838433981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838485956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838499069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838506937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838551998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838567972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838620901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838635921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838645935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838660955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838685036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838706017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838715076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838792086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838800907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838869095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.838893890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838901997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.838956118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.849839926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.849904060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.849982977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850027084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850044966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850101948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850150108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850172043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850241899 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850356102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850366116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850403070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850415945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850445032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850459099 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850488901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850512028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850522041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850574017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850611925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850629091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850688934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850709915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850748062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850815058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850832939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850845098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850867987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850877047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850894928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850928068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.850941896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850958109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.850995064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851030111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851062059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851073027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851083040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851129055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851151943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851193905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851202011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851202965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851248026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851295948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851305962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851353884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851433039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851442099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851450920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851461887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851480007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851491928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851495028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851516008 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851545095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.851571083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851581097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851600885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.851643085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.957626104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957644939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957696915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957734108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957743883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957772017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.957832098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.957927942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957937956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.957971096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958008051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958009958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958044052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958064079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958070993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958074093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958131075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958132982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958153009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958184958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958203077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958309889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958318949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958359957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958368063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958419085 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958439112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958452940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958484888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958493948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958501101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958501101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958540916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958549976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958555937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958591938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958595037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958617926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958648920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958678961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958739996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958750010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958755016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958765030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958767891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958784103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.958807945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.958833933 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.959219933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959228992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959233046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959237099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959244967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959254026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959261894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959270954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959279060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959292889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959300995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959301949 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.959309101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959322929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959333897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959342003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.959343910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959356070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959364891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.959368944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.959412098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.969723940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.969742060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.969784975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.969801903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.969818115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.969888926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.969975948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.969985962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970016003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970041037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970071077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970072985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970101118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970109940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970119953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970163107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970195055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970204115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970222950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970247984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970257044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970283031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970288992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970307112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970340967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970341921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970351934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970396996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970427990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970438004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970463991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970475912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970484972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970519066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970540047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970551968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970572948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970609903 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970629930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970633984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970657110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970679045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970706940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970797062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970805883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970837116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970845938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970856905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970895052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.970922947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970942974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970968008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.970977068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971014023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971018076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971029043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971055031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971064091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971076012 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971121073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971155882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971165895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971216917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971223116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971225977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971257925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971271038 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971277952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971307039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971337080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971338034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971364021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971390963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971395016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971443892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971446037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971456051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971513987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971576929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971585989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971594095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971599102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971615076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971657991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971667051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971674919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971724987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971770048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971779108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971793890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971802950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971846104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971890926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971899986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971909046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971935987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.971949100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971962929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.971983910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972002029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972069025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972125053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972126961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972137928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972198009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972210884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972219944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972238064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972259045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972266912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972286940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972306013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972332001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972341061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972388029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972404957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972414017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972465038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972480059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972487926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972542048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972548008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972558975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:05.972594023 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:05.972628117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.077691078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077714920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077756882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077805996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077907085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077917099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077919006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.077964067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.077965021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.077977896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078044891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078066111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078075886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078115940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078136921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078164101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078196049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078229904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078258991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078268051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078278065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078315020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078315973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078332901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078375101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078380108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078389883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078437090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078444004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078454971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078478098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078496933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078520060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078546047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078571081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078597069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078617096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078628063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078644037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078658104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078671932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078702927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078758001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078763962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078773975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078799963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078840971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078856945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078866959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078911066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078919888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078919888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.078953028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078963041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.078973055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079011917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079055071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079118967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079128027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079135895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079186916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079205990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079225063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079235077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079251051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079258919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079283953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079301119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079334974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079386950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079449892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079524040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079535007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079544067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079552889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079560995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079570055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079585075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079595089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079603910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079612970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079618931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079636097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079637051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079672098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079689980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079690933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079700947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079755068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079785109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079818010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079873085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079880953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079881907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079890966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.079952002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.079967976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080014944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080024004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080091953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080136061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080144882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080148935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080188990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080214024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080243111 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080251932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080255032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080272913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080286980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080319881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080348015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080404043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080415964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080465078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080466986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080477953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080482960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080497026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080533028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080559969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080573082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080581903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080625057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080629110 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080670118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080701113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080727100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080734015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080741882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080785036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080794096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080804110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080857038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.080915928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080924988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080929041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.080988884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.081027985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.081037045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.081039906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.081047058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.081057072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.081091881 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.081110001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.089879036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089888096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089890957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089895010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089904070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089912891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.089977026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.089994907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090007067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090007067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090015888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090024948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090034962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090049982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090061903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090086937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090090990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090115070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090142012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090147972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090151072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090199947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090203047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090209961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090261936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090262890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090315104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090325117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090369940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090406895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090416908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090462923 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090465069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090496063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090524912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090550900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090558052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090583086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090603113 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090626001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090642929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090651989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090673923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090682030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090713024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090734005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090740919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090783119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090791941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090799093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090801001 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090837955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090852022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.090938091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090948105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090951920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.090955019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091016054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091165066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091175079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091182947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091191053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091200113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091208935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091228962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091269016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091285944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091295004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091301918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091316938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091327906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091335058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091342926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091345072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091367960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091382027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091396093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091424942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091562033 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091572046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091574907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091582060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091589928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091638088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091645956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091650963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091653109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091665030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091675043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091701031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091733932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091736078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091743946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091753006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091762066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091793060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091813087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091821909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091821909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091830015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091876030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091897011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.091945887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091954947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091959000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.091991901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092000008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092008114 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092022896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092047930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092052937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092066050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092080116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092096090 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092120886 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092129946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092139006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092196941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092216969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092226028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092273951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092288017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092298031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092349052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092354059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092363119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092371941 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092427015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092458010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092468023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092521906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092571020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092581034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092588902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092597008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092638016 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092659950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092672110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092681885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092689991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092698097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092729092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092752934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092781067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092791080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092797995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092807055 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092837095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092869997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.092904091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092914104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092921019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092928886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092937946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.092979908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093014956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093024969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093029022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093033075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093048096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093056917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093095064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093120098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093161106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093194008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093225002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093228102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093238115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093247890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093278885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093285084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093288898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093302965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093318939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093343973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093368053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093380928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093389988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093425035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093432903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093447924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093478918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093478918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093496084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093534946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093544006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093549967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093599081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093684912 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093693972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093700886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093709946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093749046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093754053 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093764067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093765020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093774080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093782902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093846083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093868017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093877077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093924046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.093950987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.093961000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094011068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094050884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094060898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094082117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094089985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094115973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094137907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094150066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094158888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094197989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094207048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094208956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094254017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094268084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094289064 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094316006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094335079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094409943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094419956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094465971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094470978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094475031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094523907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094623089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094631910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094639063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094646931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.094682932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.094703913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.197685957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197704077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197753906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197796106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.197845936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.197853088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197873116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197911978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.197941065 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.197953939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.197963953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198029995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198061943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198102951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198128939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198156118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198164940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198215961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198220968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198280096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198282957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198337078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198400974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198456049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198465109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198512077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198530912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198574066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198651075 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198668003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198709011 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198724985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198729992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198786020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198786974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198849916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198863983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198926926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.198956966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.198966980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199021101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199038982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199093103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199120045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199150085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199187040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199214935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199249983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199306965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199307919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199346066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199369907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199418068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199441910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199506044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199506998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199573994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199599981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199655056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199665070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199724913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199795961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199805021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199877024 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.199949980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.199959993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200000048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200020075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200051069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200056076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200110912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200124979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200184107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200326920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200383902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200407982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200459003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200465918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200527906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200572014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200628042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200628996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200690985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200702906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200711966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200767040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200799942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200855017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200879097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200936079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.200936079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.200953960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201010942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201091051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201143980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201149940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201262951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201270103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201287031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201334953 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201375961 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201431036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201432943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201491117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201544046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201600075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201631069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201687098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201689005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201725960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201745987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201782942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201785088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201829910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201842070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201889038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.201909065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.201961040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202054977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202070951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202114105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202152967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202184916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202208042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202250957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202280998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202320099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202337980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202372074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202383041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202434063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202447891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202476978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202500105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202542067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202579975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202589989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202645063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202661037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202686071 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202714920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202737093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202756882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202792883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202816010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202850103 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202883005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202934980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202938080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.202975035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.202991009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203010082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203032017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203072071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203084946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203144073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203149080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203217983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203233957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203280926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203283072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203290939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203351021 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203373909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203408003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203429937 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203464031 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203474998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203526974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203552008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203613043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203632116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203641891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203700066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203708887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203783989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203799963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203859091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203881979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203898907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203941107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203942060 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.203978062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.203996897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.204031944 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.209832907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.209917068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210160971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210211992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210217953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210274935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210418940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210475922 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210488081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210536957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210561991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210572004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210643053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210702896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210743904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210777998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210824013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210824966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210881948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210886955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.210953951 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.210988045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211040974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211097002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211168051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211186886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211236954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211294889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211338997 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211353064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211390018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211419106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211441040 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211471081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211491108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211503029 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211529970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211564064 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211590052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211632013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211641073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211699009 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211704016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211756945 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211786985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211803913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211843967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211857080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211906910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.211909056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.211976051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212043047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212052107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212116003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212249994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212259054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212321997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212423086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212481022 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212557077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212564945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212616920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212618113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212641001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212676048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212685108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212707996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212732077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212771893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212781906 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212826967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212862015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212869883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212918997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.212948084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.212997913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213000059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213027954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213051081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213072062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213089943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213115931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213126898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213166952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213185072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213217020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213244915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213304043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213346004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213356972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213363886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213404894 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213428974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213434935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213485003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213531017 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213540077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213547945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213587999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213599920 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213607073 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213615894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213624954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213664055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213679075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213685036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213742018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213815928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213830948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213840008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213859081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.213876963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213895082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213921070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.213953018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214004993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214009047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214060068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214185953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214195013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214198112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214207888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214257002 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214286089 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214302063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214335918 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214359999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214458942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214468956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214513063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214514971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214524984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214544058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214553118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214576006 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214605093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214615107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214684010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214684963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214694977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214721918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214739084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214776993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214782953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214793921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214837074 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214875937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214884996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214941025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.214972973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.214982986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215033054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215054989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215065002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215114117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215116978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215126991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215188026 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215229034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215238094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215275049 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215301991 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215318918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215328932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215363979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215368986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215374947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215419054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215456963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215466022 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215470076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215476990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215519905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215605974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215615988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215620041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215627909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215636969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215673923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215675116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215699911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215724945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215738058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215753078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215785027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215786934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215822935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215843916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215868950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215871096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215890884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215924025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215941906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.215950012 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215970039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.215998888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216015100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216064930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216115952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216151953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216162920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216166019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216176987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216185093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216217995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216223955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216262102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216273069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216320038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216340065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216348886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216396093 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216423988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216433048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216486931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216495037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216504097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216528893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216536999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216552019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216578007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216587067 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216589928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216633081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216682911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216691971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216728926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216737986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216738939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216792107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216804028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216813087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216845036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216851950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216857910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216892958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216897964 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216933966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.216942072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.216991901 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217048883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217057943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217082977 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217092991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217113018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217149019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217176914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217192888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217226982 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217243910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217256069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217264891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217308998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217346907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217355967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217387915 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217407942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217437029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217484951 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217494965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217534065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217542887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217542887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217554092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217591047 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217619896 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217628002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217638969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217672110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217674017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217708111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217721939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217734098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217767954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217782021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217787981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217819929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217834949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217837095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217881918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217889071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217936993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.217951059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.217966080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218000889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218015909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218034983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218060970 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218087912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218105078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218131065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218139887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218143940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218152046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218195915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218277931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218293905 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218307972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218317986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218338966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218365908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218394995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218405008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218449116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218452930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218458891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218499899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218504906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218535900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218559980 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218585014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218589067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218605042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218642950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218656063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218664885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218713045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218713999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218723059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218770027 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218849897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218859911 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218905926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.218928099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218938112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.218986988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219012976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219022989 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219041109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219069958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219098091 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219144106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219153881 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219156981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219206095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219285965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219295025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219321966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219340086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219346046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219377041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219388962 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219461918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219471931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219520092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219521999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219532013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219574928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219578028 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219584942 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219620943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219629049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219680071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219708920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219717979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219752073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219767094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219791889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219801903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219813108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219851017 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219876051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219886065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219893932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219897985 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219952106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.219965935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.219969034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220011950 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220056057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220065117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220098019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220107079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220117092 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220158100 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220194101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220202923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220254898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220257998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220268011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220300913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220309019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220319033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220339060 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220355034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220366955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220387936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220407009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220415115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220474005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220484972 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220541954 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220571995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220587969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220594883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220603943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220640898 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220660925 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220691919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220700979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220705032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220711946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220715046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220765114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220810890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220819950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220829010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220837116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.220861912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.220885992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.317718983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.317754030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.317801952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.317843914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.317869902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.317890882 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.317922115 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318011999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318044901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318058968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318088055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318260908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318314075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318321943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318370104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318430901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318479061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318480015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318523884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.318816900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318831921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.318880081 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319070101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319117069 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319117069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319169998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319169998 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319202900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319220066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319256067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319354057 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319363117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319407940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319433928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319478989 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319506884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319557905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319618940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319673061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319725990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319777966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319834948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319884062 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.319885969 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.319930077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.320053101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.320067883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.320116997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.320699930 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.320749044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.320760965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.320811033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.321244001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.321300030 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.321315050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.321362972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.321846008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.321896076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.321929932 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.321979046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.322443008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.322489977 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.322520971 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.322582960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.322833061 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.322841883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.322887897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323198080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323250055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323256016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323317051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323519945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323574066 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323620081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323668957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323863983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323915958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.323921919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.323971987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324105978 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324151039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324153900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324202061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324352980 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324392080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324403048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324446917 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324618101 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324665070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324724913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324733973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324779034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324860096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324875116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324902058 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.324908972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324933052 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.324955940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325130939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325139999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325186014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325227976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325253010 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325278997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325294971 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325445890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325480938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325495958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325531960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325691938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325700998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325747013 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.325906992 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325917006 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.325963020 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326070070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326077938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326124907 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326252937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326303005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326318979 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326374054 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326543093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326581001 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326592922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326631069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326839924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326857090 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.326889992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326906919 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.326997995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327008009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327058077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327198982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327208042 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327254057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327444077 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327487946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327495098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327543974 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327677011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327694893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327725887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327743053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.327846050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327853918 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.327923059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328011990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328044891 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328061104 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328102112 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328208923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328373909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328419924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328432083 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328493118 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328537941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328717947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328727007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328772068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.328967094 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.328975916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329025984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.329086065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329135895 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329178095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.329298019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329308987 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329351902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.329540968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329552889 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329598904 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.329761982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.329974890 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330028057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.330161095 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330318928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330368996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.330581903 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330679893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330729961 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.330919981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330929041 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.330972910 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.331335068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331372976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331428051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.331545115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331593990 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331643105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.331855059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331864119 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.331909895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.332253933 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.333100080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.333158970 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.333841085 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.333857059 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.333914042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.334208965 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.334225893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.334284067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.334657907 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.334672928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.334764004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.335073948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.335133076 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.335190058 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.335585117 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.335669994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.335731983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.336035013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336049080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336101055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.336261988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336340904 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336393118 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.336560011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336594105 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336647987 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.336879969 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336889982 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.336972952 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.337074995 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337162018 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337297916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.337424994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337528944 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337584019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.337755919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337793112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.337810040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.337843895 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338063002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338112116 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338140965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338157892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338382959 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338433981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338450909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338668108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338675976 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338732004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338872910 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.338920116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.338937998 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339109898 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339126110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339162111 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.339181900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.339382887 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339428902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339485884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.339632988 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339648962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339698076 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.339839935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339931011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.339983940 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.340205908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340214014 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340257883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.340394020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340403080 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340450048 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.340578079 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340589046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340645075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.340825081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340833902 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.340878963 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.341083050 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341092110 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341136932 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.341165066 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341206074 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341253996 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.341356993 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341373920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341428995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.341569901 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341579914 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.341623068 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.342222929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342294931 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342353106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.342540026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342556953 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342617035 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.342686892 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342717886 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342775106 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.342931986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342941046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.342988014 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343117952 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343131065 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343175888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343287945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343297005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343343973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343446016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343456030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343504906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343590975 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343599081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343645096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343826056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343833923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.343879938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.343986034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344002008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344037056 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344065905 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344177008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344186068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344237089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344362974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344372034 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344436884 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344513893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344543934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344602108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344703913 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344712973 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344779015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.344945908 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.344954967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345000029 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.345148087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345297098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345351934 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.345380068 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345396996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345443010 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.345750093 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345788956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.345838070 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.345994949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346065044 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346108913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.346201897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346210957 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346261978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.346501112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346515894 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346561909 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.346698999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346709013 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.346751928 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.348042011 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348081112 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348150015 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.348503113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348512888 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348562956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.348721981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348838091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.348886967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.349067926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349076986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349113941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.349252939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349364996 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349426031 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.349464893 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349488020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349539042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.349636078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.349695921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.349857092 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350003958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350061893 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.350131035 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350302935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350361109 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.350467920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350661039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.350724936 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.350953102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351224899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351286888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.351324081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351389885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351449966 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.351552963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351703882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.351759911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.351836920 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352044106 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352114916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.352199078 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352353096 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352411985 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.352479935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352689028 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352750063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.352833986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.352963924 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353018045 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.353133917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353271008 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353327036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.353434086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353596926 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.353632927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353816032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.353873968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.353971004 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354140043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354201078 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.354341984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354549885 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354605913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.354695082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354902983 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.354969978 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.355052948 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.355185032 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.355240107 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.355319023 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.355658054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.355720997 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.355896950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.355979919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.356038094 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.356101036 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.356349945 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.356405973 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.356617928 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.356730938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.356781960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.356981039 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.357178926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.357223988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.357403994 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.357588053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.357604027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.357707024 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.357760906 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.357824087 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358011007 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358064890 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.358161926 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358366966 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358439922 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.358536005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358814955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.358875990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.359067917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.359241009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.359291077 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.359468937 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.359529018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.359627962 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.359718084 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.359754086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.359956026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.360008955 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.360109091 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.360275984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.360327005 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.360461950 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.360702991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.360750914 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.360951900 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.361213923 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.361263990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.361474991 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.361534119 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.361684084 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.361737967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.362010956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.362062931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.362278938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.362328053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.362514019 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.362566948 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.362803936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.362854004 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.363032103 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.363085032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.363212109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.363262892 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.363440037 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.363490105 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.363712072 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.363759041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.363872051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.363920927 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.364125967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.364172935 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.364326000 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.364378929 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.364511967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.364571095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.364707947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.364757061 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.364877939 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.364927053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.365118027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.365168095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.365386963 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.365437984 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.365566015 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.365617037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.365807056 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.365859032 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366070986 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366131067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366291046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366341114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366414070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366470098 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366563082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366615057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366774082 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366821051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.366935968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.366986990 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.367182016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.367229939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.367430925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.367485046 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.367633104 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.367683887 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.367778063 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.367826939 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.367929935 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.367980957 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368076086 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368123055 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368387938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368436098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368458033 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368479967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368688107 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368746042 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368815899 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368865967 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.368948936 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.368999958 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.369195938 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.369246960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.373214960 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.373267889 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.373737097 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.373801947 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.374255896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.374316931 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.374869108 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.374918938 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.375303984 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.375375986 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.375679016 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.375852108 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.375973940 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.376025915 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.376434088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.376526117 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.376595020 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.376833916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.377012968 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.377054930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.377075911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.377192974 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.377239943 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.377320051 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.377538919 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.377585888 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.377787113 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378009081 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378057003 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.378225088 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378391981 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378443956 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.378617048 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378684044 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.378835917 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.378972054 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.379021883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.379159927 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.379417896 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.379463911 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.379657030 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.379971027 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.380026102 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.380121946 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.380358934 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.380408049 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.380637884 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.381181002 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.381230116 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.381372929 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.381633043 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.381690025 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.384902954 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.385678053 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.387238026 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.387725115 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.387773037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.388142109 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.388195038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.389704943 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.389714003 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.389816999 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.389854908 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.389918089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.389939070 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.389991999 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.390079021 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.390256882 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.390309095 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.390487909 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.390661955 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.390721083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.390831947 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.390974045 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391035080 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.391110897 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391275883 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391324043 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.391552925 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391675949 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391727924 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.391818047 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391932964 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.391990900 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.392071009 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392204046 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392251968 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.392458916 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392601967 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392652988 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.392735958 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392805099 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.392857075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.392857075 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.437361956 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.437805891 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.437905073 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.437975883 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.438040018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.438055992 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.465987921 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.470218897 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470309019 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470356941 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470427036 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470484972 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470535994 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470583916 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470638037 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470699072 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470767975 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470812082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470870018 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470921993 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.470976114 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471019983 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471076965 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471132040 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471219063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471271038 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471338034 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.471375942 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.509977102 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.510173082 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.557305098 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.557560921 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.557694912 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.557774067 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.557856083 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.557923079 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558003902 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558078051 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558176041 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558247089 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558326960 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.558377981 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590137005 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.590485096 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590629101 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590702057 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590774059 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590853930 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.590923071 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.591005087 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.591093063 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.591157913 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.591217995 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.618628025 CET	15666	49730	45.130.145.152	192.168.2.4
Dec 6, 2024 14:09:06.618941069 CET	49730	15666	192.168.2.4	45.130.145.152
Dec 6, 2024 14:09:06.619072914 CET	49730	15666	192.168.2.4	45.130.145.152

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 14:09:00.491707087 CET	192.168.2.4	1.1.1.1	0x6b97	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 14:09:00.634769917 CET	1.1.1.1	192.168.2.4	0x6b97	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 14:09:00.634769917 CET	1.1.1.1	192.168.2.4	0x6b97	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 14:09:00.634769917 CET	1.1.1.1	192.168.2.4	0x6b97	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.12.205	443	7152	C:\Users\user\Desktop\apilibx64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 13:09:02 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-06 13:09:02 UTC	426	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 13:09:02 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edc821199370f6d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=14419&min_rtt=1651&rtt_var=8323&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1768625&cwnd=252&unsent_bytes=0&cid=2647e8bca21e1866&ts=604&x=0"
2024-12-06 13:09:02 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	08:08:59
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\apilibx64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\apilibx64.exe"
Imagebase:	0x7ff65daa0000
File size:	3'341'824 bytes
MD5 hash:	BCA7E8CADA42A299C99380FD96E5104F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1887309159.000002B45ADE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	89.7%
Signature Coverage:	17.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	110

Executed Functions

Function 000002B45B01FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000002B45B01FB71
GetSystemMetrics.USER32 ref: 000002B45B01FB7F
GetSystemMetrics.USER32 ref: 000002B45B01FB8D
GetSystemMetrics.USER32 ref: 000002B45B01FB9B
GetDC.USER32 ref: 000002B45B01FBA5
GetDeviceCaps.GDI32 ref: 000002B45B01FBBB
GetDeviceCaps.GDI32 ref: 000002B45B01FBCB
CreateCompatibleDC.GDI32 ref: 000002B45B01FBD8
CreateCompatibleBitmap.GDI32 ref: 000002B45B01FBF0
SelectObject.GDI32 ref: 000002B45B01FC06
BitBlt.GDI32 ref: 000002B45B01FC3C
SHCreateMemStream.SHLWAPI ref: 000002B45B01FC72
SelectObject.GDI32 ref: 000002B45B01FC88
DeleteDC.GDI32 ref: 000002B45B01FC91
ReleaseDC.USER32 ref: 000002B45B01FC9C
DeleteObject.GDI32 ref: 000002B45B01FCA5
EnterCriticalSection.KERNEL32 ref: 000002B45B01FD9C
LeaveCriticalSection.KERNEL32 ref: 000002B45B01FDAE
IStream_Size.SHLWAPI ref: 000002B45B01FDE5
IStream_Reset.SHLWAPI ref: 000002B45B01FDF6
IStream_Read.SHLWAPI ref: 000002B45B01FE7B
SelectObject.GDI32 ref: 000002B45B01FED5
DeleteDC.GDI32 ref: 000002B45B01FEDE
ReleaseDC.USER32 ref: 000002B45B01FEEB
DeleteObject.GDI32 ref: 000002B45B01FEF4

Strings

, xrefs: 000002B45B01FC11

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction ID: e84091af3fdde68629ad955de16c150382d7531b281a71d6a09d306c20e67dc2
Opcode Fuzzy Hash: e8e9b911cd9b9f557c011d0a693391b94df579aa06795856880fde4b09ecdcd5
Instruction Fuzzy Hash: 88B110B2214FC086E774EF21E89839AB7A5F799B80F808515DE8943B5ADF7CC185CB50

Function 000002B45B0598C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 000002B45B05996D
GetLastError.KERNEL32 ref: 000002B45B059977
FindFirstFileW.KERNEL32 ref: 000002B45B05998E
GetLastError.KERNEL32 ref: 000002B45B05999A
FindClose.KERNEL32 ref: 000002B45B0599A8
__std_fs_open_handle.LIBCPMT ref: 000002B45B059A3B
CloseHandle.KERNEL32 ref: 000002B45B059A51
CloseHandle.KERNEL32 ref: 000002B45B059BC4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: 286ac6364bfc674fed1b48c137ada84eb3b6c5d184a2fca05a0254d6ebca53dc
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 449171B1310E4147FE74AF25A4C87697391E7A6FB0F948710DAB647AE6DB38C841CB60

