Edit tour

Windows Analysis Report
Wk6IMAhBNF.exe

Overview

General Information

Sample name:	Wk6IMAhBNF.exe renamed because original name is a hash value
Original sample name:	FF61853AA5A10D3FE8FBE0D5470DB9D0.exe
Analysis ID:	1581277
MD5:	ff61853aa5a10d3fe8fbe0d5470db9d0
SHA1:	bc6f2373b942643d275a062ac01367b197c3ad24
SHA256:	ec234980252c20fc05b927ffa9bc292c88f210bda8e2e532a38cf9cbd1e72557
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected GhostRat

AI detected suspicious sample

Contain functionality to detect virtual machines

Contains functionality to capture and log keystrokes

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found evasive API chain (may stop execution after checking mutex)

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Machine Learning detection for sample

PE file has a writeable .text section

Potentially malicious time measurement code found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

Wk6IMAhBNF.exe (PID: 2148 cmdline: "C:\Users\user\Desktop\Wk6IMAhBNF.exe" MD5: FF61853AA5A10D3FE8FBE0D5470DB9D0)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Wk6IMAhBNF.exe	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1999206035.0000000000438000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Wk6IMAhBNF.exe PID: 2148	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: Wk6IMAhBNF.exe PID: 2148	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Wk6IMAhBNF.exe PID: 2148	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Wk6IMAhBNF.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.0.Wk6IMAhBNF.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 103.199.100.97, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\Wk6IMAhBNF.exe, Initiated: true, ProcessId: 2148, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49786

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:57:51.073805+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49786	103.199.100.97	8080	TCP
2024-12-27T09:59:01.558575+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49786	103.199.100.97	8080	TCP
2024-12-27T10:00:12.511514+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49979	103.199.100.97	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Wk6IMAhBNF.exe	Virustotal: Detection: 47%			Perma Link
Source: Wk6IMAhBNF.exe	ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Wk6IMAhBNF.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Unpacked PE file: 0.2.Wk6IMAhBNF.exe.5880000.3.unpack

Source: Wk6IMAhBNF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: iphlpapi.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.00000000021AF000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458151098.00000000022CB000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.0000000002540000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Wk6IMAhBNF.exe, 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2185256355.00000000021A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2185256355.00000000021A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.00000000021AF000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458151098.00000000022CB000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458607021.0000000002540000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_058880E0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_058880E0

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 4x nop then lea eax, dword ptr [ebp-00000114h]	0_2_0040BAA0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 4x nop then lea eax, dword ptr [ebp-38h]	0_2_0040BC00
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 4x nop then mov dword ptr [ebp-54h], 00000040h	0_2_0040BC8C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49786 -> 103.199.100.97:8080
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49979 -> 103.199.100.97:8080

Source: global traffic	TCP traffic: 192.168.2.5:49786 -> 103.199.100.97:8080
Source: global traffic	TCP traffic: 192.168.2.5:49958 -> 103.199.100.130:8181

Source: Joe Sandbox View

ASN Name: XIAOZHIYUN1-AS-APICIDCNETWORKUS XIAOZHIYUN1-AS-APICIDCNETWORKUS

Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97
Source: unknown	TCP traffic detected without corresponding DNS query: 103.199.100.97

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_00404BBD select,recv,

0_2_00404BBD

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: [esc]	0_2_0588E740
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: [esc]	0_2_0588E740
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: [esc]	0_2_0588E740
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: [esc]	0_2_0588E740

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588E740 Sleep,CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

0_2_0588E740

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

0_2_0588E740

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588BBD0 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

0_2_0588BBD0

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588E3E0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_0588E3E0

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_61d963bb-0

Source: Yara match	File source: 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wk6IMAhBNF.exe PID: 2148, type: MEMORYSTR

System Summary

PE file has a writeable .text section

Source: Wk6IMAhBNF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0588B41F ExitWindowsEx,	0_2_0588B41F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0588B443 ExitWindowsEx,	0_2_0588B443
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0588B3FB ExitWindowsEx,	0_2_0588B3FB

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041C186	0_2_0041C186
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041F443	0_2_0041F443
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004294C2	0_2_004294C2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041C59E	0_2_0041C59E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041F672	0_2_0041F672
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004127CC	0_2_004127CC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041C9D3	0_2_0041C9D3
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00417A31	0_2_00417A31
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0042BAB9	0_2_0042BAB9
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00423B40	0_2_00423B40
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00474B4C	0_2_00474B4C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00474B12	0_2_00474B12
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00474B28	0_2_00474B28
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041BC8A	0_2_0041BC8A
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041AD20	0_2_0041AD20
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0041CE08	0_2_0041CE08
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00473EE2	0_2_00473EE2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00430EEB	0_2_00430EEB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00473EEF	0_2_00473EEF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00473EFD	0_2_00473EFD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00473E86	0_2_00473E86
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00473E86	0_2_00473E86
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05886C20	0_2_05886C20
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05886ED0	0_2_05886ED0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_058824B0	0_2_058824B0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0589D78F	0_2_0589D78F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0589E231	0_2_0589E231
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05898271	0_2_05898271
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0589DCE0	0_2_0589DCE0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0589E90D	0_2_0589E90D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0589F8EF	0_2_0589F8EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_058888F0	0_2_058888F0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022977D0	0_2_022977D0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C575	0_2_0229C575
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02284F3B	0_2_02284F3B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02298F43	0_2_02298F43
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229CC14	0_2_0229CC14
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02490246	0_2_02490246
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0246D265	0_2_0246D265
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02499278	0_2_02499278
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6	0_2_022868D6

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 058941F0 appears 32 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 00418D67 appears 46 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 00418CC5 appears 32 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 0226F8D7 appears 51 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 004192C0 appears 49 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 00418CFC appears 40 times
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: String function: 0040F1F6 appears 33 times

Source: Wk6IMAhBNF.exe	Binary or memory string: OriginalFilename vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2329543309.0000000000866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameadvapi32.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFeedbackCollector.exe^ vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458408865.00000000024BC000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameadvapi32.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiphlpapi.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.0000000002A53000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458151098.000000000231B000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000295E000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.0000000002241000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2185256355.00000000022CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.00000000021AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458151098.00000000022CB000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs Wk6IMAhBNF.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: OriginalFilenameFeedbackCollector.exe^ vs Wk6IMAhBNF.exe

Source: Wk6IMAhBNF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Wk6IMAhBNF.exe

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/2

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05887730 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_05887730
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05887610 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	0_2_05887610
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05887B60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_05887B60

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05886C20 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

0_2_05886C20

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05886020 _memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,

0_2_05886020

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0040C523 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantClear,CoUninitialize,

0_2_0040C523

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Mutant created: \Sessions\1\BaseNamedObjects\???????

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Command line argument: >QC

0_2_00435090

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wk6IMAhBNF.exe	Virustotal: Detection: 47%
Source: Wk6IMAhBNF.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Section loaded: msvfw32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Wk6IMAhBNF.exe

Static file information: File size 1151488 > 1048576

Source: Wk6IMAhBNF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: iphlpapi.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.00000000021AF000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458151098.00000000022CB000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: iphlpapi.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458607021.00000000025AD000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458607021.0000000002540000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Wk6IMAhBNF.exe, 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2185256355.00000000021A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2185256355.00000000021A7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000003.2235912555.00000000021AF000.00000004.00000020.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000002.4458151098.00000000022CB000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: Wk6IMAhBNF.exe, Wk6IMAhBNF.exe, 00000000.00000002.4458607021.0000000002540000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdbUGP source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Unpacked PE file: 0.2.Wk6IMAhBNF.exe.400000.0.unpack .text:EW;.rdata:W;.data:W;.gfids:W;.tls:W;.rsrc:W;.reloc:W;.NLDEE:EW;.idata:W;.NLDEE:R; vs .text:ER;.rdata:R;.data:R;.gfids:R;.tls:R;.rsrc:R;.reloc:R;.NLDEE:ER;.idata:R;.NLDEE:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Unpacked PE file: 0.2.Wk6IMAhBNF.exe.5880000.3.unpack

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05887480 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

0_2_05887480

Source: initial sample

Static PE information: section where entry point is pointing to: .NLDEE

Source: Wk6IMAhBNF.exe

Static PE information: real checksum: 0x125d0f should be: 0x125207

Source: Wk6IMAhBNF.exe	Static PE information: section name: .NLDEE
Source: Wk6IMAhBNF.exe	Static PE information: section name: .NLDEE