Function 000002B45B021660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000002B45B021990

Strings

computer_name, xrefs: 000002B45B022954
time, xrefs: 000002B45B023041
timezone, xrefs: 000002B45B023414
[UTC, xrefs: 000002B45B021963
ram, xrefs: 000002B45B02285B
gpu, xrefs: 000002B45B022522
cpu, xrefs: 000002B45B022618
user_name, xrefs: 000002B45B02242F
system, xrefs: 000002B45B0223E4, 000002B45B0224D3, 000002B45B0225C9, 000002B45B0226C3, 000002B45B02280B, 000002B45B022905, 000002B45B0229F8, 000002B45B022B7F, 000002B45B022D70, 000002B45B022FF1, 000002B45B0231B4, 000002B45B0233CE, 000002B45B02356D, 000002B45B023717, 000002B45B0237DD
%d-%m-%Y, %H:%M:%S, xrefs: 000002B45B022F5F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: 0dd1e5c6ffcfe042f98f50cea33d590f3970540244b4691ecc6062fd750dda19
Instruction ID: e3bf78f859f38f283e9e466c80b525f7e12182f904f25c02374f21c8b3390e7f
Opcode Fuzzy Hash: 0dd1e5c6ffcfe042f98f50cea33d590f3970540244b4691ecc6062fd750dda19
Instruction Fuzzy Hash: F5238F73614FC08ADB21DF64D8843DD77A1F7A9B98F905216EA9D07B9ADB78C284C700

Function 000002B45B021FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B020C30: GetCurrentHwProfileW.ADVAPI32 ref: 000002B45B020C6C

Part of subcall function 000002B45B020500: EnumDisplayDevicesW.USER32 ref: 000002B45B020617
Part of subcall function 000002B45B020500: EnumDisplayDevicesW.USER32 ref: 000002B45B0206BB

Part of subcall function 000002B45B020420: RegGetValueA.ADVAPI32 ref: 000002B45B020489

Part of subcall function 000002B45B020110: GetUserNameW.ADVAPI32 ref: 000002B45B020155

Part of subcall function 000002B45B0201B0: GetComputerNameW.KERNEL32 ref: 000002B45B0201F5

GlobalMemoryStatusEx.KERNEL32 ref: 000002B45B02277C
wcsftime.LIBCMT ref: 000002B45B022F72
GetModuleFileNameA.KERNEL32 ref: 000002B45B023106

Strings

computer_name, xrefs: 000002B45B022954
time, xrefs: 000002B45B023041
timezone, xrefs: 000002B45B023414
ram, xrefs: 000002B45B02285B
gpu, xrefs: 000002B45B022522
cpu, xrefs: 000002B45B022618
user_name, xrefs: 000002B45B02242F
system, xrefs: 000002B45B0223E4, 000002B45B0224D3, 000002B45B0225C9, 000002B45B0226C3, 000002B45B02280B, 000002B45B022905, 000002B45B0229F8, 000002B45B022B7F, 000002B45B022D70, 000002B45B022FF1, 000002B45B0231B4, 000002B45B0233CE, 000002B45B02356D, 000002B45B023717, 000002B45B0237DD
%d-%m-%Y, %H:%M:%S, xrefs: 000002B45B022F5F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: 0edf946aa031858e22f84dec9932a38a9ea07152ae512ed7bca355d0ac67b43f
Instruction ID: be911f56578260d5393e18eb992000ebd04bac022d131908221e6823fb892804
Opcode Fuzzy Hash: 0edf946aa031858e22f84dec9932a38a9ea07152ae512ed7bca355d0ac67b43f
Instruction Fuzzy Hash: 79F27073614FC08ADB21DF64D8943DD77A1F799B98F805216EA9D07BAADB78C284C700

Function 000002B45AFDB820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000002B45AFDB90C
GetProcAddress.KERNEL32 ref: 000002B45AFDBA17
GetProcAddress.KERNEL32 ref: 000002B45AFDBAD9
GetProcAddress.KERNEL32 ref: 000002B45AFDBB53
GetProcAddress.KERNEL32 ref: 000002B45AFDBBD5
GetProcAddress.KERNEL32 ref: 000002B45AFDBC4F
GetProcAddress.KERNEL32 ref: 000002B45AFDBCD3
FreeLibrary.KERNEL32 ref: 000002B45AFDC801

Strings

vault, xrefs: 000002B45AFDC663
system, xrefs: 000002B45AFDC60D
cannot use push_back() with , xrefs: 000002B45AFDC84F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 29bb64fe588729a6dd7e9a1a634112c6195bb6beec1e71e03033c135bde283d8
Instruction ID: 6a38a31696200aa61e89a15b6905b0b47f4cb47fcb494c609edbc939ab36ca42
Opcode Fuzzy Hash: 29bb64fe588729a6dd7e9a1a634112c6195bb6beec1e71e03033c135bde283d8
Instruction Fuzzy Hash: 9C923772205FC48ADB719F29E8883DD73A4F799798F504216DA9C5BB9AEF74C684C300

Function 000002B45B016480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002B45B019760: GetCurrentProcess.KERNEL32 ref: 000002B45B01979B
Part of subcall function 000002B45B019760: OpenProcessToken.ADVAPI32 ref: 000002B45B0197AE
Part of subcall function 000002B45B019760: GetTokenInformation.ADVAPI32 ref: 000002B45B0197EA

ExitProcess.KERNEL32 ref: 000002B45B0164C7
OpenMutexA.KERNEL32 ref: 000002B45B0165E2
ExitProcess.KERNEL32 ref: 000002B45B0165F2
CreateMutexA.KERNEL32 ref: 000002B45B016611
ExitProcess.KERNEL32 ref: 000002B45B016637

Part of subcall function 000002B45B019AA0: GetModuleFileNameW.KERNEL32 ref: 000002B45B019AEA

Part of subcall function 000002B45B024740: CoInitializeEx.OLE32 ref: 000002B45B0247AA

Strings

SeDebugPrivilege, xrefs: 000002B45B0164CE
SeImpersonatePrivilege, xrefs: 000002B45B0164DA

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 782d380b29ac7723b8536a50f4b201a6bd666a22727d19413264e9f9b1f80c53
Instruction ID: 408ab38d3be1ff52f76aec4ddbecae3baf3199d951d6de8d60718c734901e04a
Opcode Fuzzy Hash: 782d380b29ac7723b8536a50f4b201a6bd666a22727d19413264e9f9b1f80c53
Instruction Fuzzy Hash: 316192A2114E8083FA35BF64E8DD39EB350FBA5B94FD04515EA9D42BDBDF28C0458720

Function 000002B45B04114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000002B45B041191

Part of subcall function 000002B45B0407F8: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04080C

Part of subcall function 000002B45B03B550: HeapFree.KERNEL32 ref: 000002B45B03B566
Part of subcall function 000002B45B03B550: GetLastError.KERNEL32 ref: 000002B45B03B570

Part of subcall function 000002B45B049D94: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B049CDF

_get_daylight.LIBCMT ref: 000002B45B041180

Part of subcall function 000002B45B040858: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04086C

_get_daylight.LIBCMT ref: 000002B45B0413F6
_get_daylight.LIBCMT ref: 000002B45B041407
_get_daylight.LIBCMT ref: 000002B45B041418
GetTimeZoneInformation.KERNEL32 ref: 000002B45B04143F

Strings

Eastern Standard Time, xrefs: 000002B45B0414E5
Eastern Summer Time, xrefs: 000002B45B0414FD

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 7c59d7ccbe5d7300b5b7a10bdfa8df02b94e7a90d3a9da5a0b2f52bbfcd600ed
Instruction ID: 075b949041f6a59d36b195aaaaa63c54d672026e3a415e6d8e78d9cdce7f1341
Opcode Fuzzy Hash: 7c59d7ccbe5d7300b5b7a10bdfa8df02b94e7a90d3a9da5a0b2f52bbfcd600ed
Instruction Fuzzy Hash: 4ED1C2A6600A409BE730FF26D4D93A97B61F764F84FD48126EE4947AD7EB38C441C760

Function 000002B45B01F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000002B45B01F3CB
InternetOpenUrlA.WININET ref: 000002B45B01F4A8
HttpQueryInfoW.WININET ref: 000002B45B01F509
HttpQueryInfoW.WININET ref: 000002B45B01F5A2
InternetQueryDataAvailable.WININET ref: 000002B45B01F5E6
InternetReadFile.WININET ref: 000002B45B01F6A9
InternetQueryDataAvailable.WININET ref: 000002B45B01F774
InternetCloseHandle.WININET ref: 000002B45B01F81E
Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B01F87B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: 21f0a994e3c7b07007afd14c1e7407b7e66aed596d6a0d2b4b5656aaf2c13836
Instruction ID: 04f872313dd5fbd62ef0c4ce787075ba95e9d484dc217cb13c80fb762b99a0f6
Opcode Fuzzy Hash: 21f0a994e3c7b07007afd14c1e7407b7e66aed596d6a0d2b4b5656aaf2c13836
Instruction Fuzzy Hash: 89029E72A14F9486EB20DF69E88439E77B4F795B98F604215EE9C57B9ADF38C080C710

Function 000002B45B05E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002B45B05E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B05E58D
Part of subcall function 000002B45B05E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B05E60B
Part of subcall function 000002B45B05E54C: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B05E65C

CreateFileW.KERNEL32 ref: 000002B45B05EA6E
CreateFileW.KERNEL32 ref: 000002B45B05EABE
GetLastError.KERNEL32 ref: 000002B45B05EAEE
GetFileType.KERNEL32 ref: 000002B45B05EB03
GetLastError.KERNEL32 ref: 000002B45B05EB0D
CloseHandle.KERNEL32 ref: 000002B45B05EB40
CloseHandle.KERNEL32 ref: 000002B45B05ECA3
CreateFileW.KERNEL32 ref: 000002B45B05ECD8
GetLastError.KERNEL32 ref: 000002B45B05ECE7

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 6c60d7a50310d6954293a7337b09cd7d4299e4aa422918796cd7da5ef2f218d4
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: 32C1BEB2720E4086EB60EFA9C4D92AD3761F36AF98F415215DF5A5B7D6CB38C451C310

Function 000002B45B018F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000002B45B0191A1
SetFilePointer.KERNEL32 ref: 000002B45B019254
ReadFile.KERNEL32 ref: 000002B45B019283

Strings

exists, xrefs: 000002B45B01970A
ios_base::eofbit set, xrefs: 000002B45B0196C4
ios_base::badbit set, xrefs: 000002B45B0196B1, 000002B45B01972F
ios_base::failbit set, xrefs: 000002B45B0196BD

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 298d008676232b06471bdd186e2a9360a47126fbb1c4607c87d28e5657c7adae
Instruction ID: 509506ac6d78cd65d702d13b3eda7d0e623e0ca4a86b100fad8459f65c7ad0e4
Opcode Fuzzy Hash: 298d008676232b06471bdd186e2a9360a47126fbb1c4607c87d28e5657c7adae
Instruction Fuzzy Hash: DA320472614BC48AEB30DF24D8C83DD37A1F795B88F908226DA4D57BAAEB74C645C710

Function 000002B45B0413C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000002B45B0413F6

Part of subcall function 000002B45B040858: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04086C

_get_daylight.LIBCMT ref: 000002B45B041407

Part of subcall function 000002B45B0407F8: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04080C

_get_daylight.LIBCMT ref: 000002B45B041418

Part of subcall function 000002B45B040828: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04083C

Part of subcall function 000002B45B03B550: HeapFree.KERNEL32 ref: 000002B45B03B566
Part of subcall function 000002B45B03B550: GetLastError.KERNEL32 ref: 000002B45B03B570

GetTimeZoneInformation.KERNEL32 ref: 000002B45B04143F

Strings

Eastern Standard Time, xrefs: 000002B45B0414E5
Eastern Summer Time, xrefs: 000002B45B0414FD

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction ID: 31426c189b9ad7b5099870c2e9baa0efb638e309c45464eb4cbb59636922b5e0
Opcode Fuzzy Hash: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction Fuzzy Hash: C751A4B6600E419BE730FF21E8C979A7760F768F84FD48126EA4947BA7DB38C4418760

Function 000002B45B03749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B0374BE
_get_daylight.LIBCMT ref: 000002B45B03751E
_get_daylight.LIBCMT ref: 000002B45B03752F
_get_daylight.LIBCMT ref: 000002B45B037540
_isindst.LIBCMT ref: 000002B45B037591
_isindst.LIBCMT ref: 000002B45B0375E4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction ID: 80cc0c950ae1ff047c4422708fff70d5c2a02cd6fa6d60b662ca12397ce50fe2
Opcode Fuzzy Hash: 842d06e59cb7d0c874962108e89d6781c57040cb1ba9c53ec58eb2fa30030a5a
Instruction Fuzzy Hash: 69810CF27007458BEB689F34C9C97BC37A5E764F88F449125DA094B787EB38D5418750

Function 000002B45B028B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B028D24
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B028D32
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B028FB5
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B028FC3

Strings

value, xrefs: 000002B45B028C4A, 000002B45B028EE3

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: ce45c1bc253841957aeb455638705b5451abed70ec86fc96132d5cff3fd0d5d5
Instruction ID: 87b976447ac93aaa260d54f6c0aa1428a7bb52717ed0ddcfee7ad69c192fa37e
Opcode Fuzzy Hash: ce45c1bc253841957aeb455638705b5451abed70ec86fc96132d5cff3fd0d5d5
Instruction Fuzzy Hash: 070293A2614FC086EB20EF74D4C83AD7761E7A5BA4F905215FA9D02AEBDF78C185C310

Function 000002B45AFDC8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002B45AFDC90A
Process32FirstW.KERNEL32 ref: 000002B45AFDC94C
Process32NextW.KERNEL32 ref: 000002B45AFDCB43
CloseHandle.KERNEL32 ref: 000002B45AFDCDBA

Strings

[PID: , xrefs: 000002B45AFDC98E

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: e37ae5426cac92230d0c23acd66e156993648a257dd706c95ef8f7e99a7cf727
Instruction ID: d97cbe260eef69965c3853bc0185187275cb1bdc974248e8819851b8615e25db
Opcode Fuzzy Hash: e37ae5426cac92230d0c23acd66e156993648a257dd706c95ef8f7e99a7cf727
Instruction Fuzzy Hash: 1EE17063614FC086EB31DF25E8C439D77A5F3997A8F904216EAA907B9ADF78C245C700

Function 000002B45B025970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002B45B0259BE
OpenProcessToken.ADVAPI32 ref: 000002B45B0259D1
LookupPrivilegeValueW.ADVAPI32 ref: 000002B45B0259F2
AdjustTokenPrivileges.ADVAPI32 ref: 000002B45B025A38
CloseHandle.KERNEL32 ref: 000002B45B025A58

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: 774d3f83cc9eb226e7bf5c005c086b9fcdd931f54e6abad52bbe1dce7a47df7d
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: 1A216B72218F8086E7609F62F4C834AB3A0F798F90F958126EA8943B5ADF7CC545CB50

Function 000002B45B001340 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

exists, xrefs: 000002B45B00374D
prefs.js, xrefs: 000002B45B0028A2
directory_iterator::directory_iterator, xrefs: 000002B45B0020E3, 000002B45B003764
status, xrefs: 000002B45B0020D1, 000002B45B0020F3, 000002B45B00211B, 000002B45B002143
cannot use push_back() with , xrefs: 000002B45B002095

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 2028398e588e2433f4f958282045dfcafc89b56812f6764fb8a2c61116ee508e
Instruction ID: 86235af0f050c741a7df814015cbd53d71ec08f401e6473875f7f0feb342b7de
Opcode Fuzzy Hash: 2028398e588e2433f4f958282045dfcafc89b56812f6764fb8a2c61116ee508e
Instruction Fuzzy Hash: 11523672609FC485E6B1AB15F8953DEB3A4F7D9B84F905216DACC42B5AEF38C194CB00

Function 000002B45B01E9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000002B45B01EBCC
recv.WS2_32 ref: 000002B45B01F0AC
closesocket.WS2_32 ref: 000002B45B01F0BE
WSACleanup.WS2_32 ref: 000002B45B01F0C4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 36b5ba9792e9bde74e71c0f1acfcc28cd0ccb678e6b6ee60cf7e27d7f1635b86
Instruction ID: a167cbecb10a08633fc9540d74c738bdbd023ec176d333f6e2ca3114fa3971db
Opcode Fuzzy Hash: 36b5ba9792e9bde74e71c0f1acfcc28cd0ccb678e6b6ee60cf7e27d7f1635b86
Instruction Fuzzy Hash: A81261B2614FC082EA31AF14E8D93DEB751E7A9B90F904215DAAD42BDBDF78C485C710

Function 000002B45AFDACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000002B45AFDAD22
CredFree.ADVAPI32 ref: 000002B45AFDB746

Strings

cannot use push_back() with , xrefs: 000002B45AFDB794

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 21b259fd1aadcca7f384711705638e9f6f800b965a1646408ae8043415057343
Instruction ID: 94acd96ca7d25196bd4e91cc7dc74cd22dde40126c23d83773243d9a41284b1a
Opcode Fuzzy Hash: 21b259fd1aadcca7f384711705638e9f6f800b965a1646408ae8043415057343
Instruction Fuzzy Hash: 0E625C73604FC49AEB319F25E8843DD77A1F399798F904216EAAD17B9ADB74C284C700

Function 000002B45B02C55A Relevance: 5.6, Strings: 4, Instructions: 566COMMON

Download Yara Rule

Strings

array, xrefs: 000002B45B02CC84
object separator, xrefs: 000002B45B02CAB3, 000002B45B02CDEE
object, xrefs: 000002B45B02CD39
object key, xrefs: 000002B45B02CB5C, 000002B45B02CEA3

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: array$object$object key$object separator
API String ID: 0-2277530871
Opcode ID: 67436389a04c99e8054f3e0aa3fffa1fd3ae553f7ec7f9764ff34f684751c61b
Instruction ID: 3cd2819908e094748cdbfb07e9570c76fe3bdb188af620dae218871a53b2a49a
Opcode Fuzzy Hash: 67436389a04c99e8054f3e0aa3fffa1fd3ae553f7ec7f9764ff34f684751c61b
Instruction Fuzzy Hash: 7A42B2A2624E8497EB20EF34D4D93ED7361F7A5B98FC01202EA4D47A9BDF64C248C350

Function 00007FF65DAA34C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 00007FF65DAA3527
NtProtectVirtualMemory.NTDLL ref: 00007FF65DAA3591

Strings

0, xrefs: 00007FF65DAA3507

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: MemoryVirtual$ProtectQuery
String ID: 0
API String ID: 1355999870-4108050209
Opcode ID: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction ID: 1569ce5b47ca568740f2991cf1d8c385b4365b6ea35e7acb0733ddf282182a44
Opcode Fuzzy Hash: 89413ede3b1e85be20c8f272e65a27b8bfe40e2a2e38e4141ba162e5d23f76ce
Instruction Fuzzy Hash: 3D212A3261CB8586EB508B65F45436A73A4FB887A4F540335EAAD93BE8EF7CD0448B00

Function 000002B45B011EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000002B45B011EF8
LocalFree.KERNEL32 ref: 000002B45B011F8A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: 596fa499bef244c438dd8ce5b568fe42677af41db95d3305215718dc59f1aca7
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: CD416C73614B80CEE3209F74E4843DD37A5F769B8CF444229EB8806E8ADB79C5A4C354

Function 000002B45B0213B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000002B45B021421

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: d8b03ed05d86498b2cd0db94420db970589b51d7f0771b86feb35ab4319b7204
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: B1417E33A18F8086E720DF21E8C439EB764F794784F545215EE8823A6ADB78D5D1DB40

Function 000002B45B020110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000002B45B020155

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: f16845598cd2ff46f2c1968c5ded64752efd06936a45029065fc06c6ce80e4e7
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: FF018872118B8183E731DF15F8D539EB3A4F7A8B84F844215EA8D42656DBBCC194CB50

Function 000002B45B020820 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 000002B45B020A7E

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: d79c3521c7dd920ccc3192e03795f8b47db21d7ff3f24562c83f2d7779fd43af
Instruction ID: 88516e7bd30a2b6093b1ac3655b713bd73145893e6921b582b74256572eebdcb
Opcode Fuzzy Hash: d79c3521c7dd920ccc3192e03795f8b47db21d7ff3f24562c83f2d7779fd43af
Instruction Fuzzy Hash: A3C105A3E14F808AF720DF78D48539D7761F7A9BA8F905305EAA816A97DB78C185C340

Function 000002B45B0270B0 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 000002B45B0272A2

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction ID: 4006db4ea86c973ae35e42ddf845224143fb1beed4bdb61edb134a97f1d5699a
Opcode Fuzzy Hash: 06a80ac53363f504e8d291dc153b6a47b21947aca11156197ff4547b1ef6832f
Instruction Fuzzy Hash: 0681C1A2304A9483EA64EF15D5D87ADB761F7A5F80FC48422DF4A43BA6DF38C919C350

Function 000002B45B02662B Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

": , xrefs: 000002B45B026711, 000002B45B0267BE

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 7d9dad981727df251dcf6c5e6bbde99c0667bc6b6e6a6f7e89b9cedcecf14999
Instruction ID: f0f259c8684685e3667f0e6dfb6ed666e5a7352825e2dd8f50f79a5a62a4018a
Opcode Fuzzy Hash: 7d9dad981727df251dcf6c5e6bbde99c0667bc6b6e6a6f7e89b9cedcecf14999
Instruction Fuzzy Hash: 6F91F2B6304A8582DB20AF26D1D879EB361F799FC8F859006CB9E07B66DF39C558C701

Function 000002B45AFE22D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 000002B45AFE2359

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction ID: 44cfe04fbae3220caa092f4764b571bfbe3bdfd7fdf1d4e56f0c53d132849297
Opcode Fuzzy Hash: 0e1e18df8e43834f8c2d261b7060e305521bf1430a60c216941d6cdd0af00934
Instruction Fuzzy Hash: 83411363619AE04ADB52CB39845137D7FB1E366B88F5CC152DBE487747D62DC206CB10

Function 000002B45AFDCF60 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4028d5451824e4ec8c33ef6ec6e520c2671e829f655679f515adae9ffa1b5c9d
Instruction ID: 664b4cac7e122fd08ffb3dafd891f6fe613eea5777f1cdc4645512c56256afff
Opcode Fuzzy Hash: 4028d5451824e4ec8c33ef6ec6e520c2671e829f655679f515adae9ffa1b5c9d
Instruction Fuzzy Hash: 4A725B73615FC48AEB21DF69E88439D73A0F798798F504216EADC57B9AEB78C244C700

Function 000002B45AFCF1C0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67552ef0fa8666a4d59e6087d1a22013c3b6e00b0d2513b4aae911bd138e3fa
Instruction ID: 5dd3c31cbf2802d106d0cdf34a2636507511e7d49e775602ce969e6dd8f499c3
Opcode Fuzzy Hash: f67552ef0fa8666a4d59e6087d1a22013c3b6e00b0d2513b4aae911bd138e3fa
Instruction Fuzzy Hash: A9F14073A05F848AEB208F69E88535DB7A0F79C7A8F504315EEDC57B99DB78C1948700

Function 000002B45AFCF8B0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba1c8cdbafd4b0f0ef2d06a6ba6c9fd059a218815a8c9af8ed0182ad1c5c82d
Instruction ID: e2fec5aea515fec07c1b1da4eaedef32c82c94bbee5bb17da5cc46e0e31b7f3c
Opcode Fuzzy Hash: cba1c8cdbafd4b0f0ef2d06a6ba6c9fd059a218815a8c9af8ed0182ad1c5c82d
Instruction Fuzzy Hash: DDF15E73604F848AEB209B69E88535DB7A0F79C7A8F504315EEEC56B99EB78C194C700

Function 000002B45B018B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002B45B0188B0: InitializeCriticalSectionEx.KERNEL32 ref: 000002B45B018901
Part of subcall function 000002B45B0188B0: GetLastError.KERNEL32 ref: 000002B45B01890B

EnterCriticalSection.KERNEL32 ref: 000002B45B018B71
GdiplusStartup.GDIPLUS ref: 000002B45B018B98
LeaveCriticalSection.KERNEL32 ref: 000002B45B018BA6
LeaveCriticalSection.KERNEL32 ref: 000002B45B018BD4
GdipGetImageEncodersSize.GDIPLUS ref: 000002B45B018BE2
GdipGetImageEncoders.GDIPLUS ref: 000002B45B018C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 000002B45B018D40
GdipSaveImageToStream.GDIPLUS ref: 000002B45B018D5E
GdipDisposeImage.GDIPLUS ref: 000002B45B018DC3
GdipDisposeImage.GDIPLUS ref: 000002B45B018DD7

Strings

&, xrefs: 000002B45B018D3A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction ID: d33fb33a6c751668f5eb61585645d2581b742becefe7e96376a82387ac94bec7
Opcode Fuzzy Hash: e0228fc8eea7d5b1ef60bb9784c8d30ef67e4de2cf218bbc2f582390e882f76a
Instruction Fuzzy Hash: 3B918FB2200F409BEB34EF20D8C87A877A4F765F98F948215EA4947B96DF34C695C360

Function 000002B45B019BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002B45B01F890: GetUserGeoID.KERNEL32 ref: 000002B45B01F8B7
Part of subcall function 000002B45B01F890: GetGeoInfoA.KERNEL32 ref: 000002B45B01F8D1
Part of subcall function 000002B45B01F890: GetGeoInfoA.KERNEL32 ref: 000002B45B01F921

WSAStartup.WS2_32 ref: 000002B45B019D59
socket.WS2_32 ref: 000002B45B019D7A
htons.WS2_32 ref: 000002B45B019DA0
inet_pton.WS2_32 ref: 000002B45B019DE3
connect.WS2_32 ref: 000002B45B019DFD
closesocket.WS2_32 ref: 000002B45B019E1C
WSACleanup.WS2_32 ref: 000002B45B019E22

Strings

system, xrefs: 000002B45B019CC5
geo, xrefs: 000002B45B019D06

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 60c3024b284a940e11ebd5efc28cec14dd664e0cfac4e9075431bf37327be272
Instruction ID: 1b97bf9ffd9971919b9c3b124241bc05661dd29bc77556e9ae9af90e555e59ce
Opcode Fuzzy Hash: 60c3024b284a940e11ebd5efc28cec14dd664e0cfac4e9075431bf37327be272
Instruction Fuzzy Hash: 79C1BFA2B01F409AEB20EFA4D8D939C73A2B765B98F815212DE5D177AADF34C546C310

Function 000002B45B023B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002B45B023B61
GetProcessId.KERNEL32 ref: 000002B45B023B6A
RmStartSession.RSTRTMGR ref: 000002B45B023B8A
RmRegisterResources.RSTRTMGR ref: 000002B45B023BB5
RmGetList.RSTRTMGR ref: 000002B45B023BEE
RmGetList.RSTRTMGR ref: 000002B45B023C50
RmEndSession.RSTRTMGR ref: 000002B45B023C8B
RmEndSession.RSTRTMGR ref: 000002B45B023CC2
RmEndSession.RSTRTMGR ref: 000002B45B023CD7

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction ID: 3bec53ecfa4320dfb45b12534d06ebd6dd48c7b70fe673c2148dfc57fabf97fe
Opcode Fuzzy Hash: fd498ee3de36280c394abacf9467fc5b9ce5ac8d70b1b0db778499f5d870b0f3
Instruction Fuzzy Hash: 34512E72714A418BF724DFA5E4D869DB3B1F758B88F90412ADE0A63B95DF34C80AC750

Function 000002B45B03D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B03DA1D

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction ID: 7cebdf34db678d8791fa010cb790e58e9527f2a9d571ab6a782d368851ddd011
Opcode Fuzzy Hash: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction Fuzzy Hash: C2C1C2A2214F8593E771BF1994CE3AD7BA1F7A1F80F954211DA4A07793DF79C84A8320

Function 000002B45B018990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000002B45B0189D3
EnterCriticalSection.KERNEL32 ref: 000002B45B0189E5
EnterCriticalSection.KERNEL32 ref: 000002B45B0189F5
GdiplusShutdown.GDIPLUS ref: 000002B45B018A03
LeaveCriticalSection.KERNEL32 ref: 000002B45B018A10
LeaveCriticalSection.KERNEL32 ref: 000002B45B018A1A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: 29c438c31477100c5b6404e6fe5dd383312e6ec3af03dabd75737afaca510061
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: 1E113A72111F4082EB24EF25E8C8119B3B4FB65FA4FA84315DA6D027A5DF34C997C360

Function 00007FF65DAB7980 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DAB7C00: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00007FF65DAB7C0E

Part of subcall function 00007FF65DAA6610: char_traits.LIBCPMTD ref: 00007FF65DAA663D

Part of subcall function 00007FF65DAB7DC0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB7ED5

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB7AFA

Strings

LoadAcceleratorsA, xrefs: 00007FF65DAB7A73
EnterCriticalSection, xrefs: 00007FF65DAB79FC
LeaveCriticalSection, xrefs: 00007FF65DAB79C5
LoadAcceleratorsW, xrefs: 00007FF65DAB7A33

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ProcessorReentrantScoped_lockScoped_lock::~_Virtual$Concurrency::RootRoot::char_traits
String ID: EnterCriticalSection$LeaveCriticalSection$LoadAcceleratorsA$LoadAcceleratorsW
API String ID: 2378420206-1394853731
Opcode ID: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction ID: 2907f183e0a0640a203cdc572d738fe74f4342b8e6efbdbdd256517f8979fe73
Opcode Fuzzy Hash: 04327c45c70a67150be1c73c2e078c6eac2a998af2c452a8fcebf7652b8d46cf
Instruction Fuzzy Hash: E6512F3251DA8791EA70EB90E4513EB6360FBC1344F481132E28DE3AEAEE6CD905CB40

Function 00007FF65DAB7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB80EF
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB8197

Part of subcall function 00007FF65DAF77D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7824
Part of subcall function 00007FF65DAF77D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7865

Strings

1.3.1.zlib-ng, xrefs: 00007FF65DAB802D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$ExceptionFileHeaderRaise
String ID: 1.3.1.zlib-ng
API String ID: 543713560-992988628
Opcode ID: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction ID: 2b2e4bec28393fe5e0b1174a4bc127b8acc68283a3da0de771b7c1b7f460699e
Opcode Fuzzy Hash: 8956c29817721c66e9a5c783700e556b24576ee2f69ddabf96bd024d6e1e8483
Instruction Fuzzy Hash: 5961E83261CA8686E670DB64E4513EBB3A0FBD8344F444235E6CD92AD9EF3CD645CB41

Function 000002B45B020420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000002B45B020489

Strings

ProductName, xrefs: 000002B45B020474
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000002B45B02047B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction ID: 18647ed88ba045cdd96435fcacda25da4b06b045380efa1cc3d51fc3bb61c629
Opcode Fuzzy Hash: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction Fuzzy Hash: 7E118172218F8083EB60DF21F48539AB3A4F799B94F804216EA9803B5ADFBCC155CB40

Function 000002B45B02B090 Relevance: 4.9, APIs: 3, Instructions: 440COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B02B26B
Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B02B474
Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B02B5F0

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 70d3a949619ac1b0e9964116f6ba8f5623cd288c852f1d955663d95d3cb59920
Instruction ID: 2f40ee141e180b5b1b8ddbc8ddfabd4cfc455397287e15475c8d845e3d620126
Opcode Fuzzy Hash: 70d3a949619ac1b0e9964116f6ba8f5623cd288c852f1d955663d95d3cb59920
Instruction Fuzzy Hash: 6DF1A3B2211F8486DA24EF25E4C87ADB3A4F758BE4F944625EBAD47796DF38C194C300

Function 000002B45B01ED77 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000002B45B01F0AC
closesocket.WS2_32 ref: 000002B45B01F0BE
WSACleanup.WS2_32 ref: 000002B45B01F0C4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a3ff1c72fe5ce7a4ba30a757a1366cac1052ac2a4458e6b2fc94b70744e8dcc2
Instruction ID: c6beeee9cca80ab956d1dd3247192211756413ccc5aa9d2f8daeb57f16e1707e
Opcode Fuzzy Hash: a3ff1c72fe5ce7a4ba30a757a1366cac1052ac2a4458e6b2fc94b70744e8dcc2
Instruction Fuzzy Hash: 269152A3614FC042EA35AF15E4D939E7751E7A5BA0F904305DAAD06BEBDF78C4818710

Function 000002B45B021111 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002B45B021129
RegEnumKeyExA.ADVAPI32 ref: 000002B45B02116E
RegCloseKey.ADVAPI32 ref: 000002B45B021364

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: f458c22420d06c21da6f2b9f6a93e1c26ea9a1f356d9961e8a5c3013cb53f523
Instruction ID: 806c7673ad30be3d3eb62bf0e1040d83a50794afe79fa63e863a0957e88c5462
Opcode Fuzzy Hash: f458c22420d06c21da6f2b9f6a93e1c26ea9a1f356d9961e8a5c3013cb53f523
Instruction Fuzzy Hash: 407185B2604F8486EB20DF65E4C839DB761F7957A8FA00205EFA917AD6DB78C0D5C710

Function 00007FF65DAAD7F0 Relevance: 4.6, APIs: 3, Instructions: 112COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF65DAAD8DD
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF65DAAD9C0
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAAD9E9

Part of subcall function 00007FF65DAA6610: char_traits.LIBCPMTD ref: 00007FF65DAA663D

Part of subcall function 00007FF65DAADAA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAADAB8

Part of subcall function 00007FF65DAADB00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAADB13

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue$char_traits
String ID:
API String ID: 2573577243-0
Opcode ID: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction ID: 67f0581bbb6226d53542c6954093864db14cd52256f7be7e08b292ffc7a2b84a
Opcode Fuzzy Hash: f26d7d76682de479d1a510b7515a2100360f65aa1e8371ebd0398830a94be955
Instruction Fuzzy Hash: 0B51097260CBC691DA609B55E4413ABB3A0FBC5780F844136E6CD97BAAFF2CD445CB40

Function 000002B45B0210A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002B45B021129
RegEnumKeyExA.ADVAPI32 ref: 000002B45B02116E

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction ID: a08690fd5923f89412374b1fc4e81e9246d05981e2915fb1055dbd97206f46f2
Opcode Fuzzy Hash: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction Fuzzy Hash: 3B319E72600B8486E730DFA1E88879EB365F795B98FA00215EE9817B56DF78C196C700

Function 00007FF65DAB17D0 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CallMemberFunction0.LIBCPMTD ref: 00007FF65DAB1850
_CallMemberFunction0.LIBCPMTD ref: 00007FF65DAB18CD
_CallMemberFunction0.LIBCPMTD ref: 00007FF65DAB1928

Part of subcall function 00007FF65DAAA560: char_traits.LIBCPMTD ref: 00007FF65DAAA593

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: CallFunction0Member$char_traits
String ID:
API String ID: 1927575840-0
Opcode ID: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction ID: 94e39cc7ebfcc7e28ff1bfafbbaecb35e15b2d9943cc45d919552e959996c57c
Opcode Fuzzy Hash: b3a0a285e39b8cf687cbf5e33b540a6d49c497df54d9ecd142d2dcea34095149
Instruction Fuzzy Hash: 00316031A0DA4686F660DB95E44117BB7E1FB85784F484235E28DD76EAFF3CE5028B40

Function 000002B45B020DDB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002B45B020DF7
RegQueryValueExA.ADVAPI32 ref: 000002B45B020E36
RegCloseKey.ADVAPI32 ref: 000002B45B020ED4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: b5901a3cd6b954f6a774689512a6fc3d71d5621db7fe552ec5d293c361ff023b
Instruction ID: 5b4f2aaaee396765070ece01fe34dd83ae3ff6cb988e4f178016a9f19835f2e8
Opcode Fuzzy Hash: b5901a3cd6b954f6a774689512a6fc3d71d5621db7fe552ec5d293c361ff023b
Instruction Fuzzy Hash: A721A7A2615F8082EE709F25E4D535FB351F7E5BD4F805212EA9E42A96EF38C0C4C750

Function 00007FF65DAB82A0 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65DAB82DB
OpenProcessToken.ADVAPI32 ref: 00007FF65DAB82EE
GetTokenInformation.KERNELBASE ref: 00007FF65DAB8336

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction ID: 585bd021ad77fa035ea717594884e739665b7f22dea023cc03d8b0d62a35e7af
Opcode Fuzzy Hash: 722ab832dbefb05b570a67b2cccdef345e5e387398dfdff30b5f0e262e84267a
Instruction Fuzzy Hash: 0C215E3152C68185EB40DB65E4543AFA760FB81744F981035F6CE93AD9EF3DD409CB00

Function 000002B45B01F890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000002B45B01F8B7
GetGeoInfoA.KERNEL32 ref: 000002B45B01F8D1
GetGeoInfoA.KERNEL32 ref: 000002B45B01F921

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction ID: aae97450a7c8ecf31efb307a0fae5c10f88095d70eed42f4a7902b2c9287f63b
Opcode Fuzzy Hash: d34c2ece54cb3812040e4eef0477fed434900964bc97860851aa3e607d5351a2
Instruction Fuzzy Hash: EE11BF72628B8183E720AF61F49471EB3A1F7A5F88F445225EF8503B5ADF7CD5908B84

Function 000002B45B019760 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002B45B01979B
OpenProcessToken.ADVAPI32 ref: 000002B45B0197AE
GetTokenInformation.ADVAPI32 ref: 000002B45B0197EA

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: ac19d2d059f11fe95dfa06180a3e4b4e8ab2040db48b75045ca1a072a2cbf215
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: DB110A72619F8083EB60AF15F8C434AB3A0F799B80F999125EA9957B69CF3CC445CB50

Function 000002B45B043270 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000002B45B043281
TerminateProcess.KERNEL32 ref: 000002B45B04328C
ExitProcess.KERNEL32 ref: 000002B45B04329B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction ID: bcccd370567abc40214f030ab76ef1e15d9b23ec2899ecc777db71c1ab677053
Opcode Fuzzy Hash: f80d91bcf93e8424b3640f1b7356e3f7b22acd1ad7b3684da8aa45f97133e79c
Instruction Fuzzy Hash: A2D06CA4320E0493EA387F7069DD26D7325AB7AF01F906838CA02067A7CF2988498320

Function 000002B45AFDF350 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFDF53C

Strings

, xrefs: 000002B45AFDF3D3

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: e166c857a238f254e59f2c4b7f065a9c8d06d56266ce2945c74b42336dbb6aa6
Instruction ID: 25aba49fb6d6045f2b380c778251e07d38711ca3f3d4d9bb219b28fe111d497f
Opcode Fuzzy Hash: e166c857a238f254e59f2c4b7f065a9c8d06d56266ce2945c74b42336dbb6aa6
Instruction Fuzzy Hash: BA513B73204F44A7EA269F2AD99835C37A0F759B94F948612CB6D43BA6CF79D0A58300

Function 000002B45B020C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000002B45B020C6C

Strings

Unknown, xrefs: 000002B45B020D26

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction ID: 9987bb5ede146e87ca1420a3d0efe5e572d6ecf8a0997956bf49f21a04bb92b7
Opcode Fuzzy Hash: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction Fuzzy Hash: 8F31A163628FC087E7219F20E59439EB360F7A9B84F945215EFC912A57DB7CC595CB00

Function 00007FF65DAAFAE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_CRT_INIT.LIBCMTD ref: 00007FF65DAAFB9A

Strings

@, xrefs: 00007FF65DAAFB6E

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction ID: 3056eec26edad0a022dda977660ebc0776ed8039fb981c68fa9ee0e22cfad379
Opcode Fuzzy Hash: b337b7728e22acf7a85b468339197ec44de5b842342dd1561fc2dcb21d3dd529
Instruction Fuzzy Hash: C331B83661DB818AD760DB55E49062BBBE0F788784F140626FB8D93B99EF3CD5408F40

Function 000002B45AFE51E0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE5320
Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE541F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7b110e3cb14acf78e02d684284d6cd73aadd085dc85baf4b69cd65186d7b59fb
Instruction ID: 4d078520eacc43da1d2bd8c46a817a7d3c018bc5fe7b709d386748a94aae051e
Opcode Fuzzy Hash: 7b110e3cb14acf78e02d684284d6cd73aadd085dc85baf4b69cd65186d7b59fb
Instruction Fuzzy Hash: C551A2A3305F4486EE74BF52A98839D7391A768BE4F984622DE7D0B7D7DB78C4858300

Function 000002B45B018E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000002B45B018E69
CoTaskMemFree.OLE32 ref: 000002B45B018F2A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: ac78d0950d5123e79d1274902e366252036e177f94df0b62379f251fbb92b7d3
Instruction ID: 37c5e594a1a3123c9ae2a42452426a0e856db118891a4c4dc92283225c8a881f
Opcode Fuzzy Hash: ac78d0950d5123e79d1274902e366252036e177f94df0b62379f251fbb92b7d3
Instruction Fuzzy Hash: E33173B2914B8082E720DF25E4D535EB761F7A9BF4F505316FAAC02796DB7CC1818B40

Function 000002B45B02E614 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B02E63B

Part of subcall function 000002B45B02E5D0: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B02E5E7

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B02E6EF

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction ID: 8b976cab16cd11e74140d4a5b7b812601b940256c91852f6dab3bb860e1664c4
Opcode Fuzzy Hash: cb30a7c2c620b97f400ef9b33bc0fdb0214d80daa24a11497eeb67f4fc095207
Instruction Fuzzy Hash: FE317CA2650E4487EA75FF54E9D97ADB361A7B4FC0FD80621E609473D3EB78C5098320

Function 000002B45B017390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000002B45B0173E1
RegCloseKey.ADVAPI32 ref: 000002B45B0173F3

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction ID: 004422bbd95cc8a1926bcc40e3236a76e696c4739df828ac82deef570c2e89c9
Opcode Fuzzy Hash: f079ec761da95b766b8b6afbeec7fda29d97571b2deafd3f5d4343d11bd09f0c
Instruction Fuzzy Hash: 9221B4A1711E4047EA70AF21E8C43AAB760EBA9FD4F841221EE4D47B9BDF68C481C710

Function 000002B45B01664C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000002B45AFDC8C0: CreateToolhelp32Snapshot.KERNEL32 ref: 000002B45AFDC90A
Part of subcall function 000002B45AFDC8C0: Process32FirstW.KERNEL32 ref: 000002B45AFDC94C

Part of subcall function 000002B45AFDACC0: CredEnumerateA.ADVAPI32 ref: 000002B45AFDAD22

Part of subcall function 000002B45B01E9F0: recv.WS2_32 ref: 000002B45B01EBCC

ReleaseMutex.KERNEL32 ref: 000002B45B0166BB
CloseHandle.KERNEL32 ref: 000002B45B0166C4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: eea197aff795f4b9c5d6efeee9918aec06857f2d6b74eb6359eb0d3e40ff1cb4
Instruction ID: fe4c8d5ba5b1ef4554eeb203ddbb9872b39d3462886ab2d0c9c78f3704d69947
Opcode Fuzzy Hash: eea197aff795f4b9c5d6efeee9918aec06857f2d6b74eb6359eb0d3e40ff1cb4
Instruction Fuzzy Hash: 6F219DA2605E8053F936BFB4ECDE3AD7340AB76F95FC44602EAA9016D79F18C0848731

Function 000002B45B01667D Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B01E9F0: recv.WS2_32 ref: 000002B45B01EBCC

ReleaseMutex.KERNEL32 ref: 000002B45B0166BB
CloseHandle.KERNEL32 ref: 000002B45B0166C4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: ec0be76bda8e78934538e784beaa4ec270da2de2427e8a6dabb4454447da85b6
Instruction ID: fcb83c90250b7b74ebd47b77065ff30d2c7d1c2ec834bb80504287df5bd6a69c
Opcode Fuzzy Hash: ec0be76bda8e78934538e784beaa4ec270da2de2427e8a6dabb4454447da85b6
Instruction Fuzzy Hash: 571191E2601E8043FA767F64ECDE39D7340ABA6F91FC44601EAA9016D79F18C0848731

Function 000002B45B03DB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000002B45B03DBAC
GetLastError.KERNEL32 ref: 000002B45B03DBB6

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: b299cbb5285ed947540b7887271d98b776bbf86fab8cb27ba1564e4914e1a8cb
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: F5118CA2214F8082DA20AF25E8C9259B361F7A5FF4F944311EE794B7EACF78C0518750

Function 00007FF65DAAD750 Relevance: 3.0, APIs: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF65DAAD768
GetProcAddress.KERNEL32 ref: 00007FF65DAAD789

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction ID: f385aaeb217b3f0be95a9a23a8b80893fd53e8c446ababc7d483d044cf5a4a1d
Opcode Fuzzy Hash: bd71bcfb797b50c55a6df7201416778f22323b2fa91c79af38a8b0c2d0370c92
Instruction Fuzzy Hash: A701297651CB8589DB608B51F48032BB7B0F789798F141635E6CE92BA8EF3CD1958F04

Function 000002B45B04CB98 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B04CBC8

Part of subcall function 000002B45B04DBEC: std::bad_alloc::bad_alloc.LIBCMT ref: 000002B45B04DBF5

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B04CBCE

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction ID: 443e5462585161a11139de4b3683cd5ef20f082cfea330df8843ae8aac0fc184
Opcode Fuzzy Hash: 267b89f17236609d1417f10d46edbd95984192d968a560c5371d581f7ac22313
Instruction Fuzzy Hash: 5CE0EC91615B0547F9383E7218DE2B423444B39B70E981B26DD75052C3AB94C4D583B0

Function 00007FF65DAE5810 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,00007FF65DAE5929,00007FF65DAEACD6,?,?,?,00007FF65DAEB053,?,?,00000000,00007FF65DAEB9B9,?,?,?,00007FF65DAEB8EB), ref: 00007FF65DAE5826
GetLastError.KERNEL32(?,?,00007FF65DAE5929,00007FF65DAEACD6,?,?,?,00007FF65DAEB053,?,?,00000000,00007FF65DAEB9B9,?,?,?,00007FF65DAEB8EB), ref: 00007FF65DAE5830

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction ID: 56293b8076c2befbd15badc7a8c851348f82d792b6430dd8cf3e2b0e93b2f24f
Opcode Fuzzy Hash: d1c0f4e6f877c9d6cfcd8a19c59eeb7a423ced942baaa3383c8ac58c4f15d072
Instruction Fuzzy Hash: 73E08CB0F0C20342FF086BF2B89507A12629F84B41F8C4034DD0DE22E2FE2CA8859300

Function 000002B45B03B550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000002B45B03B566
GetLastError.KERNEL32 ref: 000002B45B03B570

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction ID: 772cb318d08f3d01727d40758f3ca683cc6da5a25f8c19e734c59610d1a4edc0
Opcode Fuzzy Hash: 47cbcda289b4926f8a5fa232dbc04e0ffd722977d505590b0caac84d58b1b127
Instruction Fuzzy Hash: 19E0E2D0B22F0593FA387FF298DD32933956BB9F45FC44520DA25962A3EF2888944320

Function 000002B45B02D450 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B02D6A0

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f9939f10e4e3afd893229be84c0e5982441ea8343fd720606789c516903e13da
Instruction ID: ec01db49cc944febac6d8199965cbefb84aba19af196f7bb3763ced9740ad669
Opcode Fuzzy Hash: f9939f10e4e3afd893229be84c0e5982441ea8343fd720606789c516903e13da
Instruction Fuzzy Hash: 59619CA2200E9086EA35AE16D1D936DB3A1A324FD8F948611DE5D077D6DF79C88AC320

Function 000002B45AFCE150 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000002B45AFCE283

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 2144925f09ea7b6f4cadf475c6b9da65537d4cea81ec615bd04734634f348af7
Instruction ID: dbc5d5545f2bd5cd5d47511dbf77dd5939db65980cab4fd6763e3914024b8e72
Opcode Fuzzy Hash: 2144925f09ea7b6f4cadf475c6b9da65537d4cea81ec615bd04734634f348af7
Instruction Fuzzy Hash: A661B463B44F4087FB30EF66D8E839C33A1E765B98F844612DE29576D6EB34C4998340

Function 000002B45AFEA050 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFEA1F8

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f9609803d3e825b54ac25102eb7abc985b7260913e5548cc781afebc749f5d3f
Instruction ID: 4eb583b0e1b50ac5132a4d39eccc99880402ae00d19d8ee2195f4f0c2d77b38e
Opcode Fuzzy Hash: f9609803d3e825b54ac25102eb7abc985b7260913e5548cc781afebc749f5d3f
Instruction Fuzzy Hash: C641C163301E8482EE74FB66E89826A7751B764BE4F948626EF7D077C6CF38C0958310

Function 000002B45AFE5B00 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE5C95

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6eb7d6ad84328a61a5f81028902d6e822cb982940a9aa980b8ad4f398988815d
Instruction ID: a3e34c49e16cd2178a3a295c874168f9017874816c4368978c7023e2ab23fae5
Opcode Fuzzy Hash: 6eb7d6ad84328a61a5f81028902d6e822cb982940a9aa980b8ad4f398988815d
Instruction Fuzzy Hash: 6041BFA2304F8482EA60AF26E89839D7351B729FD4F944622DFAD0B7D7DF38C4458304

Function 000002B45B00B010 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B00B1B7

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9e12385e36486cb58df179bf8176c268858ef5d2040d43e36d1972db119702ff
Instruction ID: 9099d92b0dd7fa2de521a8c9b869ea99ab89b8e61a603d9b234a7d3907b515ab
Opcode Fuzzy Hash: 9e12385e36486cb58df179bf8176c268858ef5d2040d43e36d1972db119702ff
Instruction Fuzzy Hash: 694161B6214F8882DA24EF55E5D83AE73A1E759FD4FD08616DBAD03B96DF38C0408310

Function 000002B45AFE9ED0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFEA034

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 37ea0906b01e05952d2a2c17eb9448a2b55dfb41596f7d6e2e290d65e971a214
Instruction ID: f7e1bfb0b5154cbdc7b2141a99078c6000484eaf480ca602d25f38a44b410301
Opcode Fuzzy Hash: 37ea0906b01e05952d2a2c17eb9448a2b55dfb41596f7d6e2e290d65e971a214
Instruction Fuzzy Hash: A531B163301E8446ED74EB56A88869AB354B764FE4FD04A26AFBD077D6CF39C0498310