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0046C027 push dword ptr [esp]; retn 0004h	0_2_0046C024
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004931E7 push dword ptr [esp+58h]; retn 005Ch	0_2_004932D1
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00478196 push esp; retf	0_2_004781AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004882F3 push dword ptr [esp]; retn 0004h	0_2_00488396
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00492291 push dword ptr [esp+14h]; retn 0018h	0_2_00492488
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00419306 push ecx; ret	0_2_00419319
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0049239A push dword ptr [esp+14h]; retn 0018h	0_2_00492488
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004774C0 push dword ptr [esp+04h]; retn 0008h	0_2_004E7B40
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004774C0 push dword ptr [esp+20h]; retn 0024h	0_2_004E7D25
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004E44C4 push dword ptr [esp+1Ch]; retn 0020h	0_2_004E4517
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00477557 push dword ptr [esp+20h]; retn 0024h	0_2_004E7D25
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004EF5D1 push esi; mov dword ptr [esp], esp	0_2_004EF5A3
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004745ED push eax; iretd	0_2_004745EE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004E458B push dword ptr [esp+04h]; retn 0008h	0_2_004E4681
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0047758B push dword ptr [esp+20h]; retn 0024h	0_2_004E7D25
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004E4601 push dword ptr [esp+04h]; retn 0008h	0_2_004E4681
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004E4619 push dword ptr [esp+04h]; retn 0008h	0_2_004E4681
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004836A3 push dword ptr [esp]; retn 0004h	0_2_0048369A
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00474767 push dword ptr [esp+1Ch]; retn 0020h	0_2_004747E1
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004757C3 pushfd ; mov dword ptr [esp], ebx	0_2_004BD421
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004D97FC push dword ptr [esp+08h]; retn 000Ch	0_2_004D9801
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004817F1 push dword ptr [esp+14h]; retn 0018h	0_2_00481832
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004DD834 push dword ptr [esp+04h]; retn 0008h	0_2_004DD945
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004818F3 push dword ptr [esp+1Ch]; retn 0020h	0_2_00481944
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004DD8F2 push dword ptr [esp+04h]; retn 0008h	0_2_004DD945
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004DD8B1 push dword ptr [esp+04h]; retn 0008h	0_2_004DD945
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0046B94C push dword ptr [esp+14h]; retn 0018h	0_2_0046B975
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0046B90B push dword ptr [esp+14h]; retn 0018h	0_2_0046B975
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0046B92D push dword ptr [esp+14h]; retn 0018h	0_2_0046B975
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_00476937 pushfd ; mov dword ptr [esp], esp	0_2_00476939
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0046B985 push ecx; ret	0_2_0046BFA0

Source: Wk6IMAhBNF.exe

Static PE information: section name: .NLDEE entropy: 7.823713533239283

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588B39D OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_0588B39D

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE IpDates_info

Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Wk6IMAhBNF.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Wk6IMAhBNF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Wk6IMAhBNF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1999206035.0000000000438000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wk6IMAhBNF.exe PID: 2148, type: MEMORYSTR

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: VMware VMware VMware VBOX VBOX VBOX VBOX VMware VMware VMware		0_2_0040CB1E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: vmware vmware vmware vmware		0_2_0040DAA8

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0040DC56 __ehhandler$___std_fs_get_file_attributes_by_handle@8,__EH_prolog3_GS,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__aulldiv,GetCursorPos,GetCursorPos,GetCursorPos,

0_2_0040DC56

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-71483

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_DiskDrive

Queries temperature or sensor information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\WMI : SELECT * FROM MSAcpi_ThermalZoneTemperature

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	API/Special instruction interceptor: Address: 483E9F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	API/Special instruction interceptor: Address: 481848
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	API/Special instruction interceptor: Address: 49EB0F

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Wk6IMAhBNF.exe	Binary or memory string: DIR_WATCH.DLL
Source: Wk6IMAhBNF.exe	Binary or memory string: .LNKROOT\WMISELECT * FROM MSACPI_THERMALZONETEMPERATUREWQLCURRENTTEMPERATURE08-00-2700-03-FF00-05-6900-0C-2900-50-56\\.\PHYSICALDRIVE0VBOXSERVICE.EXEVBOXTRAY.EXEVMWARE.EXEVMTOOLSD.EXEVIRTUAL MACHINETEMP\ROOT\CIMV2SELECT FROM SERIALNUMBERWIN32_BASEBOARDNONECAPTIONWIN32_DISKDRIVEVMWAREVBOXVIRTUAL HDMODELWIN32_COMPUTERSYSTEMVIRTUALBOXFAILED TO CREATE D3D11 DEVICE.FAILED TO CREATE DXGI FACTORY.CURRENTUSERSANDBOXEMILYHAPUBWSHONG LEEIT-ADMINJOHNSONMILLERMILOZSPETER WILSONTIMMYUSERSAND BOXMALWAREMALTESTTEST USERVIRUSJOHN DOESANGFORJOHN-PCSANDBOX7SILVIAHANSPETER-PCMUELLER-PCWIN7 - TRAPSFORTINETTEQUILABOOMBOOMRUNDLL32.EXEFAILED TO GET EXECUTABLE PATHAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLDBGHELP.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT64.DLLCMDVRT32.DLLRTLINITUNICODESTRINGNTDLL.DLLZWQUERYLICENSEVALUEKERNEL-VMDETECTION-PRIVATENOT SPECIFIEDBAD_INDEXVMWAREFAILED TO RETRIEVE SMBIOS DATA.DETECT AS A VM BASED ON THE NUMBER OF CPU CORES.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON THE NUMBER OF CPU CORES.[-]DETECT AS A VM BASED ON PHYSICAL MEMORY SIZE.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON PHYSICAL MEMORY SIZE.[-]DETECT AS A VM BASED ON TOTAL DISK SIZE.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON TOTAL DISK SIZE.[-]DETECT AS A VM BASED ON SPECIFIC PROCESSES.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON SPECIFIC PROCESSES.[-]DETECT AS A VM BASED ON HARDWARE INFORMATION.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON HARDWARE INFORMATION.[-]DETECT AS A VM BASED ON SYSTEM BOOT TIME.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON SYSTEM BOOT TIME.[-]DETECT AS A VM BASED ON HYPER-V PRESENCE.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON HYPER-V PRESENCE.[-]DETECT AS A VM BASED ON TEMP FILE COUNT.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON TEMP FILE COUNT.[-]DETECT AS A VM BASED ON CPU TEMPERATURE.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON CPU TEMPERATURE.[-]DETECT AS A VM BASED ON GPU MEMORY.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON GPU MEMORY.[-]DETECT AS A VM BASED ON MAC ADDRESS PREFIX.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON MAC ADDRESS PREFIX.[-]DETECT AS A VM BASED ON USERNAMES.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON USERNAMES.[-]DETECT AS A VM BASED ON NETBIOS NAME.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON NETBIOS NAME.[-]DETECT AS A VM BASED ON RUNDLL32 PARENT PROCESS.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON RUNDLL32 PARENT PROCESS.[-]VOIDWALKERDETECT AS A VM BASED ON CURRENT PROCESS FILENAME.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON CURRENT PROCESS FILENAME.[-]DETECT AS A VM BASED ON EXECUTABLE RUN PATH.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON EXECUTABLE RUN PATH.[-]DETECT AS A VM BASED ON DLLS LOADED.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON DLLS LOADED.[-]DETECT AS A VM BASED ON POWER CAPABILITIES.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON POWER CAPABILITIES.[-]DETECT AS A VM BASED ON LICENSE VALUES.[+]DETECT AS PHYSICAL ENVIRONMENT BASED ON LICENSE VALUES.[-]DETECT AS A VM BASED ON MOTHERBOARD INFO.[+]DETECT AS PHYSICAL ENVIRON
Source: Wk6IMAhBNF.exe	Binary or memory string: SBIEDLL.DLL
Source: Wk6IMAhBNF.exe	Binary or memory string: API_LOG.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4942D7 second address: 4942BF instructions: 0x00000000 rdtsc 0x00000002 mov cx, dx 0x00000005 lea esp, dword ptr [esp+01h] 0x00000009 lea esi, dword ptr [esi+0000010Ch] 0x0000000f mov dx, word ptr [esp] 0x00000013 xchg edx, eax 0x00000015 jmp 00007FD76946955Dh 0x00000017 mov dl, bh 0x00000019 mov dl, byte ptr [esp] 0x0000001c xchg ax, cx 0x0000001e xchg dword ptr [esp+14h], esi 0x00000022 mov cl, ah 0x00000024 rcr eax, 02h 0x00000027 jmp 00007FD76946957Ah 0x00000029 rcl edx, 11h 0x0000002c not al 0x0000002e push dword ptr [esp+14h] 0x00000032 retn 0018h 0x00000035 mov edi, dword ptr [ebp+00h] 0x00000038 push ecx 0x00000039 pushfd 0x0000003a jmp 00007FD76946951Fh 0x0000003f mov dx, FB6Dh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483E80 second address: 483EDF instructions: 0x00000000 rdtsc 0x00000002 lea edx, dword ptr [6E0A2F6Eh] 0x00000008 pushad 0x00000009 add esp, 09h 0x0000000c jmp 00007FD76852F799h 0x00000011 lea esp, dword ptr [esp+03h] 0x00000015 lea esp, dword ptr [esp+14h] 0x00000019 neg esi 0x0000001b mov dx, 6A6Fh 0x0000001f mov bh, ch 0x00000021 jmp 00007FD76852F6C5h 0x00000023 mov bx, word ptr [esp] 0x00000027 dec esi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483EDF second address: 483E9F instructions: 0x00000000 rdtsc 0x00000002 sub esp, 0Eh 0x00000005 jnc 00007FD76946956Bh 0x00000007 jmp 00007FD76946958Ah 0x00000009 mov ebx, 516A27D9h 0x0000000e pushad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483E9F second address: 483FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD76852F720h 0x00000004 lea esp, dword ptr [esp+02h] 0x00000008 rol esi, 00000000h 0x0000000b bsf eax, ebx 0x0000000e jmp 00007FD76852F749h 0x00000010 js 00007FD76852F6DDh 0x00000012 bsr ebx, esp 0x00000015 stc 0x00000016 call 00007FD76852F73Dh 0x0000001b or ax, dx 0x0000001e clc 0x0000001f mov eax, dword ptr [esp] 0x00000022 lea ebx, dword ptr [ecx+edx] 0x00000025 mov al, D8h 0x00000027 jmp 00007FD76852F75Ah 0x00000029 xchg dword ptr [esp], ecx 0x0000002c neg ah 0x0000002e mov eax, dword ptr [esp] 0x00000031 call 00007FD76852F6DEh 0x00000036 lea eax, dword ptr [00000000h+ebx4] 0x0000003d mov dl, al 0x0000003f lea ecx, dword ptr [ecx+3Eh] 0x00000042 jmp 00007FD76852F716h 0x00000044 bsf eax, edx 0x00000047 mov edx, dword ptr [esp] 0x0000004a bts dx, dx 0x0000004e mov bh, byte ptr [esp] 0x00000051 xchg dword ptr [esp+04h], ecx 0x00000055 pushad 0x00000056 jmp 00007FD76852F7C7h 0x0000005b mov ax, F820h 0x0000005f push word ptr [esp+05h] 0x00000064 lea edx, dword ptr [ebp+ebp+00h] 0x00000068 lea edx, dword ptr [esp+2BC2CE0Bh] 0x0000006f lea esp, dword ptr [esp+02h] 0x00000073 push dword ptr [esp+24h] 0x00000077 retn 0028h 0x0000007a setno bh 0x0000007d mov dx, word ptr [esp] 0x00000081 mov dh, 75h 0x00000083 jmp 00007FD76852F7B8h 0x00000088 lea esp, dword ptr [esp+2Ch] 0x0000008c sub esi, 44ECB633h 0x00000092 mov edx, DEDCAC1Dh 0x00000097 lea edx, dword ptr [00000000h+esi4] 0x0000009e mov bx, 519Ah 0x000000a2 jmp 00007FD76852F6E0h 0x000000a4 setl al 0x000000a7 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483FDB second address: 483FE0 instructions: 0x00000000 rdtsc 0x00000002 xchg dx, ax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483FE0 second address: 48468A instructions: 0x00000000 rdtsc 