Function 000002B45AFE5CB0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE5E2C

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 455f16833df3cee76ae30f5063861d7cd2cdd050caad19e1d8857e5a0724da3f
Instruction ID: 8f9f85dd92b96997a985bb951f390453150be5c0d6803593e260758b252e69fa
Opcode Fuzzy Hash: 455f16833df3cee76ae30f5063861d7cd2cdd050caad19e1d8857e5a0724da3f
Instruction Fuzzy Hash: 8F41AEA2305F4486EE70BB16A98C39DB351A328FE4F9446229F7D4BBD7DB78C5458300

Function 000002B45AFE15C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE1711

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 725e7b1dce42eeb5c15a5466f027004f63ab61178bae60a4eda76fb116a9ea87
Instruction ID: 8f026e062869b908a2f61b5ebb8a3e4f3ebf7fc9747a16136b0ca7e8cec6e569
Opcode Fuzzy Hash: 725e7b1dce42eeb5c15a5466f027004f63ab61178bae60a4eda76fb116a9ea87
Instruction Fuzzy Hash: E831D1A3301E4486FA75BA5699983AD33919725FE4F980622DA390BBC7DB78C4898344

Function 000002B45B03BA50 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B03BA78

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction ID: 5727b79b02f933338a8cc2957b574fa0319ff57b06dc3e9d5fb61128ad9b1604
Opcode Fuzzy Hash: 62a68b64f697a3323ce5c67975f603dd912b7630c4b3619a8df593f8b8e10b11
Instruction Fuzzy Hash: D341D1B2214F0487EA34BF19E5DD36D73A0E766F88F940205EA96836D7CB68C802C771

Function 000002B45AFE5990 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE5AEB

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2c1d873e7b48c48a7202e499ec2ce75aaf65b47fadd1cdb31bddda3e7c006e5e
Instruction ID: e3dc89259b67a891057725a5959e2e8eaa50f1a475daad60f59b677bf61e05d2
Opcode Fuzzy Hash: 2c1d873e7b48c48a7202e499ec2ce75aaf65b47fadd1cdb31bddda3e7c006e5e
Instruction Fuzzy Hash: 8131A0A2305F8496EE70BF16A9C839D7355A724FD4F9846269E6D0BBC7DB78C0958300

Function 000002B45B020250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000002B45B0202E0

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 076eddd4a4bb32051c91c1a6983a33c56c444267f15b4631bc17067f3113462f
Instruction ID: 003dde3843425a9994e3b30bc90e45af7d97be800590b0df1a44ffc88cce096f
Opcode Fuzzy Hash: 076eddd4a4bb32051c91c1a6983a33c56c444267f15b4631bc17067f3113462f
Instruction Fuzzy Hash: 38519073A14F808AE721DF64D8C439E7364F799B88F904212EB9C53A9AEF78C585C740

Function 00007FF65DAB7DC0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DABB970: _Byte_length.LIBCPMTD ref: 00007FF65DABB9F6

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB7ED5

Part of subcall function 00007FF65DABBA40: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DABBA6A

Part of subcall function 00007FF65DABBAA0: _Byte_length.LIBCPMTD ref: 00007FF65DABBB26

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2675252387-0
Opcode ID: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction ID: c951fbae9fd4428cebe0574b09521da38d9945909168c3b76b0540478909cffb
Opcode Fuzzy Hash: 8cf2c1331036d997b2d5cbdfd09f9a6dace60c7598b65e1a7ef6aa7a93a04358
Instruction Fuzzy Hash: 2C512A3261DAC596EA60DB55E4503EBB3A1FBC4784F844132E68D93BA9EF3CD549CB00

Function 00007FF65DAABA90 Relevance: 1.6, APIs: 1, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF65DAAC520: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAAC53D
Part of subcall function 00007FF65DAAC520: _Max_value.LIBCPMTD ref: 00007FF65DAAC562
Part of subcall function 00007FF65DAAC520: _Min_value.LIBCPMTD ref: 00007FF65DAAC590

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAABB3C

Part of subcall function 00007FF65DAA4310: std::_Xinvalid_argument.LIBCPMT ref: 00007FF65DAA431B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valueXinvalid_argumentstd::_
String ID:
API String ID: 142707115-0
Opcode ID: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction ID: e957a7df378b44cc467ce3b10301ec5cf755c0aeebcdcb40ac56b4c85d64e4fc
Opcode Fuzzy Hash: 60dc388cca3665f00380207ba0fc440bb0a5f3e9cb1ca1dbde5340a79cbc7bc9
Instruction Fuzzy Hash: 6451C43661DB8585DA60DB56F49026BB7A0F7C9B80F141126FACE93B69DF3CD450CB40

Function 000002B45AFDFE50 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFDFF58

Part of subcall function 000002B45AFCB7B0: __std_exception_copy.LIBVCRUNTIME ref: 000002B45AFCB7F8

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: f050d2dd9f53cf4eb60f05675c22f827f91ddd450abe77daab4cd8a3ee421a2e
Instruction ID: 33e8590853916dca5c18cdc0b4ea5d095c03bae8038bdfa64e815315f84bfb4a
Opcode Fuzzy Hash: f050d2dd9f53cf4eb60f05675c22f827f91ddd450abe77daab4cd8a3ee421a2e
Instruction Fuzzy Hash: 6021E863601F4062EA26FF15E5843687390A764FA4F644722DE7C47BD3EB78C4D68340

Function 000002B45B03D4D0 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B03D556

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction ID: 6768d7fd44c430e026c9052412e74917c59c09d54fafa7fff192f4118f254130
Opcode Fuzzy Hash: 90e282629e3327800b1a09ea2473f0e2941ce1167cc6a0942764be9094e0e12c
Instruction Fuzzy Hash: 2F3158A2614F1087FB61BF6998CE35D7760A764FA8FC10206EA254B3D3DB78C8468731

Function 00007FF65DAAF580 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction ID: ab44104c9b943f2db355bd83fe4d21e3c3e330a79c9c4a1997c72e24df827700
Opcode Fuzzy Hash: 8832b93c38650351119958a3682aaab50e8cbc8b9dc0623d89af5356b64ee8a2
Instruction Fuzzy Hash: BF312C7262CBC181DA509B92E49036BA7A0FBC57D0F041136FACD93BA9EF6CD0008B40

Function 000002B45B0431A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002B45B0431CF

Part of subcall function 000002B45B0432C8: GetModuleHandleExW.KERNEL32 ref: 000002B45B0432ED
Part of subcall function 000002B45B0432C8: GetProcAddress.KERNEL32 ref: 000002B45B043303
Part of subcall function 000002B45B0432C8: FreeLibrary.KERNEL32 ref: 000002B45B04332A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction ID: 573cd463694ec4384342c209713b640381f23547b15ed85f980e2e5c78466f3f
Opcode Fuzzy Hash: 530d5f225501611c07fa3f753d7d8dc80cca454b0254b6cc05cb90d306267795
Instruction Fuzzy Hash: C0214CB2A01B408AEB24AFA8D5C83AC37A0F764B18F945635D61907AD7EB34C945CB60

Function 000002B45B05C510 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B05C46D

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction ID: b7a214b7e8728e30ca1252d3b0e7458e1aba8ef083358d9b39d2df2a9f1ac9c1
Opcode Fuzzy Hash: 6080b6f5c7735027f4532a4154f17099be5a1c2b37b88469d38b788aa2f2ab04
Instruction Fuzzy Hash: 111193A1605E4083EA70BF51D4C877DB3A0F7A6F90FC48511EA884BAC7CB39C8418B60

Function 000002B45B05E208 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B05E22B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction ID: 64aa498a8f85b4ed42ec73045912fa7ee0dc5df8219d44bc82bb3c9778c5cf21
Opcode Fuzzy Hash: c41a516aab5bbd5a0cb5ee3d8915c07e5e449c965519035ee3790c186b832703
Instruction Fuzzy Hash: 1721A8B2214E4487E771AF18D4C436977A1F7A9F54FA48324E79947ADBDB39C804CB10

Function 00007FF65DABBBF0 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DABBC1C

Part of subcall function 00007FF65DABF7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DABF846
Part of subcall function 00007FF65DABF7D0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DABF855

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2595383736-0
Opcode ID: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction ID: 65cdd596d9632659404309422496b52ce043c026517e704ede335ab79d25018e
Opcode Fuzzy Hash: d187d2a0eb802e6f176a8c328b985804572825bb7962f1620d6111e602d056cd
Instruction Fuzzy Hash: 2E21E53651CF8981EA10DB55F48025BB7A0F7C9B84F541126EA8D93BA9EF3CD551CB40

Function 00007FF65DAAE170 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction ID: 0e1903a1202d6e2f4ab5dafcc6b9cf75d71b6ecaa034df940ccda60f521837fa
Opcode Fuzzy Hash: 292d0802afc3662b8a44df9434c69ee7ab1bc2423aa3cf29da608adeab93335d
Instruction Fuzzy Hash: 4F21213261CAC181DAB0DB51E4513AF67A0FB94384F585635F6CED3ADAEF2CD6488B00

Function 00007FF65DAB8750 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAB875E

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction ID: e0ec0d395d769666c9864387cc7cc0907d5c3ccdf313c1fa378cb1c7c6d8f8e1
Opcode Fuzzy Hash: f8c7e8331dde7540c220ec2cf53b80f18e0f368c2e7c04878d69dbed098d0d54
Instruction Fuzzy Hash: BC117236619F8882DB619B5AE48031EB7A1F7C9B84F545122EBCD53BA9DF3CC5508B00

Function 00007FF65DABBAA0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DABBB70: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DABBB7E

_Byte_length.LIBCPMTD ref: 00007FF65DABBB26

Part of subcall function 00007FF65DABBBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DABBC1C

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork
String ID:
API String ID: 3730899627-0
Opcode ID: a4279381825b097a51bbb40bb4fa2ec5ae5536782bc70fef3494edae06f6c104
Instruction ID: 1ada7df26ac9bcf7323a7242fa55a2422ed65cee480c07979b808f6ee3902354
Opcode Fuzzy Hash: a4279381825b097a51bbb40bb4fa2ec5ae5536782bc70fef3494edae06f6c104
Instruction Fuzzy Hash: 9011063251CA8582EA50DB65F49119BB7A0FBC5780F944122FBCD93BAAEF3CC5558F40

Function 00007FF65DABB970 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_Byte_length.LIBCPMTD ref: 00007FF65DABB9F6

Part of subcall function 00007FF65DABBBF0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DABBC1C

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Byte_lengthConcurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 2180140624-0
Opcode ID: 4c1b483ce9ae656858f0bbe009e6f38eed582fb41a9c014dc9f6aa9f7ebd549b
Instruction ID: 18179249ba2746e94ce768aefc8f1f231464af9fe48210fda8e7a744f40654c0
Opcode Fuzzy Hash: 4c1b483ce9ae656858f0bbe009e6f38eed582fb41a9c014dc9f6aa9f7ebd549b
Instruction Fuzzy Hash: 0711E33252CA8582DA50DB65F49119BB7A0FBC5780F944122FACD93BA9EF3CC1558F40

Function 00007FF65DAA7E40 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAA7E74

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction ID: 1b49c8b0b8a57e537da39da087bd77e509266e261ee3cdb73a412222f1acbd13
Opcode Fuzzy Hash: 30fd8099ffd4be0d4f69dd9a583985dde0d8b0850e5991a20b1c7c05a0df383f
Instruction Fuzzy Hash: F111303660CB4181DA20DB55E04036FA7A0FBC8BD4F480236EA8D97BA5DF7CC5408B40

Function 00007FF65DAAF6A0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF65DAAF721

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID:
API String ID: 3713626258-0
Opcode ID: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction ID: 17fa20d4f650bd7091013af0b58dd41643f16cd8353992f8068264d224a7f12b
Opcode Fuzzy Hash: 76e54cbdeb55244470ca4b8c1149c975881fede5f5229d85922bdbd701fbbbd6
Instruction Fuzzy Hash: 1101097662CB8681DA409B56F45026BB3A1FB94BC0F046531FACE97B9AEF3CD4108B40

Function 000002B45B01ADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000002B45B01AE08

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: 63af64b95f8354db1188fb8acc2bcf24d36967ed0b76ebf4bd9d13a4df5cfae1
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: E701D665715F9486DB64DF1AF9C4219B3A0F798FD4F885131EF5E43B4ADB28C8518700

Function 00007FF65DAACD80 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65DAACDC2

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction ID: c5b1ece00b9deacfdede26ad4e2d92f70b4791e06237714886f741f84929bf55
Opcode Fuzzy Hash: 5b003b8cca513f1d9bd291702dbd346b7f7ce6d2eb4d71e1a0a6965b61c62195
Instruction Fuzzy Hash: CF01527661DF4681FA609B69E44031BA790FB88794F080331F69DD2BD5EF2CC1108704

Function 00007FF65DABC9F0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DABCA33

Part of subcall function 00007FF65DAAA910: allocator.LIBCONCRTD ref: 00007FF65DAAA92B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID:
API String ID: 1755220593-0
Opcode ID: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction ID: 4b40e2a2a55a1c35c50bf96bc857f2e34d634e6e64944b1433e0209c7e76c58f
Opcode Fuzzy Hash: 0be8727490954b9d9608c68c0c3e94e3c05ef35cc3da3c80f663008593293bb7
Instruction Fuzzy Hash: D8016036619F8482CA60DB4AF89011EB7A5F7C9B94F504225FACD83B29DF3CD5608B00

Function 000002B45AFD58F3 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000002B45AFD5936

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: 7cb7860f7884ad77fa6cfa782a466609da57f5fa957c8177a3a75ae0d9bdedaf
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: F3012126218E8081EA71DB52F89439A7360F798B94F804023CE9D43B59DF38C4868B00

Function 000002B45B02ED2C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002B45B02ED4B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction ID: 7381d8167b5021d2184cf4ec7a09e82dcca829297810e12b6853b4e342fe3d56
Opcode Fuzzy Hash: 8baf8acf487f5caa78a15ef12004ef049afcc069522c3c2ef46e844b516c0117
Instruction Fuzzy Hash: 8DE0EDB1215E4182EB313EA4E1C926CB2649B20FB0FD44721EA38062C7CB2484544320

Function 00007FF65DABBA40 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DABBA6A

Part of subcall function 00007FF65DAB7FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB80EF
Part of subcall function 00007FF65DAB7FD0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF65DAB8197

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 2443641946-0
Opcode ID: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction ID: c4282fc447f7a817080c12eab2803e1128d5117da5cc370b813f08e93633c295
Opcode Fuzzy Hash: a00cf0b1ec4db13d273557ccddcb421bc2b4e8bce47aca48317bcbe3f147d040
Instruction Fuzzy Hash: A1F0D47251CB8486D660DB55E44111FB7A0F7C8794F001225FACD93B69DF7CC1118F44

Function 00007FF65DAF5554 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65DAF5584

Part of subcall function 00007FF65DAF64DC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65DAF64E5

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction ID: ba3c96b7d235443a4e158041e1d04ab880a806c066c944591b94f815a9d651aa
Opcode Fuzzy Hash: eab2c86477353e2fdf37daf347e1d7af9a32534bc8376d8c7edc6a9f128f6aaa
Instruction Fuzzy Hash: EFE0EC64E0E10B06F92871E5E55527B01554F4C775E1C1BB0DA3EE92C7BD2CE4518750

Function 00007FF65DAAA910 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF65DAAA92B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction ID: 7412210b05be38f340f060614203fa1588c7ca427c491e68fe72048ba629956a
Opcode Fuzzy Hash: 69c9719d4dd52abe98a264028dc470e26ea7d52536d19f2f10ff87e1f9baad59
Instruction Fuzzy Hash: 45C0127AA29F85C1DA04EB12F48100E7760F7C8BC0F849421FA8E53729DF3CC0508B00

Function 000002B45B0597D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 000002B45B0597D4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: d3909a6f7473fb26ba17ba61e4194c6e9faed257e702729be9c5f7510ab7a166
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: F3C04C55F25D05C3EA743F725CCA2066394B776B00FC08061C60480161DB2C81D64B21

Function 000002B45B05B3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 000002B45B05B3CD

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: 50236484a74d86e247f9433f6490e9b191fb1e41e495d16555e94deb600eace4
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: 19B09266A14CC0C3C621FF04E88A00AB331F7A5B0CFE00000E68D42625CF2CDA2A8F00

Function 00007FF65DAE64BC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000028,00007FF65DAF5573,?,?,?,00007FF65DAA10A8), ref: 00007FF65DAE64FA

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction ID: b27495c76e1a6f0b5cbcb7fd140a993157ceede4120b12dac8756f44d6586a4e
Opcode Fuzzy Hash: 31f5e82480b86c694179d874989cf1b3d096565e770f3be7cb9178f83f4d8f72
Instruction Fuzzy Hash: C9F0F8A1F1D24745FAA45AE2EA1167B1190DF887B4F0C5F34D92EEA6C6FE2CE441C260

Function 000002B45B03DEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000002B45B03DF1A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction ID: 01748fda1233d7109772fabe201f4693b5217de915ef42afa614d5288abc362e
Opcode Fuzzy Hash: ad1b43cdb7c3550550fd4afa13c905d117ea5c1f34bfd66f5f885cc22fb7391c
Instruction Fuzzy Hash: 9BF0F895315B459BFA747FB158CE36973A05B64FA0F895B24DD2A862C3DB29C4428330

Function 00007FF65DAA26C0 Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF65DAA26F3

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction ID: 2cd59807b1326af8b35217ee7bb258e05b35bfdb9201b68ba8fd0359a75eae63
Opcode Fuzzy Hash: bb55d3c25760e0320b4c92f21841f287c01ac31988aa5e77e6438427710fe636
Instruction Fuzzy Hash: FAE0E576A1CB8586D7208B15F44031BBBB0F799784F204625EACC92B68EF7DC6A48F40

Non-executed Functions

Function 000002B45AFEC820 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFEDEA1
Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFEDF4F

Part of subcall function 000002B45AFCB930: __std_exception_copy.LIBVCRUNTIME ref: 000002B45AFCB973

Part of subcall function 000002B45B04F198: RtlPcToFileHeader.KERNEL32 ref: 000002B45B04F1E8
Part of subcall function 000002B45B04F198: RaiseException.KERNEL32 ref: 000002B45B04F229

Strings

quote was opened but not closed., xrefs: 000002B45AFEDDC6, 000002B45AFEDE3B
unexpected '}', xrefs: 000002B45AFEDF7C
No closed word, xrefs: 000002B45AFEDEA7, 000002B45AFEDECE
/, xrefs: 000002B45AFECB12
#base, xrefs: 000002B45AFED225
object is not closed with '}', xrefs: 000002B45AFEDD9F
Unexpected eof, xrefs: 000002B45AFEDD72
word wasnt properly ended, xrefs: 000002B45AFEDF55
unexpected key without object, xrefs: 000002B45AFEDE7A
", xrefs: 000002B45AFECD13
key declared, but no value, xrefs: 000002B45AFEDDED, 000002B45AFEDE14, 000002B45AFEDF01
*, xrefs: 000002B45AFECB3D
key opened, but never closed, xrefs: 000002B45AFEDF28
#include, xrefs: 000002B45AFED1F9

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 7b48c90d8c43a7aec6eacfb7e85ddc8044e99ba8f5cfae321a50a31fd03d40e1
Instruction ID: a0e6a380647ccc84d593f5562a392c188fe907ed2b3b9cd0aa778cb1cba7e58c
Opcode Fuzzy Hash: 7b48c90d8c43a7aec6eacfb7e85ddc8044e99ba8f5cfae321a50a31fd03d40e1
Instruction Fuzzy Hash: E6D26E62211EC48AEBB1AF25DCD83DC7361F765B98F844112DA6D0BB9ADF74C689C310

Function 00007FF65DAEFF2C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF65DAEFF7A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF05E6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF075C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF0A1A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF0C3A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF0E77
memcpy_s.LIBCPMT ref: 00007FF65DAF0F52
memcpy_s.LIBCPMT ref: 00007FF65DAF0FFD
memcpy_s.LIBCPMT ref: 00007FF65DAF10CC

Strings

1#INF, xrefs: 00007FF65DAF00A3
1#IND, xrefs: 00007FF65DAF0067
1#QNAN, xrefs: 00007FF65DAF0093
1#SNAN, xrefs: 00007FF65DAF008A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: f599b05029d98f237293d086c6c8cbc83094781c7e8eddfec9504f7173d138ad
Instruction ID: d11ed54f7f44f29dffccd25e1ac46e0bed348710c9e27e2260cbc79034cfe7a5
Opcode Fuzzy Hash: f599b05029d98f237293d086c6c8cbc83094781c7e8eddfec9504f7173d138ad
Instruction Fuzzy Hash: 5CB2B076A1C2838BE7648EA4D5407FE77A1FB54388F485175DA0DA7AC4EF38A980CB44

Function 000002B45B024740 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B0243F0: RtlAcquirePebLock.NTDLL ref: 000002B45B024433
Part of subcall function 000002B45B0243F0: NtAllocateVirtualMemory.NTDLL ref: 000002B45B02446B
Part of subcall function 000002B45B0243F0: lstrcpyW.KERNEL32 ref: 000002B45B0244CD
Part of subcall function 000002B45B0243F0: lstrcatW.KERNEL32 ref: 000002B45B024582

CoInitializeEx.OLE32 ref: 000002B45B0247AA
lstrcpyW.KERNEL32 ref: 000002B45B024989
lstrcatW.KERNEL32 ref: 000002B45B024B8E
CoGetObject.OLE32 ref: 000002B45B024BAC
lstrcpyW.KERNEL32 ref: 000002B45B025229
lstrcatW.KERNEL32 ref: 000002B45B02544C
CoGetObject.OLE32 ref: 000002B45B02546A
CoUninitialize.OLE32 ref: 000002B45B025932

Strings

0, xrefs: 000002B45B02506A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction ID: 68ecfd3b85505abf4caf09abc17c7cc9dda551a7a7fe355586482a1236718b52
Opcode Fuzzy Hash: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction Fuzzy Hash: D1B2963662AFC48AD7908F69E88165EB7B5F788B88F106215FECD57B18EB38C154C740

Function 00007FF65DAD2B97 Relevance: 12.0, Strings: 9, Instructions: 793COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF65DAD2D25
invalid distance code, xrefs: 00007FF65DAD34E4
invalid bit length repeat, xrefs: 00007FF65DAD2F9C
invalid literal/length code, xrefs: 00007FF65DAD3308
invalid distances set, xrefs: 00007FF65DAD30B5
invalid code -- missing end-of-block, xrefs: 00007FF65DAD2FC9
invalid literal/lengths set, xrefs: 00007FF65DAD303F
too many length or distance symbols, xrefs: 00007FF65DAD2D3E
invalid distance too far back, xrefs: 00007FF65DAD35AA

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 8dab440fc9059f63e4ec5b970c608ca424db9a839ae67d8aedf904f713204985
Instruction ID: 8971007fc597b51f9ec7e17ddecb7c58f5c1dc3927c4b0fb2c1dc6e98fdf051d
Opcode Fuzzy Hash: 8dab440fc9059f63e4ec5b970c608ca424db9a839ae67d8aedf904f713204985
Instruction Fuzzy Hash: 0A62D672A086A58BE7A49F55D598B7F37A9FB84340F194139EA4A937C0EF3CD844CB40

Function 00007FF65DAECE44 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

TranslateName.LIBCMT ref: 00007FF65DAECEAE
TranslateName.LIBCMT ref: 00007FF65DAECEE9
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF65DAE42C8), ref: 00007FF65DAECF30
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF65DAE42C8), ref: 00007FF65DAECF68
GetLocaleInfoW.KERNEL32 ref: 00007FF65DAED125

Strings

utf8, xrefs: 00007FF65DAED04C

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: f952dde8d3cd7788e963193f5ea5aa1e92811ebc708004aabb464cf43692a041
Instruction ID: adec365ec391a482dd494f217f625b20c9aceccbec9f11326c9bef5853f05f73
Opcode Fuzzy Hash: f952dde8d3cd7788e963193f5ea5aa1e92811ebc708004aabb464cf43692a041
Instruction Fuzzy Hash: A4916936A0D78385EB649BA1D4512BA63A4EB84B80F4C8131DA5DE7BC5FF3CE652C341

Function 00007FF65DAED88C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5CFD

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF65DAED9FC

Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5D2A
Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5D3B
Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5D4C

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF65DAE42C1), ref: 00007FF65DAED9E3
ProcessCodePage.LIBCMT ref: 00007FF65DAEDA26
IsValidCodePage.KERNEL32 ref: 00007FF65DAEDA38
IsValidLocale.KERNEL32 ref: 00007FF65DAEDA4E
GetLocaleInfoW.KERNEL32 ref: 00007FF65DAEDAAA
GetLocaleInfoW.KERNEL32 ref: 00007FF65DAEDAC6

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: c4ae29048c0868d5221bcf0fbd91c5e5467cd0d186a5bb531500621032177dec
Instruction ID: eee058a792879c7baa6a39cade7e605fbea87e2a5f0e0a11428777362954ef09
Opcode Fuzzy Hash: c4ae29048c0868d5221bcf0fbd91c5e5467cd0d186a5bb531500621032177dec
Instruction Fuzzy Hash: CE714472B1C6838AEF509BA1D8506BA23A0EB49B84F484535CA1DA7BD5FE3CE945C350