0x00000002 mov bh, 40h 0x00000004 xchg dx, bx 0x00000007 jmp 00007FD76852F733h 0x00000009 ror esi, 00000000h 0x0000000c setno al 0x0000000f bsf edx, esi 0x00000012 jnl 00007FD76852F77Ah 0x00000014 lea edx, dword ptr [eax+19h] 0x00000017 add esi, dword ptr [ebp+00h] 0x0000001a xchg dx, ax 0x0000001d xchg ax, bx 0x0000001f neg bx 0x00000022 jmp 00007FD76852F6D2h 0x00000024 jne 00007FD76852F6DAh 0x00000026 call 00007FD76852FD83h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49F853 second address: 49F83D instructions: 0x00000000 rdtsc 0x00000002 mov dh, byte ptr [esp] 0x00000005 jmp 00007FD769469585h 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49F83D second address: 49FA4C instructions: 0x00000000 rdtsc 0x00000002 lea ebx, dword ptr [00000000h+edi*4] 0x00000009 jmp 00007FD76852F724h 0x0000000b lea ebx, dword ptr [edi+50h] 0x0000000e stc 0x0000000f jmp 00007FD76852F8F5h 0x00000014 js 00007FD76852F531h 0x0000001a mov dh, byte ptr [esp] 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4817F1 second address: 481848 instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [00000000h+ebx4] 0x00000009 xchg dword ptr [esp], edx 0x0000000c mov eax, 2BDC9494h 0x00000011 xchg ch, al 0x00000013 jmp 00007FD769469577h 0x00000015 xchg al, ah 0x00000017 lea edx, dword ptr [edx+26h] 0x0000001a shr cl, 00000000h 0x0000001d lea ecx, dword ptr [00000000h+esi4] 0x00000024 jmp 00007FD7694695F4h 0x00000026 mov ax, C1B5h 0x0000002a shl ax, cl 0x0000002d xchg dword ptr [esp], edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4973BB second address: 4973FF instructions: 0x00000000 rdtsc 0x00000002 lea eax, dword ptr [eax+0000DC47h] 0x00000008 lea esp, dword ptr [esp+01h] 0x0000000c jmp 00007FD76852F6E9h 0x0000000e sub cl, bl 0x00000010 jne 00007FD76852F76Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 497619 second address: 4977C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD769469643h 0x00000007 inc edi 0x00000008 sub esp, 1Bh 0x0000000b jbe 00007FD7694694E1h 0x00000011 jnbe 00007FD769469534h 0x00000013 lea esp, dword ptr [esp+03h] 0x00000017 jmp 00007FD769469547h 0x00000019 call 00007FD7694695CFh 0x0000001e pop word ptr [esp] 0x00000022 mov ax, word ptr [esp] 0x00000026 sub esp, 16h 0x00000029 jle 00007FD76946957Fh 0x0000002b jnle 00007FD7694695D5h 0x0000002d xchg dword ptr [esp+11h], eax 0x00000031 xchg word ptr [esp+0Bh], dx 0x00000036 jmp 00007FD769469564h 0x00000038 lea esp, dword ptr [esp+18h] 0x0000003c inc cl 0x0000003e lea edx, dword ptr [00000000h+edx*4] 0x00000045 mov al, byte ptr [esp] 0x00000048 jmp 00007FD7694695ADh 0x0000004a lea edx, dword ptr [4AD3A4D5h] 0x00000050 dec ah 0x00000052 jnle 00007FD7694695CFh 0x00000054 mov al, byte ptr [esp] 0x00000057 pushad 0x00000058 jmp 00007FD769469639h 0x0000005d lea esp, dword ptr [esp+20h] 0x00000061 xor cl, 0000001Ch 0x00000064 adc dx, bx 0x00000067 jns 00007FD76946957Eh 0x00000069 mov eax, 7A1AD9E0h 0x0000006e neg eax 0x00000070 mov ax, word ptr [esp] 0x00000074 call 00007FD7694696D3h 0x00000079 jmp 00007FD7694694D2h 0x0000007e mov ax, 7A60h 0x00000082 add esp, 00000000h 0x00000085 jo 00007FD769469583h 0x00000087 jno 00007FD769469581h 0x00000089 lea esp, dword ptr [esp+04h] 0x0000008d add cl, 00000024h 0x00000090 jmp 00007FD7694695E5h 0x00000092 xchg dl, dh 0x00000094 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4977C6 second address: 4977F9 instructions: 0x00000000 rdtsc 0x00000002 bswap eax 0x00000004 bsf eax, esi 0x00000007 jnle 00007FD76852F73Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49E851 second address: 49E833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD769469575h 0x00000004 xchg ax, bx 0x00000006 xchg edx, ebx 0x00000008 lea ebx, dword ptr [A001857Bh] 0x0000000e push edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49668D second address: 496779 instructions: 0x00000000 rdtsc 0x00000002 neg dl 0x00000004 xor bx, 793Bh 0x00000009 call 00007FD76852F80Ch 0x0000000e add esp, 04h 0x00000011 jmp 00007FD76852F6CDh 0x00000013 jnbe 00007FD76852F726h 0x00000015 mov bh, bl 0x00000017 mov ebp, dword ptr [esp] 0x0000001a dec cx 0x0000001c jmp 00007FD76852F74Eh 0x0000001e jle 00007FD76852F6D8h 0x00000020 lea esp, dword ptr [esp+04h] 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 496779 second address: 483E80 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 mov ebx, dword ptr [esp] 0x00000007 jmp 00007FD7694695D7h 0x00000009 pop ecx 0x0000000a lea ebx, dword ptr [ebx+edi] 0x0000000d jmp 00007FD7694695A6h 0x0000000f mov bx, 6BD3h 0x00000013 jmp 00007FD769469666h 0x00000018 add esp, 20h 0x0000001b jnbe 00007FD769469577h 0x0000001d pop edi 0x0000001e jmp 00007FD769456B5Fh 0x00000023 mov ecx, esi 0x00000025 dec dx 0x00000027 jnl 00007FD7694695F1h 0x00000029 mov bx, si 0x0000002c lea eax, dword ptr [esp+ecx] 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49451A second address: 483E67 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD76852F7A4h 0x00000007 sub esp, 0Ch 0x0000000a lea eax, dword ptr [ecx-1A9709ADh] 0x00000010 pop ax 0x00000012 mov eax, edi 0x00000014 jmp 00007FD76852F6DCh 0x00000016 lea esp, dword ptr [esp+02h] 0x0000001a xchg dword ptr [esp+08h], ebx 0x0000001e mov ah, byte ptr [esp] 0x00000021 inc edx 0x00000022 call 00007FD76852F6EEh 0x00000027 or dh, 0000004Ah 0x0000002a lea ebx, dword ptr [ebx-000106FCh] 0x00000030 jmp 00007FD76852F72Eh 0x00000032 xchg ah, dh 0x00000034 mov eax, dword ptr [esp] 0x00000037 add ax, 0000DAEDh 0x0000003b pushad 0x0000003c mov word ptr [esp+14h], bx 0x00000041 jmp 00007FD76852F726h 0x00000043 xchg dword ptr [esp+2Ch], ebx 0x00000047 mov ax, si 0x0000004a mov edx, dword ptr [esp] 0x0000004d lea ebx, dword ptr [ecx+edx] 0x00000050 push dword ptr [esp+2Ch] 0x00000054 retn 0030h 0x00000057 mov ecx, esi 0x00000059 dec dx 0x0000005b jnl 00007FD76852F761h 0x0000005d mov bx, si 0x00000060 jmp 00007FD76852F746h 0x00000062 lea eax, dword ptr [esp+ecx] 0x00000065 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 483E67 second address: 483EDF instructions: 0x00000000 rdtsc 0x00000002 lea edx, dword ptr [6E0A2F6Eh] 0x00000008 jmp 00007FD7694697DDh 0x0000000d pushad 0x0000000e jmp 00007FD76946937Ch 0x00000013 add esp, 09h 0x00000016 jmp 00007FD769469629h 0x0000001b lea esp, dword ptr [esp+03h] 0x0000001f lea esp, dword ptr [esp+14h] 0x00000023 neg esi 0x00000025 mov dx, 6A6Fh 0x00000029 mov bh, ch 0x0000002b jmp 00007FD769469555h 0x0000002d mov bx, word ptr [esp] 0x00000031 dec esi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4D4A84 second address: 4D4A5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD76852F6DEh 0x00000004 inc esi 0x00000005 mov edx, 350F249Fh 0x0000000a mov ax, cx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4883D0 second address: 48838D instructions: 0x00000000 rdtsc 0x00000002 xchg dword ptr [esp], ebp 0x00000005 mov di, word ptr [esp] 0x00000009 setne al 0x0000000c rol ch, 1 0x0000000e mov ecx, dword ptr [esp] 0x00000011 jmp 00007FD7694694C3h 0x00000016 mov al, byte ptr [esp] 0x00000019 lea ebp, dword ptr [ebp-00000CF3h] 0x0000001f neg esi 0x00000021 mov edx, dword ptr [esp] 0x00000024 cmc 0x00000025 jmp 00007FD769469610h 0x00000027 xchg dword ptr [esp], ebp 0x0000002a mov cx, word ptr [esp] 0x0000002e not di 0x00000031 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 49EA50 second address: 49EB0F instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 shr edx, 10h 0x00000007 push dword ptr [esp+04h] 0x0000000b retn 0008h 0x0000000e mov dx, 95B3h 0x00000012 xchg al, dh 0x00000014 jmp 00007FD76852FA1Fh 0x00000019 neg dl 0x0000001b jbe 00007FD76852F640h 0x00000021 pushfd 0x00000022 setl dl 0x00000025 call 00007FD76852F5B1h 0x0000002a mov ax, 0335h 0x0000002e sub esp, 0Bh 0x00000031 bswap eax 0x00000033 bsf ax, di 0x00000037 lea esp, dword ptr [esp+03h] 0x0000003b jmp 00007FD76852F6D3h 0x0000003d xchg dword ptr [esp+08h], eax 0x00000041 mov dl, ch 0x00000043 bswap edx 0x00000045 call 00007FD76852F716h 0x0000004a bswap edx 0x0000004c lea eax, dword ptr [eax-0000012Ah] 0x00000052 shl dx, 000Eh 0x00000056 jmp 00007FD76852F735h 0x00000058 bswap edx 0x0000005a lea edx, dword ptr [esp+edi] 0x0000005d lea edx, dword ptr [00000000h+ebp*4] 0x00000064 xchg dword ptr [esp+0Ch], eax 0x00000068 neg eax 0x0000006a btc dx, bp 0x0000006e jmp 00007FD76852F761h 0x00000070 lea eax, dword ptr [edx+000000C4h] 0x00000076 adc edx, D6A078C9h 0x0000007c push dword ptr [esp+0Ch] 0x00000080 retn 0010h 0x00000083 pop word ptr [esp] 0x00000087 xchg byte ptr [esp], dh 0x0000008a jmp 00007FD76852F72Ch 0x0000008c xchg byte ptr [esp], dl 0x0000008f bsf dx, cx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4D43DB second address: 4D4464 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD7694695CAh 0x00000004 sub ebp, 02h 0x00000007 mov edx, esi 0x00000009 sbb eax, 5B71667Fh 0x0000000e je 00007FD7694695DEh 0x00000010 jne 00007FD7694695BEh 0x00000012 lea edx, dword ptr [edx+edi] 0x00000015 bts eax, ebx 0x00000018 call 00007FD7694696EBh 0x0000001d mov ax, bx 0x00000020 xchg edx, eax 0x00000022 jmp 00007FD7694694FCh 0x00000027 mov ah, 70h 0x00000029 xchg dword ptr [esp], ebp 0x0000002c lea edx, dword ptr [00000000h+esi*4] 0x00000033 mov edx, 97CF5B70h 0x00000038 not dh 0x0000003a lea ebp, dword ptr [ebp+19h] 0x0000003d jmp 00007FD769469553h 0x0000003f xchg dl, dh 0x00000041 mov ax, 6802h 0x00000045 mov dl, byte ptr [esp] 0x00000048 pushad 0x00000049 call 00007FD769469580h 0x0000004e xchg dword ptr [esp+24h], ebp 0x00000052 mov dx, word ptr [esp] 0x00000056 jmp 00007FD7694695BDh 0x00000058 mov dx, 42AEh 0x0000005c mov eax, 7814848Ah 0x00000061 push dword ptr [esp+24h] 0x00000065 retn 0028h 0x00000068 or word ptr [ebp+04h], bx 0x0000006c mov eax, edi 0x0000006e mov al, byte ptr [esp] 0x00000071 jmp 00007FD7694695A6h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4D43FF second address: 4D4464 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD76852F716h 0x00000004 sub ebp, 02h 0x00000007 mov edx, esi 0x00000009 sbb eax, 5B71667Fh 0x0000000e je 00007FD76852F74Eh 0x00000010 jne 00007FD76852F72Eh 0x00000012 lea edx, dword ptr [edx+edi] 0x00000015 bts eax, ebx 0x00000018 call 00007FD76852F85Bh 0x0000001d mov ax, bx 0x00000020 xchg edx, eax 0x00000022 jmp 00007FD76852F66Ch 0x00000027 mov ah, 70h 0x00000029 xchg dword ptr [esp], ebp 0x0000002c lea edx, dword ptr [00000000h+esi*4] 0x00000033 mov edx, 97CF5B70h 0x00000038 not dh 0x0000003a lea ebp, dword ptr [ebp+19h] 0x0000003d jmp 00007FD76852F6C3h 0x0000003f xchg dl, dh 0x00000041 mov ax, 6802h 0x00000045 mov dl, byte ptr [esp] 0x00000048 pushad 0x00000049 call 00007FD76852F6F0h 0x0000004e xchg dword ptr [esp+24h], ebp 0x00000052 mov dx, word ptr [esp] 0x00000056 jmp 00007FD76852F72Dh 0x00000058 mov dx, 42AEh 0x0000005c mov eax, 7814848Ah 0x00000061 push dword ptr [esp+24h] 0x00000065 retn 0028h 0x00000068 or word ptr [ebp+04h], bx 0x0000006c mov eax, edi 0x0000006e mov al, byte ptr [esp] 0x00000071 jmp 00007FD76852F716h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4D64FE second address: 4D651C instructions: 0x00000000 rdtsc 0x00000002 bts bx, di 0x00000006 je 00007FD769469609h 0x00000008 add ax, cx 0x0000000b jmp 00007FD7694695D3h 0x0000000d sub ebp, 02h 0x00000010 dec ax 0x00000012 jl 00007FD769469572h 0x00000014 bt edx, ebp 0x00000017 jmp 00007FD7694695A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4CE45A second address: 4CE535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD76852F97Ch 0x00000007 mov eax, BEF135F2h 0x0000000c lea edx, dword ptr [esp+ebx] 0x0000000f mov ax, sp 0x00000012 inc ax 0x00000014 jno 00007FD76852F56Eh 0x0000001a mov eax, ebp 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 4CE535 second address: 4CE55C instructions: 0x00000000 rdtsc 0x00000002 inc cl 0x00000004 mov eax, dword ptr [esp] 0x00000007 jmp 00007FD7694694F0h 0x0000000c neg eax 0x0000000e je 00007FD769469588h 0x00000010 mov eax, 7325303Fh 0x00000015 sub eax, ecx 0x00000017 xchg eax, edx 0x00000018 sub esp, 13h 0x0000001b lea esp, dword ptr [esp+03h] 0x0000001f jmp 00007FD7694695D2h 0x00000021 lea esp, dword ptr [esp+10h] 0x00000025 jmp 00007FD769469622h 0x0000002a xor cl, 0000001Ch 0x0000002d mov ah, dl 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 46B96A second address: 46BA09 instructions: 0x00000000 rdtsc 0x00000002 mov cl, byte ptr [esp] 0x00000005 xchg edi, eax 0x00000007 push dword ptr [esp+14h] 0x0000000b retn 0018h 0x0000000e push 00000000h 0x00000013 jmp 00007FD76853007Fh 0x00000018 mov esi, dword ptr [esp+2Ch] 0x0000001c jmp 00007FD76852F786h 0x0000001e lea ebp, dword ptr [esp] 0x00000021 sub esp, 000000C0h 0x00000027 mov edi, esp 0x00000029 call 00007FD76852F6CCh 0x0000002e neg edx 0x00000030 mov eax, dword ptr [esp] 0x00000033 bsf ecx, ecx 0x00000036 xchg dword ptr [esp], ebx 0x00000039 add cx, B33Ch 0x0000003e jmp 00007FD76852F6EAh 0x00000040 lea eax, dword ptr [00000000h+ebx4] 0x00000047 setp ch 0x0000004a neg cx 0x0000004d jmp 00007FD76852F72Bh 0x0000004f lea ebx, dword ptr [ebx-00000084h] 0x00000055 bswap ecx 0x00000057 add dl, ch 0x00000059 lea eax, dword ptr [00000000h+edx4] 0x00000060 inc dx 0x00000062 btc ax, bp 0x00000066 jmp 00007FD76852F747h 0x00000068 xchg dword ptr [esp], ebx 0x0000006b mov dl, byte ptr [esp] 0x0000006e call 00007FD76852F6F4h 0x00000073 pop eax 0x00000074 mov edx, 3C867E29h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	RDTSC instruction interceptor: First address: 40E1B7 second address: 40E1C1 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 call dword ptr [0043806Ch] 0x0000000a jmp dword ptr [022CCA2Fh] 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 mov eax, dword ptr [eax+18h] 0x00000019 ret 0x0000001a rdtsc