Function 000002B45B004710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B0048C4
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B0048D2
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B004B55
__std_exception_destroy.LIBVCRUNTIME ref: 000002B45B004B63

Strings

value, xrefs: 000002B45B0047EA, 000002B45B004A83

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: c4b045dfa08e55375005722c7c7c9c41e3914718ed03b793bcc59194146a9fc8
Instruction ID: 96b95737d23a63fe07c906d3f2dd9ee9308fecc8c1bd09f58cd9e3255eb15549
Opcode Fuzzy Hash: c4b045dfa08e55375005722c7c7c9c41e3914718ed03b793bcc59194146a9fc8
Instruction Fuzzy Hash: A40291A2614FC486EB60EF74D4C839D7761E7A5BA8F905206FA9D03ADBDF68C185C310

Function 00007FF65DAE1E68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF65DAE1EE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF65DAE1EF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF65DAE1F34
IsDebuggerPresent.KERNEL32 ref: 00007FF65DAE1F6D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF65DAE1F77
UnhandledExceptionFilter.KERNEL32 ref: 00007FF65DAE1F82

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ce7e3796c7a5bb2387eca005e84a3121ab51e1fc44c73afe5079a6031630cece
Instruction ID: 88335a506c8cbbda9e7a185aada0ef94b92fb62307c4f44b110ac0417974f62c
Opcode Fuzzy Hash: ce7e3796c7a5bb2387eca005e84a3121ab51e1fc44c73afe5079a6031630cece
Instruction Fuzzy Hash: 8931A43661CB8285DB60CF65E8402AE73A1FB89794F580136EA9D97B94FF3CD545CB00

Function 00007FF65DAC30B0 Relevance: 7.0, Strings: 5, Instructions: 719COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF65DAC3C7F
d, xrefs: 00007FF65DAC3B18
0, xrefs: 00007FF65DAC374E
d, xrefs: 00007FF65DAC35F5
0, xrefs: 00007FF65DAC36AD

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: 0$0$d$d$d
API String ID: 0-911316061
Opcode ID: be84b10c0d2d45635747b94c10be12c5baf49aa36d94cf40a0aca8293bbb7e80
Instruction ID: 278fff7eca451235277bd603b1f2ee0a55e909a47e57c7dcab3bf75ca9319ef0
Opcode Fuzzy Hash: be84b10c0d2d45635747b94c10be12c5baf49aa36d94cf40a0aca8293bbb7e80
Instruction Fuzzy Hash: D272057261C6818AE764CF59E4807ABB7A1E7C9754F144126EB8ED3BA8EF3DD4418F00

Function 000002B45B02B68A Relevance: 5.6, Strings: 4, Instructions: 563COMMON

Download Yara Rule

Strings

array, xrefs: 000002B45B02BDAE
object separator, xrefs: 000002B45B02BBD4, 000002B45B02BF1E
object, xrefs: 000002B45B02BE66
object key, xrefs: 000002B45B02BC80, 000002B45B02BFD6

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: array$object$object key$object separator
API String ID: 2453523683-2277530871
Opcode ID: 9c7edec81dc448aff70d24d02dc47a3d94d478b34c0c2cec5b208f141bd3f369
Instruction ID: 66d52867cedb64bf1cf6758f69be6d5b2d975fac8cb60c20a8e1b8190cc372f5
Opcode Fuzzy Hash: 9c7edec81dc448aff70d24d02dc47a3d94d478b34c0c2cec5b208f141bd3f369
Instruction Fuzzy Hash: 2A32C4A2624E8497EB21FF34C4D93ED7321F7A5B88FC01612EA494769BEF64C248C350

Function 00007FF65DAD22E8 Relevance: 5.5, Strings: 4, Instructions: 453COMMON

Download Yara Rule

Strings

, xrefs: 00007FF65DAD23D0
header crc mismatch, xrefs: 00007FF65DAD27B6
unknown header flags set, xrefs: 00007FF65DAD233C
unknown compression method, xrefs: 00007FF65DAD231A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 5fd275a1f547e5e5e246a265f17631c6e5570a77d34065937c2ebc4c447087f8
Instruction ID: 78de810c26844e333d65ecb89396b208cf121d2356ca0462426b7f05bdd91923
Opcode Fuzzy Hash: 5fd275a1f547e5e5e246a265f17631c6e5570a77d34065937c2ebc4c447087f8
Instruction Fuzzy Hash: 44126E72A1C3958AE7A5AF59C098A3B3AA9FF44744F194538DE49A63D0EF38E940C740

Function 000002B45B059480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 000002B45B0594A6
FormatMessageA.KERNEL32 ref: 000002B45B0594D9

Strings

!x-sys-default-locale, xrefs: 000002B45B059499

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction ID: bba02fc889fbac240660346eb714bb79d1334a1d76bd44eff3f6f6c4317b608d
Opcode Fuzzy Hash: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction Fuzzy Hash: B30180B2704B8083EB319F12B4D8B9AB7A2F3A6B84F948015DA4547FD6CB3CC944CB10

Function 00007FF65DAEFA90 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF65DAEFAF6
memcpy_s.LIBCPMT ref: 00007FF65DAEFB21

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 57a8bb62846f71c15516153ffb7b4828fa003a6834a4406426bc392e6d140f03
Instruction ID: c3715763196ab10f4bc035f2d9c35aa5d3e38f03309fb2794fdf9881a64f5fb2
Opcode Fuzzy Hash: 57a8bb62846f71c15516153ffb7b4828fa003a6834a4406426bc392e6d140f03
Instruction Fuzzy Hash: C8C1D272B1D68687EB248F59E08466AB791F784B84F588135DB4E93784EF3DE901CB40

Function 00007FF65DAED308 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5CFD

GetLocaleInfoW.KERNEL32 ref: 00007FF65DAED374

Part of subcall function 00007FF65DAF242C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF2449

GetLocaleInfoW.KERNEL32 ref: 00007FF65DAED3BD

Part of subcall function 00007FF65DAF242C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF24A2

GetLocaleInfoW.KERNEL32 ref: 00007FF65DAED485

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: ffb303f14084d201689acfaa42d903f902045a7f0c7723b67fadfb05f0f86b60
Instruction ID: 2a3d53b39be356d4c31bd5d87a632e6144b9e5379b20d5ae0d5f3ee96e859562
Opcode Fuzzy Hash: ffb303f14084d201689acfaa42d903f902045a7f0c7723b67fadfb05f0f86b60
Instruction Fuzzy Hash: 36617A72A0C6838AEB349F51E59026A73A1EB94744F488235CB9EE77D1EE7CE451C740

Function 000002B45B0106A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

port, xrefs: 000002B45B01135F
rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=, xrefs: 000002B45B010749
2OWqJZldB3s=, xrefs: 000002B45B0107D1

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: 2OWqJZldB3s=$port$rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=
API String ID: 0-1454942929
Opcode ID: a613ea9b7b2d786af87ad58c0f77c7aa6e012e41e5b18d5c1fc65e3f58f575f4
Instruction ID: 59d3ffc0f1b7145bffce24f18c5752d6b7658874f2a96aaca22537ec6e04a15d
Opcode Fuzzy Hash: a613ea9b7b2d786af87ad58c0f77c7aa6e012e41e5b18d5c1fc65e3f58f575f4
Instruction Fuzzy Hash: 2A726FA2629FC486D670DF25E88439EB3A4F7A9784F505216EBDD13B5AEF38C145CB00

Function 00007FF65DAC27B0 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

d, xrefs: 00007FF65DAC2E76
0, xrefs: 00007FF65DAC2BEC
0, xrefs: 00007FF65DAC2C8D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: 0$0$d
API String ID: 0-3608139397
Opcode ID: 5c76ddb99ef15a809886bb458ee614dacd124281dc7315fd32f47024dea49008
Instruction ID: f9cc7d4262425a1473f1ba14e48d6df463555d68cda8c89ae9d2e3bd98f1ea60
Opcode Fuzzy Hash: 5c76ddb99ef15a809886bb458ee614dacd124281dc7315fd32f47024dea49008
Instruction Fuzzy Hash: F932E57261D6818AE760CB59E0807AAB7A1F7C9754F144126FA8AD3BA8EF7CD445CF00

Function 00007FF65DAD8C30 Relevance: 4.2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF65DAD9139
invalid literal/length code, xrefs: 00007FF65DAD911C
invalid distance too far back, xrefs: 00007FF65DAD9156

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: e5486bf6340005e40ec32ce1de8edf0dcb03f50dc41d0fbeeae64139bd64bd70
Instruction ID: 5f51373bd7f8240769ee30afcbee11bfb6cb27e404d02c60485940403357a599
Opcode Fuzzy Hash: e5486bf6340005e40ec32ce1de8edf0dcb03f50dc41d0fbeeae64139bd64bd70
Instruction Fuzzy Hash: C5F1F772A0C69587DB589F65D45867E7BA2E785784F188139EE8E637C8EE3CD804CB00

Function 00007FF65DADA140 Relevance: 4.2, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF65DADA649
invalid literal/length code, xrefs: 00007FF65DADA62C
invalid distance too far back, xrefs: 00007FF65DADA666

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 7a605b2cea8ad5d7cbca8e7681ee519b81b1658c2b26500f27ae4b4ec54e850d
Instruction ID: 71cd8a53ae4b6ce68018876be5d910a079f3eaf5613d0270730d5971053fb7e0
Opcode Fuzzy Hash: 7a605b2cea8ad5d7cbca8e7681ee519b81b1658c2b26500f27ae4b4ec54e850d
Instruction Fuzzy Hash: F7F10472A0C69587DB58DBA5D05867E7BA2E795784F188139EE8E537CCEE3CD804CB00

Function 00007FF65DADCA20 Relevance: 4.0, Strings: 3, Instructions: 252COMMON

Download Yara Rule

Strings

, xrefs: 00007FF65DADCCD2
0, xrefs: 00007FF65DADCC42
@, xrefs: 00007FF65DADCB89

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: $0$@
API String ID: 0-2347541974
Opcode ID: eeca5f65d7def711a2938bc2b9d1f084d0224f6aa778e8f803134c364f27b88c
Instruction ID: 0a9b7ebf4c47764ab05ed7dee63a3bd2109b7f7f44d01f183a73861bfa2e5103
Opcode Fuzzy Hash: eeca5f65d7def711a2938bc2b9d1f084d0224f6aa778e8f803134c364f27b88c
Instruction Fuzzy Hash: 3FB1A6A7D28FC641F613873954439B5B311AFFF3D0A24A317FEE4B1652AB68A7818314

Function 000002B45B03E6F8 Relevance: 3.9, Strings: 3, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 000002B45B03E805
-, xrefs: 000002B45B03E857
gfff, xrefs: 000002B45B03E882

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: -$e+000$gfff
API String ID: 0-2620144452
Opcode ID: 98053ffb1976fa170abe9b1bb0e1772ad042855cb6c6921980abe163712f36bc
Instruction ID: 0c4dc4bd170f15a480d614930c465d07950b886733f151e9bb8b6b13a5b4e3ea
Opcode Fuzzy Hash: 98053ffb1976fa170abe9b1bb0e1772ad042855cb6c6921980abe163712f36bc
Instruction Fuzzy Hash: 115137A6B14BC487E7359F3598CC759BB91E364F94F88C321CBA84BAC6CB39C4458720

Function 000002B45AFE86D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFE8843

Strings

vector<bool> too long, xrefs: 000002B45AFE86D4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: vector<bool> too long
API String ID: 118556049-842332957
Opcode ID: 8742353623aa0bcf476d5af90a4760bc0d399eca5e91d255b6d5021fc072ca1c
Instruction ID: ded9270ee7f41df123c34463f5eee8de3f922f4944c3530c699106ac156e3925
Opcode Fuzzy Hash: 8742353623aa0bcf476d5af90a4760bc0d399eca5e91d255b6d5021fc072ca1c
Instruction Fuzzy Hash: 9CC1B463A14F8086EB60EF61E8843AD7760F3A9B98F505316EE6C13B9ADF34C595C740

Function 00007FF65DAE91E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF65DAE449A), ref: 00007FF65DAE9254

Strings

GetLocaleInfoEx, xrefs: 00007FF65DAE91FC, 00007FF65DAE920D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 9b4a3f26f7b91ef26a560136e31b55ba1280cb57d4f7cd41046f5acf592c097e
Instruction ID: 2bd85a38473b23c30a2a16f4891a11dd269941d24c69ee6408bb76c66f0b786d
Opcode Fuzzy Hash: 9b4a3f26f7b91ef26a560136e31b55ba1280cb57d4f7cd41046f5acf592c097e
Instruction Fuzzy Hash: 2B018F61B0CB8296EB449B96F5004A6A6A1EF8ABC0F5C4035DE4DA3B95EE3CD541C380

Function 000002B45B016760 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000002B45B0167C3
ShellExecuteW.SHELL32 ref: 000002B45B016E0A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 86a9b4c2f3dc006e725f547b657f6a5f358a7ccb74e6179ca8ceb939b538a3ee
Instruction ID: fabd13657d9cb067baf9f916e73c6497f49e732775cb2f665748c45492f0593f
Opcode Fuzzy Hash: 86a9b4c2f3dc006e725f547b657f6a5f358a7ccb74e6179ca8ceb939b538a3ee
Instruction Fuzzy Hash: 84122A72625FC48AEB50CF29E88469EB3A4F398B98F506215FEDD57B59EB38C150C700

Function 00007FF65DAE8758 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF65DAE89A7
RaiseException.KERNEL32 ref: 00007FF65DAE89B8

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a1839167aa180c42619ad643ddb8024cdd347c0831b0529f6c74a26638d682ba
Instruction ID: 4ffbbba684014d12ce0b287f50f85858741998d725f007f66170a6aac050b947
Opcode Fuzzy Hash: a1839167aa180c42619ad643ddb8024cdd347c0831b0529f6c74a26638d682ba
Instruction Fuzzy Hash: 8CB16B73A08B8A8BEB15CF39C84636D3BA0F784B88F198921DA5D937A4DF39D451C701

Function 000002B45B03F7F4 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002B45B03FA43
RaiseException.KERNEL32 ref: 000002B45B03FA54

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction ID: d7376968360aabfcd94cffd449941e796f78a5b5999e29440f54445773b45826
Opcode Fuzzy Hash: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction Fuzzy Hash: E4B13AB3600F888BE729DF29C4CA3587BA0F354F48F558916DA99877A5CB39C451C710

Function 000002B45B04A438 Relevance: 3.2, APIs: 2, Instructions: 208COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002B45B04A4DD
_invalid_parameter_noinfo.LIBCMT ref: 000002B45B04A69F

Part of subcall function 000002B45B03BBB8: HeapAlloc.KERNEL32 ref: 000002B45B03BC0D

Part of subcall function 000002B45B03B550: HeapFree.KERNEL32 ref: 000002B45B03B566
Part of subcall function 000002B45B03B550: GetLastError.KERNEL32 ref: 000002B45B03B570

Part of subcall function 000002B45B04BBA4: _invalid_parameter_noinfo.LIBCMT ref: 000002B45B04BBD7

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast_invalid_parameter_noinfo$AllocFree
String ID:
API String ID: 749460637-0
Opcode ID: e4bbda4b5f8ad799fda78e60f613521156d14bb6a0c8542167753a01ce82eeb7
Instruction ID: e3fbd2d1cb355ed6b9fe6c3a935d3c03b1f4687056689d292a727d3c078bb7b1
Opcode Fuzzy Hash: e4bbda4b5f8ad799fda78e60f613521156d14bb6a0c8542167753a01ce82eeb7
Instruction Fuzzy Hash: CF6128A2305B5143E731BF26A5C87AEB390BBA5FD0F849525EE4947B87EF38C4418720

Function 000002B45B020500 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 000002B45B020617
EnumDisplayDevicesW.USER32 ref: 000002B45B0206BB

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: 17dc533e7d739a7fa06aa4037ed2d653a9175fe6e40edbdbea4559ce57c4810f
Instruction ID: f05cba6c474ef0e19e135668cc6ba7decc45d1b0f79b1cb2cb7c90746a9bb32e
Opcode Fuzzy Hash: 17dc533e7d739a7fa06aa4037ed2d653a9175fe6e40edbdbea4559ce57c4810f
Instruction Fuzzy Hash: 4381E972614F8486E720DF21E88839EB7A4F398B98F505215EEDD17B99DF78C185C700

Function 00007FF65DAE6CD8 Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

e+000, xrefs: 00007FF65DAE6DE5
gfff, xrefs: 00007FF65DAE6E62

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: eae3eaedb716b390790cfcc6eb53f328968db58e854ae428f084f307bb2cca52
Instruction ID: d3ac159259fcdd1d39e6a3e39a8610c9dd411b35541ea545bdb87d31ae14e078
Opcode Fuzzy Hash: eae3eaedb716b390790cfcc6eb53f328968db58e854ae428f084f307bb2cca52
Instruction Fuzzy Hash: 4C517773B1C6C646E7248E75D84076AAB91E784B90F4C8A31CBAC8BAC5EF3DE404C700

Function 000002B45AFF55B0 Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45AFF562B

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f6da971f6ce2eaabb4101dd2515169c3aea2e8e18f56106eab667444c54b2b22
Instruction ID: afde3bb357f57aa09c8c80a3e6150fa3e0347cabfa963643a70039e48e23e47b
Opcode Fuzzy Hash: f6da971f6ce2eaabb4101dd2515169c3aea2e8e18f56106eab667444c54b2b22
Instruction Fuzzy Hash: CE028D63711F8486EB20EFA1E88839D73A1E358B98F948516DFAD1779ADF34C499C340

Function 00007FF65DAE9CD8 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF65DAE9E20

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: f303fb9edb89c9981dcaa8221041ff2017a834cce71cc05f93e29e86dd0c05cc
Instruction ID: 43c5471e085ee1afb8e90454f385e6b4c41ea3ade7d85e45010701c4c57b8898
Opcode Fuzzy Hash: f303fb9edb89c9981dcaa8221041ff2017a834cce71cc05f93e29e86dd0c05cc
Instruction Fuzzy Hash: AA128A32E0CBC286E751CF68D5452FA73A4FB58748F499235EB9D92696EF39E184C300

Function 00007FF65DAEA448 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25a4eb04e97a1cbd05bf3468fe75687d39b44580424cbd94dd95bbadaa425fa
Instruction ID: 9510ccf7b7204220aa24a8098c2f04cdd4e322aed239b4222dd5a4761ac8d416
Opcode Fuzzy Hash: f25a4eb04e97a1cbd05bf3468fe75687d39b44580424cbd94dd95bbadaa425fa
Instruction Fuzzy Hash: 86E13F36A09B8296E720DBA1E4402EE77A4F754788F444635DF8EA3B96FF38D645C340

Function 000002B45B0454E8 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d4f562fad0ae8194edac45898e7cb718dfe290c275f32723fdee9f334670f5
Instruction ID: d5f7f41e76167e464586ac4663839125cbee45fbb008b12bb9f4edafc9c64b0b
Opcode Fuzzy Hash: a1d4f562fad0ae8194edac45898e7cb718dfe290c275f32723fdee9f334670f5
Instruction Fuzzy Hash: 3FE13C72604F8486EB20EB61E4C56EE77A4F7A5B88F804626DF8D53B57EF78C2458310

Function 000002B45B00C600 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000002B45B00C929

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 257beddd28bebc82d33d810359b184e94764f3e42a1a45445a56447d9751d697
Instruction ID: f636e57c3dd5805b30dfc8b9f793dd171df7e67dc72ad1278f6c693d7bd13ba5
Opcode Fuzzy Hash: 257beddd28bebc82d33d810359b184e94764f3e42a1a45445a56447d9751d697
Instruction Fuzzy Hash: 22A18862A15F988AEB20CFA9D4C43AC77B0F369B58F948116DF8D57B56DB38C095C310

Function 00007FF65DAED550 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

Part of subcall function 00007FF65DAE5CB8: FlsSetValue.KERNEL32 ref: 00007FF65DAE5CFD

GetLocaleInfoW.KERNEL32 ref: 00007FF65DAED5B8

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1fc60497d60af84bc3a25616b2cbffb7f0d58d90d82e0e4919eba903a1a3e98e
Instruction ID: 23aad42b4a97313de6ed6381b0ac334baf7f99aaff07e2bbe4eb60d8842e4f2f
Opcode Fuzzy Hash: 1fc60497d60af84bc3a25616b2cbffb7f0d58d90d82e0e4919eba903a1a3e98e
Instruction Fuzzy Hash: 6C316932A1C68386EF649B66E4513AA63A1FB88784F488539DA4DE77D5EE3CE441C700

Function 000002B45B047620 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B0381FC: GetLastError.KERNEL32 ref: 000002B45B03820B
Part of subcall function 000002B45B0381FC: FlsGetValue.KERNEL32 ref: 000002B45B038220
Part of subcall function 000002B45B0381FC: SetLastError.KERNEL32 ref: 000002B45B0382AB

Part of subcall function 000002B45B0381FC: FlsSetValue.KERNEL32 ref: 000002B45B038241

GetLocaleInfoW.KERNEL32 ref: 000002B45B047688

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction ID: 515989f23e015225344d1d1408285f8c44a104c0b1161df5f13ad950a4b17492
Opcode Fuzzy Hash: 1d8e405bb44b78bdea7029598407ccfb6a808eb35fd889ed9364ebfb982fc4a2
Instruction Fuzzy Hash: BD3185B2300B8187EB74EF25E4C53AE73A2F7A9B84F848129DB5983297DF38D5558710

Function 00007FF65DAED1A0 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF65DAED98F,?,00000000,00000092,?,?,00000000,?,00007FF65DAE42C1), ref: 00007FF65DAED23E

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 381a7898935054535fb9b37bad717d8d2f933d4e212882dca7d474c99c627ba2
Instruction ID: f79507ba9c32d650075362b240272fda6da49111ba596b26a1d870977e4a6e19
Opcode Fuzzy Hash: 381a7898935054535fb9b37bad717d8d2f933d4e212882dca7d474c99c627ba2
Instruction Fuzzy Hash: 8911D273A0C6868AEF148F9AE0802A977A0FB90FA0F488135D669933C4EE28D5D1C740

Function 00007FF65DAED758 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

GetLocaleInfoW.KERNEL32(?,?,?,00007FF65DAED502), ref: 00007FF65DAED78F

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 453c54bd9860f3c2c2274d73c6c0209dd6e7591276c886d4b974ba9ca7b18a21
Instruction ID: 93ba756029f417e03108035ae2c84c061253a8f38d5b37eddc4e797fce72ceaa
Opcode Fuzzy Hash: 453c54bd9860f3c2c2274d73c6c0209dd6e7591276c886d4b974ba9ca7b18a21
Instruction Fuzzy Hash: C211E732B1C6A342EB748765E040A7F7261EB44764F584631D66DE77C4FF29D882C700

Function 000002B45B047828 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B0381FC: GetLastError.KERNEL32 ref: 000002B45B03820B
Part of subcall function 000002B45B0381FC: FlsGetValue.KERNEL32 ref: 000002B45B038220
Part of subcall function 000002B45B0381FC: SetLastError.KERNEL32 ref: 000002B45B0382AB

GetLocaleInfoW.KERNEL32 ref: 000002B45B04785F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction ID: 44570c5b64296dfb88045aa66dca0fef698239d7e54b0b272448ebb686b8c698
Opcode Fuzzy Hash: a206680715a2a1e8ed04527063a7d486e32d99efc1662854cd7c3fa16e13c692
Instruction Fuzzy Hash: F4118072710E5087E776AF25E0C877E7360E7A0F64F944625D765436C7D725C881C320

Function 00007FF65DAED270 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF65DAE5CB8: GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
Part of subcall function 00007FF65DAE5CB8: FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
Part of subcall function 00007FF65DAE5CB8: SetLastError.KERNEL32 ref: 00007FF65DAE5D67

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF65DAED94B,?,00000000,00000092,?,?,00000000,?,00007FF65DAE42C1), ref: 00007FF65DAED2EE

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: a8334e6b54be681260e95f2da46ab40b3b68223c67b0e278abaffbc4ce1ac67b
Instruction ID: e27d64f5a381fbb2ffb10466be62be96bc2f86063d0f35d652fc4a28823aa165
Opcode Fuzzy Hash: a8334e6b54be681260e95f2da46ab40b3b68223c67b0e278abaffbc4ce1ac67b
Instruction Fuzzy Hash: 0701B572E0C6C246EB504F95E4807BA76A1EB407A4F498231D669973C4EF79D481C701

Function 00007FF65DAE8E4C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF65DAE91AF,?,?,?,?,?,?,?,?,00000000,00007FF65DAEC7F0), ref: 00007FF65DAE8E9B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 22e6d56a2479983aa24c821f7915748be8a8f683883795b8a980db0dd1babcfa
Instruction ID: acc02e401316080099eb7c0bdcc107061f99399641e146d474e4340423b17a1b
Opcode Fuzzy Hash: 22e6d56a2479983aa24c821f7915748be8a8f683883795b8a980db0dd1babcfa
Instruction Fuzzy Hash: 97F01D75618A4183EB04DB59E9901A93362EB99780F585135DA4DE77A5EE3CD891C300

Function 000002B45B036718 Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002B45B03672C