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0040DC56 rdtsc

0_2_0040DC56

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: __EH_prolog3_GS,GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,

0_2_0040CEF5

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Window / User API: threadDelayed 489	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Window / User API: threadDelayed 2183	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Window / User API: threadDelayed 3571	Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_0-71203
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_0-71204

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 1436	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 1436	Thread sleep time: -292000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 2072	Thread sleep count: 489 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 2072	Thread sleep time: -489000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 2300	Thread sleep count: 2183 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 1436	Thread sleep count: 216 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 1436	Thread sleep time: -864000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 2072	Thread sleep count: 3571 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe TID: 2072	Thread sleep time: -3571000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_computersystem

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Thread sleep count: Count: 2183 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_058880E0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_058880E0

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05887400 GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_05887400

Source: Wk6IMAhBNF.exe	Binary or memory string: VMware
Source: Wk6IMAhBNF.exe	Binary or memory string: VBoxService.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: Detect as physical environment based on Hyper-V presence.[-]
Source: Wk6IMAhBNF.exe	Binary or memory string: vmware
Source: Wk6IMAhBNF.exe	Binary or memory string: .lnkROOT\WMISELECT * FROM MSAcpi_ThermalZoneTemperatureWQLCurrentTemperature08-00-2700-03-FF00-05-6900-0C-2900-50-56\\.\PhysicalDrive0VBoxService.exeVBoxTray.exevmware.exevmtoolsd.exeVirtual MachineTEMP\ROOT\CIMV2SELECT FROM SerialNumberWin32_BaseBoardNoneCaptionWin32_DiskDriveVMwareVBOXVirtual HDModelWin32_computersystemVirtualBoxFailed to create D3D11 device.Failed to create DXGI factory.CurrentUserSandboxEmilyHAPUBWSHong LeeIT-ADMINJohnsonMillermilozsPeter Wilsontimmyusersand boxmalwaremaltesttest uservirusJohn DoeSangforJOHN-PCSANDBOX7SILVIAHANSPETER-PCMUELLER-PCWIN7 - TRAPSFORTINETTEQUILABOOMBOOMrundll32.exeFailed to get executable pathavghookx.dllavghooka.dllsnxhk.dllsbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dllcmdvrt64.dllcmdvrt32.dllRtlInitUnicodeStringntdll.dllZwQueryLicenseValueKernel-VMDetection-PrivateNot SpecifiedBAD_INDEXvmwareFailed to retrieve SMBIOS data.Detect as a VM based on the number of CPU cores.[+]Detect as physical environment based on the number of CPU cores.[-]Detect as a VM based on physical memory size.[+]Detect as physical environment based on physical memory size.[-]Detect as a VM based on total disk size.[+]Detect as physical environment based on total disk size.[-]Detect as a VM based on specific processes.[+]Detect as physical environment based on specific processes.[-]Detect as a VM based on hardware information.[+]Detect as physical environment based on hardware information.[-]Detect as a VM based on system boot time.[+]Detect as physical environment based on system boot time.[-]Detect as a VM based on Hyper-V presence.[+]Detect as physical environment based on Hyper-V presence.[-]Detect as a VM based on temp file count.[+]Detect as physical environment based on temp file count.[-]Detect as a VM based on CPU temperature.[+]Detect as physical environment based on CPU temperature.[-]Detect as a VM based on GPU memory.[+]Detect as physical environment based on GPU memory.[-]Detect as a VM based on MAC address prefix.[+]Detect as physical environment based on MAC address prefix.[-]Detect as a VM based on usernames.[+]Detect as physical environment based on usernames.[-]Detect as a VM based on NetBIOS name.[+]Detect as physical environment based on NetBIOS name.[-]Detect as a VM based on rundll32 parent process.[+]Detect as physical environment based on rundll32 parent process.[-]VoidWalkerDetect as a VM based on current process filename.[+]Detect as physical environment based on current process filename.[-]Detect as a VM based on executable run path.[+]Detect as physical environment based on executable run path.[-]Detect as a VM based on DLLs loaded.[+]Detect as physical environment based on DLLs loaded.[-]Detect as a VM based on power capabilities.[+]Detect as physical environment based on power capabilities.[-]Detect as a VM based on license values.[+]Detect as physical environment based on license values.[-]Detect as a VM based on motherboard info.[+]Detect as physical environ
Source: Wk6IMAhBNF.exe	Binary or memory string: vmtoolsd.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: vmware.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: Detect as a VM based on Hyper-V presence.[+]
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: Wk6IMAhBNF.exe	Binary or memory string: VBoxTray.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: Virtual HD
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: Wk6IMAhBNF.exe, 00000000.00000002.4457620055.000000000082C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

API call chain: ExitProcess graph end node

graph_0-71703

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Process Stats: CPU usage > 42% for more than 60s

Hides threads from debuggers

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Thread information set: HideFromDebugger			Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0040DC56 Start: 0040E1CD End: 0040E1C1		0_2_0040DC56
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_004882F3 Start: 0048838D End: 004883D0		0_2_004882F3

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0040DC56 rdtsc

0_2_0040DC56

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_02404305 LdrInitializeThunk,

0_2_02404305

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588EEFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0588EEFA

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0589043B VirtualProtect ?,-00000001,00000104,?

0_2_0589043B

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05887480 wsprintfW,LoadLibraryW,GetProcAddress,MultiByteToWideChar,swprintf,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,

0_2_05887480

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0042073A mov eax, dword ptr fs:[00000030h]	0_2_0042073A
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226AEAF mov ecx, dword ptr fs:[00000030h]	0_2_0226AEAF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB22E mov eax, dword ptr fs:[00000030h]	0_2_022AB22E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C234 mov eax, dword ptr fs:[00000030h]	0_2_0229C234
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C234 mov ecx, dword ptr fs:[00000030h]	0_2_0229C234
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A320F mov eax, dword ptr fs:[00000030h]	0_2_022A320F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A320F mov ecx, dword ptr fs:[00000030h]	0_2_022A320F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF262 mov eax, dword ptr fs:[00000030h]	0_2_022BF262
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF262 mov eax, dword ptr fs:[00000030h]	0_2_022BF262
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AC27F mov eax, dword ptr fs:[00000030h]	0_2_022AC27F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02298273 mov eax, dword ptr fs:[00000030h]	0_2_02298273
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02298273 mov ecx, dword ptr fs:[00000030h]	0_2_02298273
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB243 mov eax, dword ptr fs:[00000030h]	0_2_022BB243
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB243 mov eax, dword ptr fs:[00000030h]	0_2_022BB243
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB243 mov eax, dword ptr fs:[00000030h]	0_2_022BB243
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB243 mov eax, dword ptr fs:[00000030h]	0_2_022BB243
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E251 mov eax, dword ptr fs:[00000030h]	0_2_0229E251
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E251 mov eax, dword ptr fs:[00000030h]	0_2_0229E251
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225C2ED mov eax, dword ptr fs:[00000030h]	0_2_0225C2ED
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B52E7 mov eax, dword ptr fs:[00000030h]	0_2_022B52E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B52E7 mov eax, dword ptr fs:[00000030h]	0_2_022B52E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A72FF mov ecx, dword ptr fs:[00000030h]	0_2_022A72FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022942FF mov eax, dword ptr fs:[00000030h]	0_2_022942FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F2FF mov eax, dword ptr fs:[00000030h]	0_2_0228F2FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F2FF mov eax, dword ptr fs:[00000030h]	0_2_0228F2FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022862CD mov eax, dword ptr fs:[00000030h]	0_2_022862CD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022862CD mov eax, dword ptr fs:[00000030h]	0_2_022862CD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226A2DA mov eax, dword ptr fs:[00000030h]	0_2_0226A2DA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C320 mov eax, dword ptr fs:[00000030h]	0_2_0229C320
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C320 mov eax, dword ptr fs:[00000030h]	0_2_0229C320
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BA327 mov eax, dword ptr fs:[00000030h]	0_2_022BA327
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BA327 mov eax, dword ptr fs:[00000030h]	0_2_022BA327
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF338 mov eax, dword ptr fs:[00000030h]	0_2_022BF338
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF338 mov eax, dword ptr fs:[00000030h]	0_2_022BF338
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B7370 mov eax, dword ptr fs:[00000030h]	0_2_022B7370
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228D374 mov eax, dword ptr fs:[00000030h]	0_2_0228D374
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A335F mov eax, dword ptr fs:[00000030h]	0_2_022A335F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A335F mov ecx, dword ptr fs:[00000030h]	0_2_022A335F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A83BF mov ecx, dword ptr fs:[00000030h]	0_2_022A83BF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AC3BF mov eax, dword ptr fs:[00000030h]	0_2_022AC3BF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B399 mov eax, dword ptr fs:[00000030h]	0_2_0226B399
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9395 mov eax, dword ptr fs:[00000030h]	0_2_022A9395
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D3EF mov eax, dword ptr fs:[00000030h]	0_2_0229D3EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A83FF mov eax, dword ptr fs:[00000030h]	0_2_022A83FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BD3CF mov eax, dword ptr fs:[00000030h]	0_2_022BD3CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BD3CF mov ecx, dword ptr fs:[00000030h]	0_2_022BD3CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227E03F mov eax, dword ptr fs:[00000030h]	0_2_0227E03F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02283030 mov eax, dword ptr fs:[00000030h]	0_2_02283030
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02283030 mov eax, dword ptr fs:[00000030h]	0_2_02283030
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02283030 mov eax, dword ptr fs:[00000030h]	0_2_02283030
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02283030 mov eax, dword ptr fs:[00000030h]	0_2_02283030
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02283030 mov eax, dword ptr fs:[00000030h]	0_2_02283030
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229001F mov eax, dword ptr fs:[00000030h]	0_2_0229001F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C01F mov eax, dword ptr fs:[00000030h]	0_2_0229C01F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B507B mov eax, dword ptr fs:[00000030h]	0_2_022B507B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B507B mov eax, dword ptr fs:[00000030h]	0_2_022B507B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F07F mov eax, dword ptr fs:[00000030h]	0_2_0228F07F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F07F mov eax, dword ptr fs:[00000030h]	0_2_0228F07F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F07F mov eax, dword ptr fs:[00000030h]	0_2_0228F07F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F07F mov eax, dword ptr fs:[00000030h]	0_2_0228F07F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AC04F mov eax, dword ptr fs:[00000030h]	0_2_022AC04F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C059 mov eax, dword ptr fs:[00000030h]	0_2_0229C059
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A90AF mov eax, dword ptr fs:[00000030h]	0_2_022A90AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A90AF mov eax, dword ptr fs:[00000030h]	0_2_022A90AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A90AF mov eax, dword ptr fs:[00000030h]	0_2_022A90AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A90AF mov eax, dword ptr fs:[00000030h]	0_2_022A90AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A90AF mov eax, dword ptr fs:[00000030h]	0_2_022A90AF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022650BF mov eax, dword ptr fs:[00000030h]	0_2_022650BF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E0EE mov eax, dword ptr fs:[00000030h]	0_2_0229E0EE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022900CF mov eax, dword ptr fs:[00000030h]	0_2_022900CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF0CC mov eax, dword ptr fs:[00000030h]	0_2_022BF0CC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF0CC mov eax, dword ptr fs:[00000030h]	0_2_022BF0CC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF0CC mov eax, dword ptr fs:[00000030h]	0_2_022BF0CC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF0CC mov eax, dword ptr fs:[00000030h]	0_2_022BF0CC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5129 mov eax, dword ptr fs:[00000030h]	0_2_022B5129
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227D13F mov eax, dword ptr fs:[00000030h]	0_2_0227D13F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227D13F mov ecx, dword ptr fs:[00000030h]	0_2_0227D13F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227D13F mov eax, dword ptr fs:[00000030h]	0_2_0227D13F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D16C mov eax, dword ptr fs:[00000030h]	0_2_0229D16C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D16C mov eax, dword ptr fs:[00000030h]	0_2_0229D16C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E173 mov eax, dword ptr fs:[00000030h]	0_2_0229E173
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229C195 mov eax, dword ptr fs:[00000030h]	0_2_0229C195
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B1FC mov eax, dword ptr fs:[00000030h]	0_2_0226B1FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B1FC mov ecx, dword ptr fs:[00000030h]	0_2_0226B1FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B1FC mov eax, dword ptr fs:[00000030h]	0_2_0226B1FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE1CE mov eax, dword ptr fs:[00000030h]	0_2_022BE1CE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE1CE mov eax, dword ptr fs:[00000030h]	0_2_022BE1CE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022631DF mov eax, dword ptr fs:[00000030h]	0_2_022631DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022631DF mov ecx, dword ptr fs:[00000030h]	0_2_022631DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A663F mov eax, dword ptr fs:[00000030h]	0_2_022A663F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A663F mov eax, dword ptr fs:[00000030h]	0_2_022A663F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B1636 mov eax, dword ptr fs:[00000030h]	0_2_022B1636
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B1636 mov ecx, dword ptr fs:[00000030h]	0_2_022B1636
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE609 mov eax, dword ptr fs:[00000030h]	0_2_022BE609
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C66F mov eax, dword ptr fs:[00000030h]	0_2_0228C66F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C66F mov eax, dword ptr fs:[00000030h]	0_2_0228C66F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C66F mov eax, dword ptr fs:[00000030h]	0_2_0228C66F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B964D mov eax, dword ptr fs:[00000030h]	0_2_022B964D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB646 mov eax, dword ptr fs:[00000030h]	0_2_022BB646
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228D65F mov eax, dword ptr fs:[00000030h]	0_2_0228D65F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228D65F mov ecx, dword ptr fs:[00000030h]	0_2_0228D65F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B6653 mov eax, dword ptr fs:[00000030h]	0_2_022B6653
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227C6EF mov eax, dword ptr fs:[00000030h]	0_2_0227C6EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227C6EF mov ecx, dword ptr fs:[00000030h]	0_2_0227C6EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AC6FB mov eax, dword ptr fs:[00000030h]	0_2_022AC6FB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022906CF mov eax, dword ptr fs:[00000030h]	0_2_022906CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E6DF mov eax, dword ptr fs:[00000030h]	0_2_0229E6DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E6DF mov eax, dword ptr fs:[00000030h]	0_2_0229E6DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AA728 mov eax, dword ptr fs:[00000030h]	0_2_022AA728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AA728 mov eax, dword ptr fs:[00000030h]	0_2_022AA728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AA728 mov eax, dword ptr fs:[00000030h]	0_2_022AA728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AA728 mov eax, dword ptr fs:[00000030h]	0_2_022AA728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AA728 mov ecx, dword ptr fs:[00000030h]	0_2_022AA728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB728 mov eax, dword ptr fs:[00000030h]	0_2_022BB728
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7720 mov eax, dword ptr fs:[00000030h]	0_2_022A7720
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7720 mov ecx, dword ptr fs:[00000030h]	0_2_022A7720
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE737 mov eax, dword ptr fs:[00000030h]	0_2_022BE737
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE737 mov eax, dword ptr fs:[00000030h]	0_2_022BE737
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B716 mov eax, dword ptr fs:[00000030h]	0_2_0226B716
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B716 mov eax, dword ptr fs:[00000030h]	0_2_0226B716
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228171F mov eax, dword ptr fs:[00000030h]	0_2_0228171F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2771 mov eax, dword ptr fs:[00000030h]	0_2_022A2771
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2771 mov eax, dword ptr fs:[00000030h]	0_2_022A2771
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2771 mov eax, dword ptr fs:[00000030h]	0_2_022A2771
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A777 mov eax, dword ptr fs:[00000030h]	0_2_0228A777
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A777 mov eax, dword ptr fs:[00000030h]	0_2_0228A777
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A777 mov eax, dword ptr fs:[00000030h]	0_2_0228A777
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A777 mov eax, dword ptr fs:[00000030h]	0_2_0228A777
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B57A2 mov eax, dword ptr fs:[00000030h]	0_2_022B57A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B57A2 mov eax, dword ptr fs:[00000030h]	0_2_022B57A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E78F mov eax, dword ptr fs:[00000030h]	0_2_0229E78F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229E78F mov eax, dword ptr fs:[00000030h]	0_2_0229E78F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228379E mov ecx, dword ptr fs:[00000030h]	0_2_0228379E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228379E mov eax, dword ptr fs:[00000030h]	0_2_0228379E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F7FF mov eax, dword ptr fs:[00000030h]	0_2_0228F7FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F7FF mov eax, dword ptr fs:[00000030h]	0_2_0228F7FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F7FF mov eax, dword ptr fs:[00000030h]	0_2_0228F7FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F7FF mov eax, dword ptr fs:[00000030h]	0_2_0228F7FF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022907D6 mov eax, dword ptr fs:[00000030h]	0_2_022907D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B42C mov eax, dword ptr fs:[00000030h]	0_2_0228B42C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B42C mov eax, dword ptr fs:[00000030h]	0_2_0228B42C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B42C mov ecx, dword ptr fs:[00000030h]	0_2_0228B42C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C43F mov eax, dword ptr fs:[00000030h]	0_2_0228C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C43F mov eax, dword ptr fs:[00000030h]	0_2_0228C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C43F mov eax, dword ptr fs:[00000030h]	0_2_0228C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228C43F mov eax, dword ptr fs:[00000030h]	0_2_0228C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225C43F mov eax, dword ptr fs:[00000030h]	0_2_0225C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225C43F mov eax, dword ptr fs:[00000030h]	0_2_0225C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225C43F mov eax, dword ptr fs:[00000030h]	0_2_0225C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225C43F mov eax, dword ptr fs:[00000030h]	0_2_0225C43F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B24A4 mov eax, dword ptr fs:[00000030h]	0_2_022B24A4
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B24A4 mov eax, dword ptr fs:[00000030h]	0_2_022B24A4
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A848F mov ecx, dword ptr fs:[00000030h]	0_2_022A848F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB495 mov eax, dword ptr fs:[00000030h]	0_2_022BB495
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB495 mov eax, dword ptr fs:[00000030h]	0_2_022BB495