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: aa8c88728e75ab677f25ee3ee359a5c354dffbd2d49f8684b78d8275cd561a6c
Instruction ID: ec953ba57492093afda0f1caa2970d35cb0f5f9b8e309eb14deee54ca2bad6b9
Opcode Fuzzy Hash: aa8c88728e75ab677f25ee3ee359a5c354dffbd2d49f8684b78d8275cd561a6c
Instruction Fuzzy Hash: 26F027E1B29B8803EE249B59A458394A392AB6CFF0F409321ED3D0E7CEFB1CC1108300

Function 00007FF65DAE6844 Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF65DAE6B86

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 7f8d784388c29e50a9ea76849624ee7fdd6d3f0132adaebc282318182cf08c6d
Instruction ID: 39a3e513324b582842435c4ba1f0a4243296ee02d980f3daf1700cdea514c2af
Opcode Fuzzy Hash: 7f8d784388c29e50a9ea76849624ee7fdd6d3f0132adaebc282318182cf08c6d
Instruction Fuzzy Hash: 4BA13772A0C78786EB21CF66E0507AA7BA1EB90B84F0C8931DA8D977C5EE3DD501C701

Function 00007FF65DAE02A8 Relevance: 1.5, Strings: 1, Instructions: 247COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FF65DAE0484

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d37ea77a3cce38cd321032bb1ff835da33d935561b5e8104ad0e6f6f8b8a62f8
Instruction ID: 6f1dd1d5c78b0adcb168493546e4a4d4e6b4a61e1198941d1a556942f3dd1e82
Opcode Fuzzy Hash: d37ea77a3cce38cd321032bb1ff835da33d935561b5e8104ad0e6f6f8b8a62f8
Instruction Fuzzy Hash: B0B18C7290C6478BE7648F69C09027E3BA0E749B48F6C5235CB8EA73D5EF29D481C758

Function 00007FF65DAF209C Relevance: 1.4, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF65DAF2141

Part of subcall function 00007FF65DAE5798: HeapAlloc.KERNEL32(?,?,00000000,00007FF65DAE5E92,?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028), ref: 00007FF65DAE57ED

Part of subcall function 00007FF65DAE5810: RtlFreeHeap.NTDLL(?,?,00007FF65DAE5929,00007FF65DAEACD6,?,?,?,00007FF65DAEB053,?,?,00000000,00007FF65DAEB9B9,?,?,?,00007FF65DAEB8EB), ref: 00007FF65DAE5826
Part of subcall function 00007FF65DAE5810: GetLastError.KERNEL32(?,?,00007FF65DAE5929,00007FF65DAEACD6,?,?,?,00007FF65DAEB053,?,?,00000000,00007FF65DAEB9B9,?,?,?,00007FF65DAEB8EB), ref: 00007FF65DAE5830

Part of subcall function 00007FF65DAF4700: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF4733

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 053a47b18b98772e483d4cb8cedf15fedaac31aca4fa50d076ed251903ccc722
Instruction ID: 71d4492d234b8caf95fc835ae2c57df78f45983d01cd8e2f9831e1a3e65a1d21
Opcode Fuzzy Hash: 053a47b18b98772e483d4cb8cedf15fedaac31aca4fa50d076ed251903ccc722
Instruction Fuzzy Hash: 6E41C135B0D24342FA605AA6B8517BBA690AF85BC0F885535EE4DEBBC5FE3DE401C704

Function 00007FF65DAB66E0 Relevance: 1.0, Instructions: 996COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a24e7cebadb25e1a1071a985e3153bb70c692dd492349961dac4431c1ac8243
Instruction ID: 5248fcc4f42f7d0c696c2ccaa3de6ebd7df7898b02fbff8892e1af9dcf9dfcfc
Opcode Fuzzy Hash: 9a24e7cebadb25e1a1071a985e3153bb70c692dd492349961dac4431c1ac8243
Instruction Fuzzy Hash: 24A28BF6304A4087DB08CA9DE0A572AB766E3C8B90F44513AE75B877E8DE7CD855CB04

Function 00007FF65DAB6730 Relevance: .9, Instructions: 934COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cca1694c4598a210c22f8f475ca8cb19f43e7237f1ec9f88dcea8dcebb1f8f2
Instruction ID: 7ac743e5503d2a92b98b510a331ecf86e1ec99fe0d106a191949e498180b5705
Opcode Fuzzy Hash: 3cca1694c4598a210c22f8f475ca8cb19f43e7237f1ec9f88dcea8dcebb1f8f2
Instruction Fuzzy Hash: 8F926AF5304A4087DB08CA9DE0A572AB766E3C8BA0F44513AE75B877E8DE7CD855CB04

Function 000002B45AFC5520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6968eee794167bb469fcde250685dac60b8ede26a19f14c3bf6bd3d26f4c9c17
Instruction ID: 2e68274a99639a6f9ef331e7a333c3922df3c96bf70003c32cf634336bc711b6
Opcode Fuzzy Hash: 6968eee794167bb469fcde250685dac60b8ede26a19f14c3bf6bd3d26f4c9c17
Instruction Fuzzy Hash: 2792C633915FC88AD7718F25E88129AB7A8F79D788F505315EACC26B59EB38C394C704

Function 00007FF65DAE23EC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c0cb83c689dd070a6176691960342bf1b6f8408e44a1f4b5d5845a74465e3e
Instruction ID: b2bd3a04df824c51bef88bbbc7c49f01b6b4fd864891bf1ead3ecf85d4c48a12
Opcode Fuzzy Hash: 84c0cb83c689dd070a6176691960342bf1b6f8408e44a1f4b5d5845a74465e3e
Instruction Fuzzy Hash: 3D4280A1D2DE56CAE6538B75E8125366726BF533C1F488337E80EB66D0FF6CA4429700

Function 00007FF65DAD81D0 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbc041faab4c4b85c301c09ae377af77968fd4b1b396d05bf3904191bd81879
Instruction ID: c98cf624a3f62063598f497691c03b8f4ae4139b322ff78dbee57c7126f36353
Opcode Fuzzy Hash: 0cbc041faab4c4b85c301c09ae377af77968fd4b1b396d05bf3904191bd81879
Instruction Fuzzy Hash: D012E2723101644BEA44DB6AE86C4BA37D2F79C78E7C56027FF894F389C62DA504D721

Function 00007FF65DAD4C30 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6634bdd44a1fa22541afa8fe710b752d6f9a0eae90cea3df49b852092a4059f
Instruction ID: 56e492d34d83cd3ad04823dffb711642d1afde9bfb8f7a99ba37b3156e315e97
Opcode Fuzzy Hash: b6634bdd44a1fa22541afa8fe710b752d6f9a0eae90cea3df49b852092a4059f
Instruction Fuzzy Hash: CA128032B1C2928BD7289B66D1406BAB7A1FB45781F484031EFCA977C4EF7DE5609B40

Function 00007FF65DAB39E0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642dc4f14b60206c0f6215a59d388f5b7023f11b53123760bd48b8ccc2892c3b
Instruction ID: bd7d978619a99140d843e33b321c662433c8e25bb82e66bfbe5c1d575e608d03
Opcode Fuzzy Hash: 642dc4f14b60206c0f6215a59d388f5b7023f11b53123760bd48b8ccc2892c3b
Instruction Fuzzy Hash: 5B22FA7261C2858FE364CA69E05076BBBE2E7C9304F148139F689D3AD9EE7DD9058F00

Function 000002B45AFF66A0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: 1c186ebfb3eaa5d73c9bb173b6358bd4323795fb0abdd67c885765b1a81bbc87
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 7DC13A73724AE487E766CF56D988669B762F3E4BD0F85C126DE5607B48DB38C806C700

Function 000002B45AFA6610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d27a1ba367a1fe37dc4cc43352571a4c841e483461c4efcd34cb87c067d70b
Instruction ID: 7a4f0b289321cd976b811bcc9bd312cf3906db64890af91e324fca5037b2e7d7
Opcode Fuzzy Hash: 21d27a1ba367a1fe37dc4cc43352571a4c841e483461c4efcd34cb87c067d70b
Instruction Fuzzy Hash: F312D632615FC88AD7718F29E88139AB3A4F79D788F505315EACC57B59EB38C294CB04

Function 00007FF65DAE07B4 Relevance: .3, Instructions: 327COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec41fcf7318b3fdb136675af6d95facf500f9601c2ec072af153a2977cac78c0
Instruction ID: 93cf32307b6ba14261a805429c84b131d62267fbd7924d5e9e987566c8fdbb59
Opcode Fuzzy Hash: ec41fcf7318b3fdb136675af6d95facf500f9601c2ec072af153a2977cac78c0
Instruction Fuzzy Hash: 70D18C32A0C64787EB688EA9C45027F36A0FB45B48F1C5235CE4DA76D5EF39E881C784

Function 000002B45AFC6510 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction ID: cb41dcdfd6754eb4b25f8c602775d244873544f39e667e3a7ebfd02d34734acc
Opcode Fuzzy Hash: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction Fuzzy Hash: 6D02D533915FC489D7628F39E8813D977A4F7AD788F505216EACC2AB59EBB4C294C700

Function 00007FF65DAE4110 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: ccdc4cc223566a9e700b4a92f04d3f31291b7a6cb77f8d2068ca2b5d0f3811b7
Instruction ID: bdd593684241ffb0b57da2e227379c144c7a8552ef7ccfd884317dceabd04712
Opcode Fuzzy Hash: ccdc4cc223566a9e700b4a92f04d3f31291b7a6cb77f8d2068ca2b5d0f3811b7
Instruction Fuzzy Hash: 37C18076A0C68386EB609BA2D4107BB27A8FB94788F484135DE4DE7AD5FE7CD545C300

Function 00007FF65DADC550 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f11c4fce7bcea95ba431acbf49a59f23e7ae597986c30c574894197be224cf
Instruction ID: e64b3d5a34581ec6cfe2bda67e52fae16c3b1852ea9dd3c64cfa9f5d2c5d5676
Opcode Fuzzy Hash: 46f11c4fce7bcea95ba431acbf49a59f23e7ae597986c30c574894197be224cf
Instruction Fuzzy Hash: 3BB1B5A6D28FC601F713873D90425B6F311AFFF790A69E323FDE470655AF54A2858214

Function 00007FF65DAEC8B4 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 016909b738e5124339fad153d3415a28628c645a638055c2929be9a92ab91f6c
Instruction ID: b0c7855da5f3becc6d77eb607d498e0bee640bd21dd70e5d1b3773ac8f9389c1
Opcode Fuzzy Hash: 016909b738e5124339fad153d3415a28628c645a638055c2929be9a92ab91f6c
Instruction Fuzzy Hash: A6B1AE72A1C64786FB64DFA1D4116BB33A1EB84B88F484231DA59E36C9EF3CE551C340

Function 00007FF65DB03DA0 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d98f4d47e0a857b1cf393355eb1c2583f24a2c3040599a4cd7810a84d3a9fbd0
Instruction ID: 7eb3038c82997bc8b98c66fd8ddd0724da0576ac784ae55527515f663e5a1f75
Opcode Fuzzy Hash: d98f4d47e0a857b1cf393355eb1c2583f24a2c3040599a4cd7810a84d3a9fbd0
Instruction Fuzzy Hash: 47818C72A08A1286EB64CF65D58537923A1FB49BD8F488636EF1EA77C5EF38D041C340

Function 00007FF65DAD9C10 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976ad66ee5da2cf88b50c9bfd367b15b8b9c24bdb5795f368fa9833ed7feb0ee
Instruction ID: 9802585bbfdc3ef51fc8efc97bc0b1a3a9f50d5be820b7f5ab635f46aa92953f
Opcode Fuzzy Hash: 976ad66ee5da2cf88b50c9bfd367b15b8b9c24bdb5795f368fa9833ed7feb0ee
Instruction Fuzzy Hash: 11712762E3C7C186E716473CA4022B29659AFE23C5F54E336FD8976AD6FF29D1428304

Function 00007FF65DAE7358 Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cc90599417af31cb42002b1ceffe57e88da7026f26894e3c97641a83985020
Instruction ID: 7b36f8dc2fc661f7a8f4a542091794a89a204936b15adb0523951ff99780b6fa
Opcode Fuzzy Hash: 47cc90599417af31cb42002b1ceffe57e88da7026f26894e3c97641a83985020
Instruction Fuzzy Hash: 9181D172A0C78286E7B5CB69E44037B6A90FB85794F584235DA9D97BD9EF3DD400CB00

Function 00007FF65DAD7F90 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fef933332038a432e0cbe0650c9c98f510f7709ea3c3125d6e13103ebde481
Instruction ID: 359714a3c5540f35ae249280453526515d971df120c9c3bb8e9754248fa8f856
Opcode Fuzzy Hash: e6fef933332038a432e0cbe0650c9c98f510f7709ea3c3125d6e13103ebde481
Instruction Fuzzy Hash: C251AEB2F580E10BDFAC433DE825B792DD58B86351B0DE039E595DAAD7F41E8102EB44

Function 00007FF65DADF9F0 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: c678604a09665d893db17abc06924f0136c12d30859298c7118cdda2201ffccc
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: D3516076A1CA9186E7249B69C05026F37A1EB85F58F2C4131CE4DA77E4EF3AED42C740

Function 00007FF65DADFBF4 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: d08763df0d1d8a151263bf085aacd3fa97fc4eaf288bb2e92563d19c53ed0433
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 3E515E76A1C69186E7649B69C04436B37A0EB45F5CF284131CE8DA77E4EF3AE852C740

Function 00007FF65DADF7EC Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: ec386a13e785900942d155f7ee10375b82891608f9f1e23501e05fd11e9d0ab9
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: C8516D76A1CA9186E7249F69C45022F27A0EB44F58F388131CE8DA77D4EF3AE843C740

Function 000002B45B0347FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 64f82886eca2d85151d2cbb8651f02fc40773a1e3a27425a90d8172860e72505
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: FD516FB6610F9087E7B49F29C0EC36C37A0E765F58F644112CA895B7A6CB36C853C750

Function 000002B45B0345F8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 4960e62522b2640823fa919b8e93c1502ab0880c871bd3480c1de69bb31778d5
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: A1515CB6220B508BE7B49F29D0CC32C37A1E765F98FA48111CA495B7A6D736DC92C790

Function 00007FF65DAF28CC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 252e97116b409d639cb7cf3346977e6c479a1c19db0d37f8eb51e4ebf816e3a9
Instruction ID: 01051376314da6946a13aa6316d2b2883568edbba79c6457a16e833798d33d33
Opcode Fuzzy Hash: 252e97116b409d639cb7cf3346977e6c479a1c19db0d37f8eb51e4ebf816e3a9
Instruction Fuzzy Hash: A341B136718A5582EF14CF6AD95416AA3A1BB48FD0B4D9132DE4DE7B98EE3DD0428300

Function 00007FF65DADCFA0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3993780a94f75fabcfaabf439322e03bb81cee0a4827234de154ef40bcba7dd
Instruction ID: 8fd2582d77e4524dcb802f1b60712f5e43f328399911e8dc1ef4bb959400d85d
Opcode Fuzzy Hash: e3993780a94f75fabcfaabf439322e03bb81cee0a4827234de154ef40bcba7dd
Instruction Fuzzy Hash: D231B9A6D1DB8945E6029B79A882235F3A1BFEF790F949321EDE4B0551EF2CE1444704

Function 00007FF65DADAF56 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e816ee9afbbd517afeac584de8933918a4fef5f7729cbd70fe33994d3c5995a
Instruction ID: 6a71deaa3dfd48c742c82e858d410b633aeb52c248df6d3020bf0b9936e1d616
Opcode Fuzzy Hash: 3e816ee9afbbd517afeac584de8933918a4fef5f7729cbd70fe33994d3c5995a
Instruction Fuzzy Hash: 032191D6C1DB8946E6029B3AA882126E361BFEF290F68D321EDF4B0451BF18B1844708

Function 00007FF65DADCEB2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c464e3852cc5915b9151c8cba22a9675c3ba6e6f19de27809d4dbd020f5729
Instruction ID: ea3edc2cbc89589900697401b981085a4987681036198d130a60e1c5e8e7fe06
Opcode Fuzzy Hash: 93c464e3852cc5915b9151c8cba22a9675c3ba6e6f19de27809d4dbd020f5729
Instruction Fuzzy Hash: 361182C6C5EB8D45EA039B3E9882060F261AFAB495E78D362EDF074161FF2571984318

Function 00007FF65DAE9AA0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e39b6c27bf28f0e056e49cbc12428bf1b6f050c7fc376ff2e6193081efeec9
Instruction ID: ea2d2968040bff0602adec8b941c94ea1a0dbf857e6791512397615ef3eee6d8
Opcode Fuzzy Hash: 31e39b6c27bf28f0e056e49cbc12428bf1b6f050c7fc376ff2e6193081efeec9
Instruction Fuzzy Hash: D5F0687172C2568BDB98CF28AD02A2977D0F708380F549239E58DC3B58EE3C90508F04

Function 000002B45B0726E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: c2ef8f188880444424d246751fccdef854ea8404f66adf137d4fd9589eb60a77
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: F3A01297708490CBF1130E10048D1443750E763A00BC98040C90002403C115040D8B10

Function 00007FF65DAA4C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAA4C1F
_Yarn.LIBCPMTD ref: 00007FF65DAA4C31
_Yarn.LIBCPMTD ref: 00007FF65DAA4C43
_Yarn.LIBCPMTD ref: 00007FF65DAA4C55
_Yarn.LIBCPMTD ref: 00007FF65DAA4C67
_Yarn.LIBCPMTD ref: 00007FF65DAA4C79
_Yarn.LIBCPMTD ref: 00007FF65DAA4C8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF65DAA4CA3

Part of subcall function 00007FF65DAFB954: _Yarn.LIBCPMT ref: 00007FF65DAFB982

Strings

bad locale name, xrefs: 00007FF65DAA4CAB

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: fdf93c7b3725d3de9480c70fc984c330f16ff8bafd09a5e6a50b7f6b76af3ea8
Instruction ID: 37f9dc133d86320fccafeb55f33347c9eba3b3f9cf265ac53a55d766018e91b6
Opcode Fuzzy Hash: fdf93c7b3725d3de9480c70fc984c330f16ff8bafd09a5e6a50b7f6b76af3ea8
Instruction Fuzzy Hash: C7112B65A0EB4642D900E7AAE48126FA370FFC7B84F580131EA8D637E7EE3DD4118B04

Function 00007FF65DAA35B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF65DAA35DB
RtlImageNtHeader.NTDLL ref: 00007FF65DAA3606

Strings

ntdll.dll, xrefs: 00007FF65DAA35D4
.mrdata, xrefs: 00007FF65DAA36DA
.data, xrefs: 00007FF65DAA35E6

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: HandleHeaderImageModule
String ID: .data$.mrdata$ntdll.dll
API String ID: 1307054163-825320017
Opcode ID: 540e6d451a2b33d2f7aa5391ba2a9d0ff351769d0afe938c76c5a5a31751ba7e
Instruction ID: a2300d8e8bb2a01f351a59dad3199995b664f97c194e46ccee351030974f53dd
Opcode Fuzzy Hash: 540e6d451a2b33d2f7aa5391ba2a9d0ff351769d0afe938c76c5a5a31751ba7e
Instruction Fuzzy Hash: CBA1DC3661DB8586E7A0CB95E44036BB7A4FB88794F544235EA8D97FA8EF3CD444CB00

Function 00007FF65DAE8EC8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF65DAE95D0,?,?,?,?,00007FF65DAEDBCD,?,?,?,?,00007FF65DAFB3F8), ref: 00007FF65DAE9044
GetProcAddress.KERNEL32(?,?,?,00007FF65DAE95D0,?,?,?,?,00007FF65DAEDBCD,?,?,?,?,00007FF65DAFB3F8), ref: 00007FF65DAE9050

Strings

ext-ms-, xrefs: 00007FF65DAE8FA1
api-ms-, xrefs: 00007FF65DAE8F8E

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 88c23d9036aded5f7076838acfe0058b8650966d7edef86c05992df23181fc12
Instruction ID: 9f2ca2cedf03bb2372a0a3472ab146f93bf2e31cd98589d34ef9c643dec4e02f
Opcode Fuzzy Hash: 88c23d9036aded5f7076838acfe0058b8650966d7edef86c05992df23181fc12
Instruction Fuzzy Hash: 8641CD31B1DA1382EA168BA6E8205666296FF45B90F4C4235DD0EE77D4FE3CE846C304

Function 00007FF65DAE146C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAE14AF
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAE189C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAE1B38

Strings

f, xrefs: 00007FF65DAE15D1
p, xrefs: 00007FF65DAE1561
p, xrefs: 00007FF65DAE15D9

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 35f128cec712ba658e9c7200868182dc03db665a37542de7a91c1d423a514665
Instruction ID: 62dee26a5da47410903a0587ceabab3b50252b9e6fdedd3f6c1e6ab03902ebd4
Opcode Fuzzy Hash: 35f128cec712ba658e9c7200868182dc03db665a37542de7a91c1d423a514665
Instruction Fuzzy Hash: 6912A332E0E16386FB249B99E0546BB76A1FB50750F8C4535D68AAB6C4FF3CE580CB50

Function 00007FF65DAF35B8 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAF39E5

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2111bb826fba5276a3a9dd84415bba117cbc3f7a0067bdd87d396387dbaf4657
Instruction ID: 56911e02b8d757e570b20239fd551ae9e4a8452c09b9ecc58bb6238f12e756b7
Opcode Fuzzy Hash: 2111bb826fba5276a3a9dd84415bba117cbc3f7a0067bdd87d396387dbaf4657
Instruction Fuzzy Hash: 93C1CE3AA0C68791E7609B95D4502BF7BA1EF80B90F5D4175EA8EA33D1EE7CE845C340

Function 00007FF65DABEFC0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABF011

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF65DABF334
+, xrefs: 00007FF65DABF0AE
4, xrefs: 00007FF65DABEFE9
4, xrefs: 00007FF65DABF30A
d, xrefs: 00007FF65DABF0CC

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz$4$4$d
API String ID: 3999070443-264949567
Opcode ID: 1743ddae81d6ea49377a863fa6a1ec82f2316a6d258534a902e75a0a57e9bff6
Instruction ID: 98b75065802334ff474cf0cba41dae0565995ef31ed08951a6af37799e63ad17
Opcode Fuzzy Hash: 1743ddae81d6ea49377a863fa6a1ec82f2316a6d258534a902e75a0a57e9bff6
Instruction Fuzzy Hash: 5EC1B63250DBC88ADAA1CB59F4803AAB7A0F799790F144125EADD83B98DF7DD495CF00

Function 00007FF65DAFAF88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF65DAFB18F,?,?,00000000,00007FF65DAF7CE2,?,?,?,00007FF65DB074ED), ref: 00007FF65DAFB00D
GetLastError.KERNEL32(?,?,?,00007FF65DAFB18F,?,?,00000000,00007FF65DAF7CE2,?,?,?,00007FF65DB074ED), ref: 00007FF65DAFB01B
LoadLibraryExW.KERNEL32(?,?,?,00007FF65DAFB18F,?,?,00000000,00007FF65DAF7CE2,?,?,?,00007FF65DB074ED), ref: 00007FF65DAFB045
FreeLibrary.KERNEL32(?,?,?,00007FF65DAFB18F,?,?,00000000,00007FF65DAF7CE2,?,?,?,00007FF65DB074ED), ref: 00007FF65DAFB0B3
GetProcAddress.KERNEL32(?,?,?,00007FF65DAFB18F,?,?,00000000,00007FF65DAF7CE2,?,?,?,00007FF65DB074ED), ref: 00007FF65DAFB0BF

Strings

api-ms-, xrefs: 00007FF65DAFB02D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 0d0ac073453aeb45f407a3059d888d0c76c4a1015270bd98423673d19d5896fd
Instruction ID: d96bfd578e67a2803d3fb7711c6c22a08e10cb8069581b40f11fd6cfd2fe3838
Opcode Fuzzy Hash: 0d0ac073453aeb45f407a3059d888d0c76c4a1015270bd98423673d19d5896fd
Instruction Fuzzy Hash: B631AF35A1E64391EE12DB96E40057663A8FF49BA2F4D4535DD2EAA3D4FF3CE4458300

Function 00007FF65DAE5CB8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF65DAE5CC7
FlsGetValue.KERNEL32 ref: 00007FF65DAE5CDC
FlsSetValue.KERNEL32 ref: 00007FF65DAE5CFD
FlsSetValue.KERNEL32 ref: 00007FF65DAE5D2A
FlsSetValue.KERNEL32 ref: 00007FF65DAE5D3B
FlsSetValue.KERNEL32 ref: 00007FF65DAE5D4C
SetLastError.KERNEL32 ref: 00007FF65DAE5D67

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0e9a261044974c98fe15c55c3d55f2b3032747381efac69e6f322ca96625eeb5
Instruction ID: 2314e5f24246a043fe5ad3e4e46c78a96d1e95d4fd6e994af9142f80b584ec69
Opcode Fuzzy Hash: 0e9a261044974c98fe15c55c3d55f2b3032747381efac69e6f322ca96625eeb5
Instruction Fuzzy Hash: FB213331A0D64382FA58A7A1E69917B5292DF487B1F5C4B34D83EE76D6FD6CA441C300

Function 00007FF65DAF49EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF65DAF4A1D
GetLastError.KERNEL32 ref: 00007FF65DAF4A29
CloseHandle.KERNEL32 ref: 00007FF65DAF4A41
CreateFileW.KERNEL32 ref: 00007FF65DAF4A6C
WriteConsoleW.KERNEL32 ref: 00007FF65DAF4A8B

Strings

CONOUT$, xrefs: 00007FF65DAF4A4D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 143c3a3f26d5e4478db14557210d9b5f5d56c35c52044c9f27410f3b50e0fd75
Instruction ID: ab5cb33af55143b5d6541480db6f498496cdf465681d3cee18e7f7d94b58f43c
Opcode Fuzzy Hash: 143c3a3f26d5e4478db14557210d9b5f5d56c35c52044c9f27410f3b50e0fd75
Instruction Fuzzy Hash: 6C118131A1CA4286E3508B52E84432966A1FB89BE5F084334EA5DD7BE4EF7CD4048748

Function 000002B45B04ABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002B45B04AC0D
GetLastError.KERNEL32 ref: 000002B45B04AC19
CloseHandle.KERNEL32 ref: 000002B45B04AC31
CreateFileW.KERNEL32 ref: 000002B45B04AC5C
WriteConsoleW.KERNEL32 ref: 000002B45B04AC7B

Strings

CONOUT$, xrefs: 000002B45B04AC3D

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: 52b299079e7f16a9a8dbc5feeec645d1a0ce3a0c9ebbba2a93009756f8e8dc68
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: BA11B2B1310E8087E760AF46E8D9319B3A0F3A9FE4F804214EE59877A6CF38C4448754

Function 000002B45B05B73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000002B45B05B7E9
MultiByteToWideChar.KERNEL32 ref: 000002B45B05B885
MultiByteToWideChar.KERNEL32 ref: 000002B45B05B92E
MultiByteToWideChar.KERNEL32 ref: 000002B45B05B958
MultiByteToWideChar.KERNEL32 ref: 000002B45B05BA00
CompareStringEx.KERNEL32 ref: 000002B45B05BA4D

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction ID: 677e07d4cc42b4587d9997673bbaed013b894ebefe6bcbd0474957d013e9d29a
Opcode Fuzzy Hash: ab7e75f2883cad40e90fab743296f144bd79ee85a7c99ab5de0f741cdd8f7a66
Instruction Fuzzy Hash: 22A18FA2600B808BEB31BF2594D83A97791F767FA8F948611DA5807FC6DB38D845C360

Function 00007FF65DAC8020 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 458COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF65DAC8088
&, xrefs: 00007FF65DAC80CE
nan, xrefs: 00007FF65DAC824A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 07c1dcf7fe85bbc1e067f6de4f926c6fb306207c60ad19f74a8bddca7f9c4e8f
Instruction ID: 9438f3137c88bab6173d8e0a5b6bb4d98b29d5b1dfcf339815f5380f5939b35e
Opcode Fuzzy Hash: 07c1dcf7fe85bbc1e067f6de4f926c6fb306207c60ad19f74a8bddca7f9c4e8f
Instruction Fuzzy Hash: 6E42D23260CAC689D6B18B65E4903EFB7A4F788750F484126DACD93BA9EF3CD544CB41

Function 00007FF65DAC9120 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 457COMMON

Download Yara Rule

Strings

e, xrefs: 00007FF65DAC9188
nan, xrefs: 00007FF65DAC934A
&, xrefs: 00007FF65DAC91CE

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 7952403a15a35431d6767a2053f8123c38403e361d52805be08b9de745fd9cb8
Instruction ID: b93df914376a4440eee966921ec834dc8c2fa51014f5532fff85399c5bd2520f
Opcode Fuzzy Hash: 7952403a15a35431d6767a2053f8123c38403e361d52805be08b9de745fd9cb8
Instruction Fuzzy Hash: 8142D23260CAC689D6B18B55E4903EFB7A4F788790F484126DACD93BA9EF3CD545CB40

Function 00007FF65DAC9C20 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 457COMMON

Download Yara Rule

Strings

&, xrefs: 00007FF65DAC9CCE
e, xrefs: 00007FF65DAC9C88
nan, xrefs: 00007FF65DAC9E4A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID:
String ID: &$e$nan
API String ID: 0-1192993855
Opcode ID: 5bed7973e5487bab54717232cb26603583bcbfed259e19c44ec6817ed4f113ea
Instruction ID: ac764afc0b36f36b175057727fce5dd37357e381d080e6085a82fe5dbb788ec9
Opcode Fuzzy Hash: 5bed7973e5487bab54717232cb26603583bcbfed259e19c44ec6817ed4f113ea
Instruction Fuzzy Hash: 3A42E23260DAC589D6B1CA55E4903EFB7A4F788790F488126DACD93BA9EF3CD544CB40

Function 00007FF65DAFD26C Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF65DAFD2DC
MultiByteToWideChar.KERNEL32 ref: 00007FF65DAFD37A
LCMapStringEx.KERNEL32 ref: 00007FF65DAFD3E3
LCMapStringEx.KERNEL32 ref: 00007FF65DAFD435
LCMapStringEx.KERNEL32 ref: 00007FF65DAFD4DA
WideCharToMultiByte.KERNEL32 ref: 00007FF65DAFD534

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 2b2fdd1503a79b380a1020f4e969409d4e922ebcf1c0befb99e6f4eb1a253c2d
Instruction ID: 894d4a16f413ea34c0fb5dc9366c88022ecd75088a1ea828024527664fff4edf
Opcode Fuzzy Hash: 2b2fdd1503a79b380a1020f4e969409d4e922ebcf1c0befb99e6f4eb1a253c2d
Instruction Fuzzy Hash: FE819176A0C78286EF218F55E44026A77A6FF847E8F184631EA5DA7BD8EF7CD4048700

Function 00007FF65DAE5E30 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5E3F
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5E75
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5EA2
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5EB3
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5EC4
SetLastError.KERNEL32(?,?,?,00007FF65DAE5929,?,?,?,?,00007FF65DAE650C,?,?,00000028,00007FF65DAF5573), ref: 00007FF65DAE5EDF

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: cf8115dcaa5ee2122fb104c4df6f54fc23ab72e4ca67caacefd1d5263795953b
Instruction ID: fb2b475b3a04523d58b21762734a3e72a0ecd82395095a8ad8b795fce27db7ff
Opcode Fuzzy Hash: cf8115dcaa5ee2122fb104c4df6f54fc23ab72e4ca67caacefd1d5263795953b
Instruction Fuzzy Hash: 74112130E0C64382FA5893B1E65517A6292DF487B1F5C4734D83EE76D6FE6CA401C700

Function 00007FF65DABDB90 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABDBC8

Strings

o, xrefs: 00007FF65DABDDF2
e, xrefs: 00007FF65DABDF5E
u, xrefs: 00007FF65DABDDDC
%, xrefs: 00007FF65DABDDE7

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: %$e$o$u
API String ID: 1853752696-1884988985
Opcode ID: 5fa3bfed00eb7f098b7cf37669c34e1e722c137927b02883ea76b391b0f2ab52
Instruction ID: b195c239a885ab89eaa92fd8a54aa73302bf9a26f2c518aab3f58562f3dbc26e
Opcode Fuzzy Hash: 5fa3bfed00eb7f098b7cf37669c34e1e722c137927b02883ea76b391b0f2ab52
Instruction Fuzzy Hash: 9CE1E63260CBC985DA61CB55E4903EBB7A0F788784F544126EA8E93BA9EF7CD445CB40

Function 00007FF65DAC8B30 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 260COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF65DAC8CB3
_Mpunct.LIBCPMTD ref: 00007FF65DAC8E3F

Strings

0, xrefs: 00007FF65DAC8FAD
., xrefs: 00007FF65DAC8F49
0, xrefs: 00007FF65DAC8BB8

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Mpunct
String ID: .$0$0
API String ID: 4240859931-1691970187
Opcode ID: e9687b47ea457237dee4bdc78be1e40fba84c5c64e038008681aa2fe3be40f6b
Instruction ID: c7354dcd0fbfc549f8ab5ce590375d9ba5b6e890a7f94dc3de7a52f46370d98a
Opcode Fuzzy Hash: e9687b47ea457237dee4bdc78be1e40fba84c5c64e038008681aa2fe3be40f6b
Instruction Fuzzy Hash: D0D1BA36609BC995DA61DB5AE4902EEB760F7C8B94F448022DF8D93B69EF3CC545CB00

Function 00007FF65DAA2020 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF65DAA23D2

Part of subcall function 00007FF65DAA66C0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAA66DD

Strings

rax, xrefs: 00007FF65DAA21A3
eax, xrefs: 00007FF65DAA21F6
ebx, xrefs: 00007FF65DAA20A8
rbx, xrefs: 00007FF65DAA2070

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
String ID: eax$ebx$rax$rbx
API String ID: 1755220593-2388916327
Opcode ID: c01962a9961ff03dcf299c024bebee3a4452aa249518325b59cd457b6bb118a3
Instruction ID: 47822a600442ffcb3289624f9bdeb930d0311e8d43aeb4da9f200c4fd810a56f
Opcode Fuzzy Hash: c01962a9961ff03dcf299c024bebee3a4452aa249518325b59cd457b6bb118a3
Instruction Fuzzy Hash: E6D1F06791CBC189E321CF78DC413E977A1FBAA748F045325EAC896E5AEF789244C341

Function 00007FF65DABB1E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABB22E

Strings

inf, xrefs: 00007FF65DABB35F
nan, xrefs: 00007FF65DABB3C1
nan(snan), xrefs: 00007FF65DABB3D8
nan(ind), xrefs: 00007FF65DABB390

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: e246f93cfd8b01a24d44e219b48bef0b546a2f143c45bedcdc11885149c42856
Instruction ID: c8f850370739ffd281934bdd4ee8b131563af24ae47124983702f3adb0923ed7
Opcode Fuzzy Hash: e246f93cfd8b01a24d44e219b48bef0b546a2f143c45bedcdc11885149c42856
Instruction Fuzzy Hash: 56A1EE3661DBC585EA70CB55E8903ABA7A0F784790F544236EA8E93BD8EF3CD445CB00

Function 00007FF65DABD630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABD656

Strings

1, xrefs: 00007FF65DABD74D
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF65DABD862
4, xrefs: 00007FF65DABD838
0p+0, xrefs: 00007FF65DABD66C

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: 0123456789abcdefghijklmnopqrstuvwxyz$0p+0$1$4
API String ID: 3999070443-1197085086
Opcode ID: 22605e3e1ccf5c9f3454907df50a8bf921d3aa5bdd4aa9ee1894e77eaf097de2
Instruction ID: 0a67ff6f6efbcef700ff56e6e98e9c8db7b96b084c9c0536c413fcc4ea0fe6d9
Opcode Fuzzy Hash: 22605e3e1ccf5c9f3454907df50a8bf921d3aa5bdd4aa9ee1894e77eaf097de2
Instruction Fuzzy Hash: B5A1973650DBC885EBA0CB59F4903AAB7A5F384B94F144125EA8E87BA8DF7CD445CB01

Function 00007FF65DABAE00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABAE4E

Strings

nan, xrefs: 00007FF65DABAF8F
nan(snan), xrefs: 00007FF65DABAFA6
nan(ind), xrefs: 00007FF65DABAF6B
inf, xrefs: 00007FF65DABAF41

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: 464d97ded6cad5ea3cc5b8df829cfb978308b82cca82f5cc6969c81aa40300fb
Instruction ID: 2ae1b2dc6b0fbca20dee3092c1ac2c4fea229bfb2ce88b0f8abbdd1e7b1621b5
Opcode Fuzzy Hash: 464d97ded6cad5ea3cc5b8df829cfb978308b82cca82f5cc6969c81aa40300fb
Instruction Fuzzy Hash: CAA1C63650DAC585EBB0CB55E8807AAB7A0F789780F549126EA8D93BD8EF7CD445CB00

Function 00007FF65DABAAC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABAB0B

Strings

nan(snan), xrefs: 00007FF65DABACA0
nan, xrefs: 00007FF65DABAC89
nan(ind), xrefs: 00007FF65DABAC58
inf, xrefs: 00007FF65DABAC27

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: d5b88743fa5b3b07afb4db1eeea1c002ad18bbf23253e37765dc3445f34048a6
Instruction ID: 97bd43ca5d78057b21b47d27875ef8e6510a7e6a47b95a5e854eb2884ee3c3f4
Opcode Fuzzy Hash: d5b88743fa5b3b07afb4db1eeea1c002ad18bbf23253e37765dc3445f34048a6
Instruction Fuzzy Hash: 0481F83260CBC985EAA0CB55E49036BB7A0FB85790F544126EACE87BD8EF7CD445CB01

Function 00007FF65DABA7D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABA81B

Strings

nan(ind), xrefs: 00007FF65DABA91F
inf, xrefs: 00007FF65DABA8F5
nan, xrefs: 00007FF65DABA943
nan(snan), xrefs: 00007FF65DABA95A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: 72cc235c785df8f3571cec6a84209a645bb403642a45b9f3071a678ad278a7e8
Instruction ID: 9baa855f2580392f272f004e1ff1e814eb75abc5805378c8693f18cf7adc7563
Opcode Fuzzy Hash: 72cc235c785df8f3571cec6a84209a645bb403642a45b9f3071a678ad278a7e8
Instruction Fuzzy Hash: 4471D73261CBC989EA60CB55E4803ABB7A1F785780F545026EACE93BD8EF7CD445CB01

Function 00007FF65DABA4E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABA528

Strings

inf, xrefs: 00007FF65DABA644
nan(snan), xrefs: 00007FF65DABA6BD
nan, xrefs: 00007FF65DABA6A6
nan(ind), xrefs: 00007FF65DABA675

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 3999070443-3276396208
Opcode ID: 70d59d2c9d76d07b0f33b11adfc2aa066c03e6bbcb9822e25dfa6d8139c5e202
Instruction ID: b5cc66946c1446ffbd30597f4b50740d000f154c3fd98c4d32841d8523531c0d
Opcode Fuzzy Hash: 70d59d2c9d76d07b0f33b11adfc2aa066c03e6bbcb9822e25dfa6d8139c5e202
Instruction Fuzzy Hash: 7071083660CBC989EA60CB56E49036AB7A0F785794F544136EACE87BD9EF7CD444CB00

Function 00007FF65DABA250 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABA298

Strings

nan(snan), xrefs: 00007FF65DABA3D7
nan, xrefs: 00007FF65DABA3C0
inf, xrefs: 00007FF65DABA372
nan(ind), xrefs: 00007FF65DABA39C

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: inf$nan$nan(ind)$nan(snan)
API String ID: 1853752696-3276396208
Opcode ID: d5adf79395b74f9d5280ca903bbc3249ff26270c4855bacc272925e682a68ccf
Instruction ID: 8741f7ad5f8ec45d0303005a1b3e942cb169e041badb80cda345c21dc46a13c5
Opcode Fuzzy Hash: d5adf79395b74f9d5280ca903bbc3249ff26270c4855bacc272925e682a68ccf
Instruction Fuzzy Hash: F861F43660CBC589EB60CB55F4803AAB7A0F785784F545026EACE97BA9EF7CD445CB00

Function 00007FF65DAC75D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00007FF65DAC760E
std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAC76FD

Strings

Invalid format string., xrefs: 00007FF65DAC761E
^, xrefs: 00007FF65DAC7679
invalid fill character '{', xrefs: 00007FF65DAC76C3

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fac_nodeFac_node::_allocatorstd::_
String ID: Invalid format string.$^$invalid fill character '{'
API String ID: 598859312-3800272876
Opcode ID: ad42ce789a6cde225e893fa38872b060042fd1935f330b2a9c7aacee0af1ed30
Instruction ID: 939b06d93da4e0de27adb10d7149942d3e4301e8ae439ed05ae191a6f142d32b
Opcode Fuzzy Hash: ad42ce789a6cde225e893fa38872b060042fd1935f330b2a9c7aacee0af1ed30
Instruction Fuzzy Hash: 28414D3250DBC5C9E6718B69E48036BABA0F7C9794F580535E6CD93BEAEF6CD5408B00

Function 00007FF65DAEDE14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF65DAEDE39
GetProcAddress.KERNEL32 ref: 00007FF65DAEDE4F
FreeLibrary.KERNEL32 ref: 00007FF65DAEDE76

Strings

CorExitProcess, xrefs: 00007FF65DAEDE48
mscoree.dll, xrefs: 00007FF65DAEDE30

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b098b623c8c7801e5285911e96efcdbd3b420d839b436883500a26a7c39cdebe
Instruction ID: 38fb13b3e1c61dae4d47f3971997bfecf6776d3a3e40a085466924d655124d69
Opcode Fuzzy Hash: b098b623c8c7801e5285911e96efcdbd3b420d839b436883500a26a7c39cdebe
Instruction Fuzzy Hash: 27F04FA5A1C70681FB148B64E45977A6331EF4ABA1F581235D56E953E4EF3CD448C304

Function 00007FF65DAE843C Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF65DAE847B
_set_statfp.LIBCMT ref: 00007FF65DAE8499
_set_statfp.LIBCMT ref: 00007FF65DAE84C2
_set_statfp.LIBCMT ref: 00007FF65DAE86FE

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7ad41c2085167253e11841c847abdc28045ab084f43f852668cbe7a267bd0bec
Instruction ID: ea1d444913ca433d2c28d3bae6d9075e335e5e82c44c6ad4990970ddbf98c63b
Opcode Fuzzy Hash: 7ad41c2085167253e11841c847abdc28045ab084f43f852668cbe7a267bd0bec
Instruction Fuzzy Hash: B981D33290CA4786F2628B74E45037B6290EF95394F4C4331EA5EB65E4FF3CE581CA42

Function 000002B45B03F4D8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002B45B03F517
_set_statfp.LIBCMT ref: 000002B45B03F535
_set_statfp.LIBCMT ref: 000002B45B03F55E
_set_statfp.LIBCMT ref: 000002B45B03F79A

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction ID: 84439160ae124d16e19204596b86a7647767b7574a3107cdea8b086ddf9b555a
Opcode Fuzzy Hash: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction Fuzzy Hash: BE81E492110F4487F272AF35A5CD3AEB7A0BB75F98F948301EE56265E7D738C5818720

Function 00007FF65DAE9894 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF65DAE98BC
_set_statfp.LIBCMT ref: 00007FF65DAE98D7
_set_statfp.LIBCMT ref: 00007FF65DAE98F3
_set_statfp.LIBCMT ref: 00007FF65DAE992F

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: 8352b962427c41793df8e95d872f700ea66510ba0897b7e4bc65961b26b384b5
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: AB118F32E1CB0381FA9512B9D99137B1141EFA4364F1D0634EAAEA76F6AF1CA941C101

Function 00007FF65DAE5EF8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF65DAE1DF7,?,?,00000000,00007FF65DAE2092,?,?,?,?,?,00007FF65DAE201E), ref: 00007FF65DAE5F17
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE1DF7,?,?,00000000,00007FF65DAE2092,?,?,?,?,?,00007FF65DAE201E), ref: 00007FF65DAE5F36
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE1DF7,?,?,00000000,00007FF65DAE2092,?,?,?,?,?,00007FF65DAE201E), ref: 00007FF65DAE5F5E
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE1DF7,?,?,00000000,00007FF65DAE2092,?,?,?,?,?,00007FF65DAE201E), ref: 00007FF65DAE5F6F
FlsSetValue.KERNEL32(?,?,?,00007FF65DAE1DF7,?,?,00000000,00007FF65DAE2092,?,?,?,?,?,00007FF65DAE201E), ref: 00007FF65DAE5F80

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 599f45f996d19451c8b2a229de22a9c688dca7130503bd761d5e478bd2defdca
Instruction ID: cfb07f84120c01b028f3e0bc6ae29eb4b4f1a7b7490a66b0f2d812c3d452c990
Opcode Fuzzy Hash: 599f45f996d19451c8b2a229de22a9c688dca7130503bd761d5e478bd2defdca
Instruction Fuzzy Hash: 3B111F70E0D64381FA5857A6EA5517BA281DF887B1F5C4738E92DE6AD6FE2CE401C300

Function 000002B45B03843C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002B45B02F8AF,?,?,00000000,000002B45B02FB4A,?,?,?,?,-2891666E48DAA7FF,000002B45B02FAD6), ref: 000002B45B03845B
FlsSetValue.KERNEL32(?,?,?,000002B45B02F8AF,?,?,00000000,000002B45B02FB4A,?,?,?,?,-2891666E48DAA7FF,000002B45B02FAD6), ref: 000002B45B03847A
FlsSetValue.KERNEL32(?,?,?,000002B45B02F8AF,?,?,00000000,000002B45B02FB4A,?,?,?,?,-2891666E48DAA7FF,000002B45B02FAD6), ref: 000002B45B0384A2
FlsSetValue.KERNEL32(?,?,?,000002B45B02F8AF,?,?,00000000,000002B45B02FB4A,?,?,?,?,-2891666E48DAA7FF,000002B45B02FAD6), ref: 000002B45B0384B3
FlsSetValue.KERNEL32(?,?,?,000002B45B02F8AF,?,?,00000000,000002B45B02FB4A,?,?,?,?,-2891666E48DAA7FF,000002B45B02FAD6), ref: 000002B45B0384C4

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction ID: a778a84851293ec0c8fab4a0e4f20e2b94429ab3c69f08394025f1581a92609e
Opcode Fuzzy Hash: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction Fuzzy Hash: C0116DA0205F4043FAB9BB2666DE33973415BA4BB4F944765E93A46AD7DF28D4018320

Function 00007FF65DAE5D8C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF65DAE5D9D
FlsSetValue.KERNEL32 ref: 00007FF65DAE5DBC
FlsSetValue.KERNEL32 ref: 00007FF65DAE5DE4
FlsSetValue.KERNEL32 ref: 00007FF65DAE5DF5
FlsSetValue.KERNEL32 ref: 00007FF65DAE5E06

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b77b770852fc01411a0c66b1882f58713974e64d821ee1e4b1b057d686c5eaee
Instruction ID: 721b41fca2055efa7928af50e56e3d0f09f9cf9706f5e9a519f28e65108d56a6
Opcode Fuzzy Hash: b77b770852fc01411a0c66b1882f58713974e64d821ee1e4b1b057d686c5eaee
Instruction Fuzzy Hash: CD11EC35E0D20381FA98A3A5E95A1BB1282CF49371F5C0B34D93EEA2D6FD2CB451C250

Function 00007FF65DAAAFD0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF65DAAB29F
_Mpunct.LIBCPMTD ref: 00007FF65DAAB2BC
std::ios_base::width.LIBCPMTD ref: 00007FF65DAAB79A

Strings

@, xrefs: 00007FF65DAAB448

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Mpunct$std::ios_base::width
String ID: @
API String ID: 1355946870-2766056989
Opcode ID: 23e837240074d2248eaa6e84e28edfd629583ca9120122449e8306abbf3755b7
Instruction ID: 2c76c99648b672475998d7e9de3653d3f3305a434a13f81e4fcba55ce39b046e
Opcode Fuzzy Hash: 23e837240074d2248eaa6e84e28edfd629583ca9120122449e8306abbf3755b7
Instruction Fuzzy Hash: 0F12073260DAC585DAA09B55E4943EFA7A1F7C8780F484236DACD93BA9EF3CD545CB00

Function 000002B45AFE6510 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002B45AFE6580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002B45AFE65C8
_Getcoll.LIBCPMT ref: 000002B45AFE65FC

Strings

bad locale name, xrefs: 000002B45AFE6701

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: c4a847eda672c2f6d933a7603187572b8b3689bbfda00f825ba7d637fb08f02a
Instruction ID: f49eeae8632b9d1cd50fb3f54a5616febad3610da8704810e169c8cef56f7e50
Opcode Fuzzy Hash: c4a847eda672c2f6d933a7603187572b8b3689bbfda00f825ba7d637fb08f02a
Instruction Fuzzy Hash: D4918F62702F448BEBA4EFB5D8D439C7362EB64B88F844126DB591BA9ADF34C4558340

Function 00007FF65DABE280 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABE2D1

Strings

d, xrefs: 00007FF65DABE36B
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF65DABE576
+, xrefs: 00007FF65DABE34D

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: +$0123456789abcdefghijklmnopqrstuvwxyz$d
API String ID: 1853752696-121654361
Opcode ID: 114d9d9c213bd84ef5e71c4c351011e52d5e67b59f85d736c31e102dd82b51f1
Instruction ID: 8359c5eaedfe5fd08e845d9c88e2077f017265285ad93fe12e30a34aa927fa53
Opcode Fuzzy Hash: 114d9d9c213bd84ef5e71c4c351011e52d5e67b59f85d736c31e102dd82b51f1
Instruction Fuzzy Hash: B9C1D27261C6C58AE7A0CB59F08076EBBA0F388740F14412AE6DE97B99EB7CD445CF10