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D4EF mov eax, dword ptr fs:[00000030h]	0_2_0229D4EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022AB4E7 mov eax, dword ptr fs:[00000030h]	0_2_022AB4E7
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov ecx, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228F4CF mov eax, dword ptr fs:[00000030h]	0_2_0228F4CF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D52F mov eax, dword ptr fs:[00000030h]	0_2_0229D52F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BC571 mov eax, dword ptr fs:[00000030h]	0_2_022BC571
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF5B5 mov eax, dword ptr fs:[00000030h]	0_2_022BF5B5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF5B5 mov eax, dword ptr fs:[00000030h]	0_2_022BF5B5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF5B5 mov eax, dword ptr fs:[00000030h]	0_2_022BF5B5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF5B5 mov eax, dword ptr fs:[00000030h]	0_2_022BF5B5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B5B6 mov eax, dword ptr fs:[00000030h]	0_2_0228B5B6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B5B6 mov eax, dword ptr fs:[00000030h]	0_2_0228B5B6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228B5B6 mov eax, dword ptr fs:[00000030h]	0_2_0228B5B6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov ecx, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FA3F mov eax, dword ptr fs:[00000030h]	0_2_0228FA3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DA1F mov eax, dword ptr fs:[00000030h]	0_2_0229DA1F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DA1F mov eax, dword ptr fs:[00000030h]	0_2_0229DA1F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EA7F mov eax, dword ptr fs:[00000030h]	0_2_0229EA7F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225BA86 mov eax, dword ptr fs:[00000030h]	0_2_0225BA86
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225BA86 mov ecx, dword ptr fs:[00000030h]	0_2_0225BA86
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A3AFF mov eax, dword ptr fs:[00000030h]	0_2_022A3AFF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A3AFF mov eax, dword ptr fs:[00000030h]	0_2_022A3AFF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AACF mov eax, dword ptr fs:[00000030h]	0_2_0228AACF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AACF mov eax, dword ptr fs:[00000030h]	0_2_0228AACF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AACF mov eax, dword ptr fs:[00000030h]	0_2_0228AACF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AACF mov eax, dword ptr fs:[00000030h]	0_2_0228AACF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EADF mov eax, dword ptr fs:[00000030h]	0_2_0229EADF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EADF mov eax, dword ptr fs:[00000030h]	0_2_0229EADF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02289B22 mov ecx, dword ptr fs:[00000030h]	0_2_02289B22
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02289B22 mov eax, dword ptr fs:[00000030h]	0_2_02289B22
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9B3F mov eax, dword ptr fs:[00000030h]	0_2_022A9B3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9B3F mov ecx, dword ptr fs:[00000030h]	0_2_022A9B3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DB0D mov eax, dword ptr fs:[00000030h]	0_2_0229DB0D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DB0D mov eax, dword ptr fs:[00000030h]	0_2_0229DB0D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BBB11 mov eax, dword ptr fs:[00000030h]	0_2_022BBB11
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BBB11 mov eax, dword ptr fs:[00000030h]	0_2_022BBB11
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BDB4E mov eax, dword ptr fs:[00000030h]	0_2_022BDB4E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BDB4E mov ecx, dword ptr fs:[00000030h]	0_2_022BDB4E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5BAF mov eax, dword ptr fs:[00000030h]	0_2_022B5BAF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2B9B mov eax, dword ptr fs:[00000030h]	0_2_022A2B9B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2B9B mov eax, dword ptr fs:[00000030h]	0_2_022A2B9B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5BF3 mov eax, dword ptr fs:[00000030h]	0_2_022B5BF3
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5BF3 mov eax, dword ptr fs:[00000030h]	0_2_022B5BF3
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EBDF mov eax, dword ptr fs:[00000030h]	0_2_0229EBDF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF823 mov eax, dword ptr fs:[00000030h]	0_2_022BF823
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226087E mov eax, dword ptr fs:[00000030h]	0_2_0226087E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A3873 mov eax, dword ptr fs:[00000030h]	0_2_022A3873
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B6845 mov eax, dword ptr fs:[00000030h]	0_2_022B6845
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B6845 mov eax, dword ptr fs:[00000030h]	0_2_022B6845
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B6845 mov eax, dword ptr fs:[00000030h]	0_2_022B6845
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A185B mov ecx, dword ptr fs:[00000030h]	0_2_022A185B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB8B9 mov eax, dword ptr fs:[00000030h]	0_2_022BB8B9
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BB8B9 mov eax, dword ptr fs:[00000030h]	0_2_022BB8B9
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov eax, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov eax, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov eax, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov ecx, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov eax, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B288D mov ecx, dword ptr fs:[00000030h]	0_2_022B288D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5881 mov eax, dword ptr fs:[00000030h]	0_2_022B5881
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B5881 mov eax, dword ptr fs:[00000030h]	0_2_022B5881
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A78EF mov eax, dword ptr fs:[00000030h]	0_2_022A78EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A78EF mov ecx, dword ptr fs:[00000030h]	0_2_022A78EF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF8F0 mov eax, dword ptr fs:[00000030h]	0_2_022BF8F0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE8C0 mov eax, dword ptr fs:[00000030h]	0_2_022BE8C0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BE8C0 mov eax, dword ptr fs:[00000030h]	0_2_022BE8C0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228D8DF mov eax, dword ptr fs:[00000030h]	0_2_0228D8DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228D8DF mov ecx, dword ptr fs:[00000030h]	0_2_0228D8DF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A94D mov eax, dword ptr fs:[00000030h]	0_2_0228A94D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228A94D mov eax, dword ptr fs:[00000030h]	0_2_0228A94D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022909A2 mov eax, dword ptr fs:[00000030h]	0_2_022909A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022909A2 mov eax, dword ptr fs:[00000030h]	0_2_022909A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022909A2 mov eax, dword ptr fs:[00000030h]	0_2_022909A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022909A2 mov eax, dword ptr fs:[00000030h]	0_2_022909A2
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF9BD mov eax, dword ptr fs:[00000030h]	0_2_022BF9BD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF9BD mov eax, dword ptr fs:[00000030h]	0_2_022BF9BD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BF9BD mov eax, dword ptr fs:[00000030h]	0_2_022BF9BD
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229D9BF mov eax, dword ptr fs:[00000030h]	0_2_0229D9BF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B9BB mov eax, dword ptr fs:[00000030h]	0_2_0226B9BB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0226B9BB mov eax, dword ptr fs:[00000030h]	0_2_0226B9BB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B9E2E mov eax, dword ptr fs:[00000030h]	0_2_022B9E2E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2E3F mov eax, dword ptr fs:[00000030h]	0_2_022A2E3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2E3F mov ecx, dword ptr fs:[00000030h]	0_2_022A2E3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7E09 mov eax, dword ptr fs:[00000030h]	0_2_022A7E09
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7E09 mov eax, dword ptr fs:[00000030h]	0_2_022A7E09
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7E09 mov eax, dword ptr fs:[00000030h]	0_2_022A7E09
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7E09 mov eax, dword ptr fs:[00000030h]	0_2_022A7E09
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A7E09 mov ecx, dword ptr fs:[00000030h]	0_2_022A7E09
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02285E6C mov eax, dword ptr fs:[00000030h]	0_2_02285E6C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281E7D mov eax, dword ptr fs:[00000030h]	0_2_02281E7D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B2E49 mov eax, dword ptr fs:[00000030h]	0_2_022B2E49
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AE46 mov eax, dword ptr fs:[00000030h]	0_2_0228AE46
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AE46 mov eax, dword ptr fs:[00000030h]	0_2_0228AE46
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022ABE5F mov eax, dword ptr fs:[00000030h]	0_2_022ABE5F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FEAB mov eax, dword ptr fs:[00000030h]	0_2_0228FEAB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FEAB mov eax, dword ptr fs:[00000030h]	0_2_0228FEAB
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4EBA mov eax, dword ptr fs:[00000030h]	0_2_022B4EBA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AE8C mov eax, dword ptr fs:[00000030h]	0_2_0228AE8C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AE8C mov eax, dword ptr fs:[00000030h]	0_2_0228AE8C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228AE8C mov ecx, dword ptr fs:[00000030h]	0_2_0228AE8C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A1E85 mov eax, dword ptr fs:[00000030h]	0_2_022A1E85
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A1E85 mov eax, dword ptr fs:[00000030h]	0_2_022A1E85
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A1E85 mov eax, dword ptr fs:[00000030h]	0_2_022A1E85
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov ecx, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A6E93 mov eax, dword ptr fs:[00000030h]	0_2_022A6E93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DE93 mov eax, dword ptr fs:[00000030h]	0_2_0229DE93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DE93 mov ecx, dword ptr fs:[00000030h]	0_2_0229DE93
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227CECF mov eax, dword ptr fs:[00000030h]	0_2_0227CECF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227CECF mov eax, dword ptr fs:[00000030h]	0_2_0227CECF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227CECF mov eax, dword ptr fs:[00000030h]	0_2_0227CECF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225FED0 mov eax, dword ptr fs:[00000030h]	0_2_0225FED0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225FED0 mov eax, dword ptr fs:[00000030h]	0_2_0225FED0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225FED0 mov eax, dword ptr fs:[00000030h]	0_2_0225FED0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DF3F mov eax, dword ptr fs:[00000030h]	0_2_0229DF3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DF3F mov eax, dword ptr fs:[00000030h]	0_2_0229DF3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DF3F mov eax, dword ptr fs:[00000030h]	0_2_0229DF3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DF3F mov ecx, dword ptr fs:[00000030h]	0_2_0229DF3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02263F0B mov eax, dword ptr fs:[00000030h]	0_2_02263F0B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02263F0B mov ecx, dword ptr fs:[00000030h]	0_2_02263F0B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A1F10 mov eax, dword ptr fs:[00000030h]	0_2_022A1F10
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02292F12 mov eax, dword ptr fs:[00000030h]	0_2_02292F12
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02292F12 mov eax, dword ptr fs:[00000030h]	0_2_02292F12
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BF6F mov eax, dword ptr fs:[00000030h]	0_2_0227BF6F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BF6F mov ecx, dword ptr fs:[00000030h]	0_2_0227BF6F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BF6F mov eax, dword ptr fs:[00000030h]	0_2_0227BF6F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02285F5F mov eax, dword ptr fs:[00000030h]	0_2_02285F5F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02285F5F mov eax, dword ptr fs:[00000030h]	0_2_02285F5F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BCFAF mov ecx, dword ptr fs:[00000030h]	0_2_022BCFAF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2F8F mov eax, dword ptr fs:[00000030h]	0_2_022A2F8F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A2F8F mov ecx, dword ptr fs:[00000030h]	0_2_022A2F8F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B2F98 mov eax, dword ptr fs:[00000030h]	0_2_022B2F98
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov eax, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov ecx, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov eax, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov eax, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov eax, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02281F9C mov eax, dword ptr fs:[00000030h]	0_2_02281F9C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B9F97 mov eax, dword ptr fs:[00000030h]	0_2_022B9F97
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BDFEC mov eax, dword ptr fs:[00000030h]	0_2_022BDFEC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BEFDF mov eax, dword ptr fs:[00000030h]	0_2_022BEFDF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022BEFDF mov eax, dword ptr fs:[00000030h]	0_2_022BEFDF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022ABFDF mov eax, dword ptr fs:[00000030h]	0_2_022ABFDF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227DC35 mov eax, dword ptr fs:[00000030h]	0_2_0227DC35
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227DC35 mov eax, dword ptr fs:[00000030h]	0_2_0227DC35
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227DC35 mov eax, dword ptr fs:[00000030h]	0_2_0227DC35
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229EC3F mov eax, dword ptr fs:[00000030h]	0_2_0229EC3F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225EC06 mov eax, dword ptr fs:[00000030h]	0_2_0225EC06
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229FC0A mov eax, dword ptr fs:[00000030h]	0_2_0229FC0A
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225FC12 mov eax, dword ptr fs:[00000030h]	0_2_0225FC12
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02263C60 mov esi, dword ptr fs:[00000030h]	0_2_02263C60
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B2C79 mov eax, dword ptr fs:[00000030h]	0_2_022B2C79
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B2C79 mov eax, dword ptr fs:[00000030h]	0_2_022B2C79
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B2C79 mov eax, dword ptr fs:[00000030h]	0_2_022B2C79
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229FC70 mov eax, dword ptr fs:[00000030h]	0_2_0229FC70
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9C5F mov eax, dword ptr fs:[00000030h]	0_2_022A9C5F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A4CAF mov ecx, dword ptr fs:[00000030h]	0_2_022A4CAF
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225EC85 mov eax, dword ptr fs:[00000030h]	0_2_0225EC85
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225EC85 mov eax, dword ptr fs:[00000030h]	0_2_0225EC85
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DC8D mov eax, dword ptr fs:[00000030h]	0_2_0229DC8D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0229DC8D mov ecx, dword ptr fs:[00000030h]	0_2_0229DC8D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4C98 mov eax, dword ptr fs:[00000030h]	0_2_022B4C98
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4C98 mov eax, dword ptr fs:[00000030h]	0_2_022B4C98
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4C98 mov eax, dword ptr fs:[00000030h]	0_2_022B4C98
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225EC9F mov eax