Function 00007FF65DABD260 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

std::_Load_relaxed_4.LIBCONCRTD ref: 00007FF65DABD286

Strings

1, xrefs: 00007FF65DABD36C
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF65DABD47C
0p+0, xrefs: 00007FF65DABD29A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Load_relaxed_4std::_
String ID: 0123456789abcdefghijklmnopqrstuvwxyz$0p+0$1
API String ID: 1853752696-64391948
Opcode ID: 87ffbadd58718491a0f75fa8edb27ea73874d19d2365bb681a35b88d33976b5c
Instruction ID: 68234773ba4ac188fe275026de30766ee4ec101428da62b895a699e668e47077
Opcode Fuzzy Hash: 87ffbadd58718491a0f75fa8edb27ea73874d19d2365bb681a35b88d33976b5c
Instruction Fuzzy Hash: FEA1943661CBC889DBA0CB59E49039AB7A0F785B84F545025EACE87B98DF7CD445CB01

Function 00007FF65DAA5820 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FF65DAA58D8

Part of subcall function 00007FF65DAF77D4: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7824
Part of subcall function 00007FF65DAF77D4: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7865

Strings

ios_base::badbit set, xrefs: 00007FF65DAA589B
ios_base::eofbit set, xrefs: 00007FF65DAA58C2
ios_base::failbit set, xrefs: 00007FF65DAA58B4

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ExceptionFileHeaderRaisestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 504923140-1866435925
Opcode ID: 37625c85163a6a2edd9043ea699a6532f1f35351b076ec396d6e3d08002ad281
Instruction ID: 5e63814e8f57c2601c95b63ed861aebf224a610f3730c13e35dadab58295c76a
Opcode Fuzzy Hash: 37625c85163a6a2edd9043ea699a6532f1f35351b076ec396d6e3d08002ad281
Instruction Fuzzy Hash: E6212832A1C78286E761CB14E84126B77A0FB88344F984235E6CDD7BE9EF2CE544CB04

Function 000002B45B059520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002B45B059536
GetProcAddress.KERNEL32 ref: 000002B45B059546

Strings

GetTempPath2W, xrefs: 000002B45B05953C
kernel32.dll, xrefs: 000002B45B05952F

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction ID: 9f79a25bf512b0adfaffe1c1623752945ee1721bcc071e5efae73293afd41be5
Opcode Fuzzy Hash: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction Fuzzy Hash: 98E0C9A1310E4483EE14BF11F9C8569B361F7A9F85F985025D90E07236DF28C4458710

Function 000002B45B00F480 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B00ED30: CreateToolhelp32Snapshot.KERNEL32 ref: 000002B45B00ED86
Part of subcall function 000002B45B00ED30: Process32FirstW.KERNEL32 ref: 000002B45B00EDCA
Part of subcall function 000002B45B00ED30: Process32NextW.KERNEL32 ref: 000002B45B00EDDF
Part of subcall function 000002B45B00ED30: OpenProcess.KERNEL32 ref: 000002B45B00EE1B
Part of subcall function 000002B45B00ED30: OpenProcessToken.ADVAPI32 ref: 000002B45B00EE42
Part of subcall function 000002B45B00ED30: CloseHandle.KERNEL32 ref: 000002B45B00EFB6
Part of subcall function 000002B45B00ED30: Process32NextW.KERNEL32 ref: 000002B45B00EFC3
Part of subcall function 000002B45B00ED30: CloseHandle.KERNEL32 ref: 000002B45B00F007

ImpersonateLoggedOnUser.ADVAPI32 ref: 000002B45B00F4DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 000002B45B00F9C8
RevertToSelf.ADVAPI32 ref: 000002B45B00F9E6

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: 72b49010517826a4bc1718730da808a27341e03ca3287bc81b5c6f812749a859
Instruction ID: 6f8a649a0e84fa4ffacf1e5b03ee869b1fac577d7893da89dc6dc2d1142f3d43
Opcode Fuzzy Hash: 72b49010517826a4bc1718730da808a27341e03ca3287bc81b5c6f812749a859
Instruction Fuzzy Hash: 2C22B1A2614F8487FB20EF68D4D839D3761E7A1BA8FD05201EA6D06ADBDF78C484D710

Function 00007FF65DAEE294 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF65DAEE313
WriteFile.KERNEL32 ref: 00007FF65DAEE5DB
WriteFile.KERNEL32 ref: 00007FF65DAEE621
GetLastError.KERNEL32 ref: 00007FF65DAEE6D7

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 8006df4a7e49d247def26c2c7127d35bc6642300e1a35ffac0c40609046d0867
Instruction ID: 6b364d1490b9bffbfb5bfa5ce1ee0c59e2b2bcc1d4b7a8589b46ec41efba81c4
Opcode Fuzzy Hash: 8006df4a7e49d247def26c2c7127d35bc6642300e1a35ffac0c40609046d0867
Instruction Fuzzy Hash: 4BD1C032B18A828AE711CFB9D4402AD37B1FB44798B484235CE5DE7BDAEE38D516C740

Function 00007FF65DAEEBBC Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65DAEEBA7), ref: 00007FF65DAEECD8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65DAEEBA7), ref: 00007FF65DAEED63

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 105dd8715a37432a8ca5a6fa959f0c984e635dbff9f10a33cd2e20e3aea9f4a0
Instruction ID: a218029a842a4129f943218273087d5ae20368a082d489ef232f76d48d795876
Opcode Fuzzy Hash: 105dd8715a37432a8ca5a6fa959f0c984e635dbff9f10a33cd2e20e3aea9f4a0
Instruction Fuzzy Hash: 8C917072B1C65395F7609FA5D4802BE2BA0EB44B88F184139DE0EB76D6EF38D582C700

Function 00007FF65DAA7520 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 00007FF65DAA766A
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF65DAA77D6

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWork
String ID:
API String ID: 4081100948-0
Opcode ID: 433dcc4501cc22be7c96191e04221bbceba203970fa6bf234e56f01351b521ae
Instruction ID: 4f56bc20d878723c1bb708830e2ea4fa9de7384a391bc1ca82d453dd6998beca
Opcode Fuzzy Hash: 433dcc4501cc22be7c96191e04221bbceba203970fa6bf234e56f01351b521ae
Instruction Fuzzy Hash: 0091E43261DAC585EA719B55E8503EFA7A1FBC8780F840136DACD93BA9EF2CD541CB40

Function 000002B45B059704 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000002B45B05974D
GetLastError.KERNEL32 ref: 000002B45B05975B
WideCharToMultiByte.KERNEL32 ref: 000002B45B059790
GetLastError.KERNEL32 ref: 000002B45B05979E

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction ID: 071664b0aa3d3b97d39994d9a0c8cdf0837b83ecabae4fa951c83f853eef2162
Opcode Fuzzy Hash: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction Fuzzy Hash: CD2133B6624F44C7F7209F21E48831EB7B8F3AAF94F944125DB8557B55DB39C4418B10

Function 000002B45B059BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000002B45B059520: GetModuleHandleW.KERNEL32 ref: 000002B45B059536
Part of subcall function 000002B45B059520: GetProcAddress.KERNEL32 ref: 000002B45B059546

GetLastError.KERNEL32 ref: 000002B45B059C14

Part of subcall function 000002B45B037BC4: IsProcessorFeaturePresent.KERNEL32 ref: 000002B45B037BEA

GetFileAttributesW.KERNEL32 ref: 000002B45B059C23
__std_fs_open_handle.LIBCPMT ref: 000002B45B059C4C
CloseHandle.KERNEL32 ref: 000002B45B059C5E

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: 86fbdfa52f2319e6312105fc84602156e67e79ffca24362864ab712a1c8c6086
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: 961186A1214E4047EE706F65A0CC32A7B91E766FF0F949614EA6746EE6DB38C4408F10

Function 00007FF65DAF6530 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF65DAF655C
GetCurrentThreadId.KERNEL32 ref: 00007FF65DAF656A
GetCurrentProcessId.KERNEL32 ref: 00007FF65DAF6576
QueryPerformanceCounter.KERNEL32 ref: 00007FF65DAF6586

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a6819c37be0477cab6629fe85bd40332cbc882bfc7744020e340a307dd6c19ab
Instruction ID: becdbc591a1c2d5632c9137df7daf86a48ce403585116d8aa22db2ebaa8c5d62
Opcode Fuzzy Hash: a6819c37be0477cab6629fe85bd40332cbc882bfc7744020e340a307dd6c19ab
Instruction Fuzzy Hash: 63115A26B18F068AEB00CF60E8542B933B4FB59759F080E31DA6D96BA4EF38D158C340

Function 00007FF65DAA8830 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 356COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMTD ref: 00007FF65DAA8A67
std::ios_base::width.LIBCPMTD ref: 00007FF65DAA8EE6

Strings

@, xrefs: 00007FF65DAA8B94

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Mpunctstd::ios_base::width
String ID: @
API String ID: 1954291571-2766056989
Opcode ID: 03687c50ff717027d4cbf97da90ce4cd140f58e9f754c6eefb8b4b0b970cbde7
Instruction ID: 7ac211f0bd1d21f8ccc11541fe489e126398d415458f46d0ab5d415735328b2e
Opcode Fuzzy Hash: 03687c50ff717027d4cbf97da90ce4cd140f58e9f754c6eefb8b4b0b970cbde7
Instruction Fuzzy Hash: 2A02183260DAC585DAB09B55E8943EFA7A1F7C8780F484132DACD93BA9EE7CC545CB00

Function 00007FF65DABE860 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 274COMMON

Download Yara Rule

APIs

ReadNoFence64.LIBCMTD ref: 00007FF65DABE898

Strings

B, xrefs: 00007FF65DABEAC3
e, xrefs: 00007FF65DABEC46

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fence64Read
String ID: B$e
API String ID: 3999070443-1081078989
Opcode ID: c5527d5727164a535ea70a8198cdfd9bb409c33ca9616b643965ae659df559ff
Instruction ID: 028d7ec3264793be9f79190cb09c70d10dee4ab7d21211697963f127c2a24241
Opcode Fuzzy Hash: c5527d5727164a535ea70a8198cdfd9bb409c33ca9616b643965ae659df559ff
Instruction Fuzzy Hash: E2E1F27261DAC989EA60CB55E4903ABB7A0F788784F544126EBCD83B99EF7CD1458B00

Function 00007FF65DACB990 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 265COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DACBBD3

Part of subcall function 00007FF65DAAB830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAAB84F
Part of subcall function 00007FF65DAAB830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF65DAAB87C

Part of subcall function 00007FF65DAB86A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAB86DD

Part of subcall function 00007FF65DAB5C90: List.LIBCMTD ref: 00007FF65DAB5CB2

Strings

x, xrefs: 00007FF65DACBAA9
integral cannot be stored in char, xrefs: 00007FF65DACB9E8

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 37da2e45b0d7b3146df98e9d44cab3b08f691e1043df3819007dde9a53eafa5e
Instruction ID: d9922b5ba523581a11cc22fe4c7e4d0646536ec86bbdc4829b45462164a64613
Opcode Fuzzy Hash: 37da2e45b0d7b3146df98e9d44cab3b08f691e1043df3819007dde9a53eafa5e
Instruction Fuzzy Hash: 8AE1083260CBC595E6B19B55E4943EBBBA0F785740F884136EACC93BA9EF2DD544CB00

Function 00007FF65DACDDF0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DACE038

Part of subcall function 00007FF65DAAB830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAAB84F
Part of subcall function 00007FF65DAAB830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF65DAAB87C

Part of subcall function 00007FF65DAB86A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAB86DD

Part of subcall function 00007FF65DAB5C90: List.LIBCMTD ref: 00007FF65DAB5CB2

Strings

integral cannot be stored in char, xrefs: 00007FF65DACDE48
x, xrefs: 00007FF65DACDF09

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 1596abfdd457b49d8574ff87fe7b334aa10946dc342344dab65ebbd4e4ec0ae5
Instruction ID: a74452373b81f0de2228de4c9061d1a9c938f0be997826f19a1e4480cd1c0c93
Opcode Fuzzy Hash: 1596abfdd457b49d8574ff87fe7b334aa10946dc342344dab65ebbd4e4ec0ae5
Instruction Fuzzy Hash: ECE1193260CAC599EA719B55E4943EBB7A4F7C5740F884126EACC93BA9EF3CD544CB00

Function 00007FF65DACCC20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DACCE5E

Part of subcall function 00007FF65DAAB830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAAB84F
Part of subcall function 00007FF65DAAB830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF65DAAB87C

Part of subcall function 00007FF65DAB86A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAB86DD

Part of subcall function 00007FF65DAB5C90: List.LIBCMTD ref: 00007FF65DAB5CB2

Strings

integral cannot be stored in char, xrefs: 00007FF65DACCC77
x, xrefs: 00007FF65DACCD38

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: f68e61a9b24bcdbe501b4cb4a8be31105e4a74e301578b4c8d38f57891bf8768
Instruction ID: 55333c7e960aacaf13aa980d12124db53db0badefeb2ea609a5c16d96dd2e187
Opcode Fuzzy Hash: f68e61a9b24bcdbe501b4cb4a8be31105e4a74e301578b4c8d38f57891bf8768
Instruction Fuzzy Hash: ECE1F73260CBC595EAB1DB55E4843EBB7A0F785740F484126EACD93BA9EF2CD544CB00

Function 00007FF65DACD500 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DACD748

Part of subcall function 00007FF65DAAB830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAAB84F
Part of subcall function 00007FF65DAAB830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF65DAAB87C

Part of subcall function 00007FF65DAB86A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAB86DD

Part of subcall function 00007FF65DAB5C90: List.LIBCMTD ref: 00007FF65DAB5CB2

Strings

integral cannot be stored in char, xrefs: 00007FF65DACD558
x, xrefs: 00007FF65DACD619

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 4b244738b26a5789b77ad3fd3cb99100bb612cdf3abe259f1d14dde2a12ef4b0
Instruction ID: 57a26fad79d84ee18da8ca772f3aa189639ae69d42a1ff1578d2b6c48bbc9df2
Opcode Fuzzy Hash: 4b244738b26a5789b77ad3fd3cb99100bb612cdf3abe259f1d14dde2a12ef4b0
Instruction Fuzzy Hash: 20E1083260CAC599EA719B55E4943EBB7A4F7C9740F884126DACC93BA9EF3CD544CB00

Function 00007FF65DACC340 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DACC57E

Part of subcall function 00007FF65DAAB830: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF65DAAB84F
Part of subcall function 00007FF65DAAB830: std::locale::_Getfacet.LIBCPMTD ref: 00007FF65DAAB87C

Part of subcall function 00007FF65DAB86A0: std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAB86DD

Part of subcall function 00007FF65DAB5C90: List.LIBCMTD ref: 00007FF65DAB5CB2

Strings

x, xrefs: 00007FF65DACC458
integral cannot be stored in char, xrefs: 00007FF65DACC397

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: std::_$Fac_nodeFac_node::_GetfacetListLockitLockit::_Ptr_basestd::locale::_
String ID: integral cannot be stored in char$x
API String ID: 221360887-211560653
Opcode ID: 1077f688a18f0bb061bb1737b16c4c955e09df886ced37da15a21ec57a8cb352
Instruction ID: 4ba42eb35d92ba225ed29896360099389be1675da22e67c1d03fe854c3cf452d
Opcode Fuzzy Hash: 1077f688a18f0bb061bb1737b16c4c955e09df886ced37da15a21ec57a8cb352
Instruction Fuzzy Hash: 75E1F53660CBC589E6B1DB55E4843EBB7A0F785744F884126EACD93BA9EF2CD544CB00

Function 000002B45AFCEAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000002B45AFCEBDB

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 592879274f2377c88e15551e45b0d898f1beb6016a4ce4fa7b521ea37185a7f5
Instruction ID: 2bdc137a31124e5afb3d3cab2f5e5ea9251905f80076e674002d0b51dd318d36
Opcode Fuzzy Hash: 592879274f2377c88e15551e45b0d898f1beb6016a4ce4fa7b521ea37185a7f5
Instruction Fuzzy Hash: E871E263B10F9086F720EF7AD89439D37A1E7A5B94F944216DEA917B9BCB78C085C340

Function 00007FF65DAE3E7C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65DAE4020

Strings

_.,, xrefs: 00007FF65DAE3EF1
., xrefs: 00007FF65DAE3EB7

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: .$_.,
API String ID: 3215553584-3384562259
Opcode ID: 5005c32137a548dfb07fd7f872a37727fbf1990c54d12e514ca1fba1ab344483
Instruction ID: 23264b4b60d4587ca2ed5eb941e55289ea1fb68f19269c50aa9e7b7260008c3c
Opcode Fuzzy Hash: 5005c32137a548dfb07fd7f872a37727fbf1990c54d12e514ca1fba1ab344483
Instruction Fuzzy Hash: 3C41D232E0D24385EB758AA5D4416BBA3A1EF407A1F5C0635DA1DABAC1FF7CE995C200

Function 000002B45AFF4780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002B45AFF47EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000002B45AFF4837

Strings

bad locale name, xrefs: 000002B45AFF4916

Memory Dump Source

Source File: 00000000.00000002.1887518461.000002B45AFA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002B45AFA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b45afa0000_apilibx64.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: a58eb3bf0f302d7abd68863794c76069cb31983c6482653a656e5a68ed28bb2b
Instruction ID: 0e0d51571e45166ff0fdc8fe35d4b080a5ae15111b7cfdb3f0e6fed67761842e
Opcode Fuzzy Hash: a58eb3bf0f302d7abd68863794c76069cb31983c6482653a656e5a68ed28bb2b
Instruction Fuzzy Hash: 47513A73302E408AFB60EFA0D8D43AC33A4FB64B48F844026EB5967A96DB34C519C314

Function 00007FF65DAC80FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF65DAC820F

Strings

p, xrefs: 00007FF65DAC8112
nan, xrefs: 00007FF65DAC824A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 9322a994478f8a1e71212c7b64208aeab5a97f826a7379df3ff919e47543f4b3
Instruction ID: 1014f2f7b0dc5a58127839d68dbb58d08dad626d209d87042401016531ca6ab3
Opcode Fuzzy Hash: 9322a994478f8a1e71212c7b64208aeab5a97f826a7379df3ff919e47543f4b3
Instruction Fuzzy Hash: AB51B33260DBC988E6B18B65E4403EFB6A4F789B50F484026DACC96B99EF7CD144CF11

Function 00007FF65DAC9CFF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF65DAC9E0F

Strings

p, xrefs: 00007FF65DAC9D12
nan, xrefs: 00007FF65DAC9E4A

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 9481a30ab3fd2cd97439ded438629b95f0626152fff0811fa843788489d09e16
Instruction ID: 4046d82a118bdb27774c23896ea74b3a633ab77e34e792e12c9695f0b247ea02
Opcode Fuzzy Hash: 9481a30ab3fd2cd97439ded438629b95f0626152fff0811fa843788489d09e16
Instruction Fuzzy Hash: B351AF3261DBC588E7B1CA65E4503EFB6A8FB85790F484126DACD96B99EF3CD140CB10

Function 00007FF65DAC91FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

isnan.LIBCPMTD ref: 00007FF65DAC930F

Strings

nan, xrefs: 00007FF65DAC934A
p, xrefs: 00007FF65DAC9212

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: isnan
String ID: nan$p
API String ID: 3207536064-2149505255
Opcode ID: 212ba282b589994af6719a8786fa105b4abc7be932bc5a6e8be15af795549e72
Instruction ID: 1bb798d3cd123fd432120cc8870dea76550ec51fed396533b9add7b6ee084331
Opcode Fuzzy Hash: 212ba282b589994af6719a8786fa105b4abc7be932bc5a6e8be15af795549e72
Instruction Fuzzy Hash: CA51B13260DBC588E6B18B65E4503EFB6A8FB85751F484126DACD96B99EF3CD144CB00

Function 00007FF65DAEE92C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF65DAEEA43
GetLastError.KERNEL32 ref: 00007FF65DAEEA65

Strings

U, xrefs: 00007FF65DAEE9EF

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 803ea60b07f2bfd039fe1532e5b1b15e9d3e37eaacb6a5ccb339d6080fddc9c5
Instruction ID: b8e71c01355d76277a29d95d70ee4b039ca1b434e62eeb4eb0bce616e61e9d4a
Opcode Fuzzy Hash: 803ea60b07f2bfd039fe1532e5b1b15e9d3e37eaacb6a5ccb339d6080fddc9c5
Instruction Fuzzy Hash: 49418E72A1CA4282EB609F65E8443AAB6A1FB98784F484135EA4DD77D9EF3CD501C740

Function 00007FF65DAC78B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF65DAC7972

Strings

Invalid format string., xrefs: 00007FF65DAC79A7
Missing precision specifier., xrefs: 00007FF65DAC79C3

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_
String ID: Invalid format string.$Missing precision specifier.
API String ID: 2780765137-617221873
Opcode ID: 4ca59656c3cc1c0764987cb03f835006a52b7bc3725c2088db24ddf1b17c7d77
Instruction ID: 5e52e40fcf72325c016841630433b3ab2db5ba0301eb75ea5fcd017fbc0501a7
Opcode Fuzzy Hash: 4ca59656c3cc1c0764987cb03f835006a52b7bc3725c2088db24ddf1b17c7d77
Instruction Fuzzy Hash: 0C31393251DAC585DA51CB95E48012FFBA4F7897A0F481532F6CDD3BA9EFACD5018B00

Function 00007FF65DAD0060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DAD0162

Strings

x, xrefs: 00007FF65DAD009B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: a98be8c2056132d05dbec4f152304ae5764991d5042131e464acb9f7d0bc06b8
Instruction ID: 8624eddbf38c7c75592c4d16af7a1a6884e4a98d31d408892a2a45df842f5163
Opcode Fuzzy Hash: a98be8c2056132d05dbec4f152304ae5764991d5042131e464acb9f7d0bc06b8
Instruction Fuzzy Hash: F6314F21A0D58181F720A755E84413B6B70BB86784F984132FBCD97AEAEF1DD945CB08

Function 00007FF65DAC7761 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF65DAC76FD

Strings

^, xrefs: 00007FF65DAC7679
invalid fill character '{', xrefs: 00007FF65DAC76C3

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: ^$invalid fill character '{'
API String ID: 1114552684-1467272599
Opcode ID: 719a7894ea2433418be1f6a2a8793a54ba95e5472bef42d9267058544f7ac8f4
Instruction ID: 30a6d1f3fe62ae6375d6167f1f8d28c67926bc65edfa037388b1b253f5e84e9c
Opcode Fuzzy Hash: 719a7894ea2433418be1f6a2a8793a54ba95e5472bef42d9267058544f7ac8f4
Instruction Fuzzy Hash: F521322260DBC984E6718B99E48037BA794E7C5794F481431EACD92BEADF6CD540CB00

Function 00007FF65DAD0920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DAD0A21

Strings

x, xrefs: 00007FF65DAD095B

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: 7016c2d3df3c20257f2f836e6a0a8dc63c202ef464d6a10d065f226a5f5ba269
Instruction ID: ee4f99e85cbc9089d3cd9976d99265c03065aa37ffd7fbf2892831c8a4037556
Opcode Fuzzy Hash: 7016c2d3df3c20257f2f836e6a0a8dc63c202ef464d6a10d065f226a5f5ba269
Instruction Fuzzy Hash: 68315021A1DA8185F720A765E08423BA770FB81784F584532FB8D97AEADF2DD945CB04

Function 00007FF65DAD03B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Ptr_base.LIBCMTD ref: 00007FF65DAD04B0

Strings

x, xrefs: 00007FF65DAD03EB

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: Ptr_base
String ID: x
API String ID: 897191226-2363233923
Opcode ID: 9bfe9e957daf48727a13c624664f7626c2dd4fb6e28bca9134fae2d2c54b9db9
Instruction ID: 36c7a85d6a9e3ae06c6c9efd602f863ad85f36aac3d5c104e6a42e98b821ac14
Opcode Fuzzy Hash: 9bfe9e957daf48727a13c624664f7626c2dd4fb6e28bca9134fae2d2c54b9db9
Instruction Fuzzy Hash: F1319171A0D68181F720A755E04467B6B70FB81384F984132FACD97AEAEF2DD946CB44

Function 00007FF65DAF77D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7824
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65DAF651B), ref: 00007FF65DAF7865

Strings

csm, xrefs: 00007FF65DAF7852

Memory Dump Source

Source File: 00000000.00000002.1888014001.00007FF65DAA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF65DAA0000, based on PE: true

Associated: 00000000.00000002.1887987009.00007FF65DAA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DB0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888075482.00007FF65DDBD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888308048.00007FF65DDC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1888326292.00007FF65DDCC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff65daa0000_apilibx64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c503307943bf2825cf6e1cf168de274f8e029fc4329f5c4f3fb9745047db57ca
Instruction ID: 1d4762754f0b436f30dbcc4f1c48188b075fce3c371017e5c51c9c71aa5aeeee
Opcode Fuzzy Hash: c503307943bf2825cf6e1cf168de274f8e029fc4329f5c4f3fb9745047db57ca
Instruction Fuzzy Hash: D6115B3661CB8182EB618F15E44026A77E5FB88B85F584634EE8C577A8EF3CC591CB40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report apilibx64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

Windows Analysis Report
apilibx64.exe

Function 000002B45B01FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 000002B45B0598C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 000002B45AFDB820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 000002B45B016480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 000002B45B04114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 000002B45B01F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 000002B45B05E968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 000002B45B018F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Function 000002B45B0413C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Function 000002B45B03749C Relevance: 9.2, APIs: 6, Instructions: 227
COMMON

Function 000002B45B028B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Function 000002B45B018B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 000002B45B019BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Function 000002B45B023B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Function 000002B45B03D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre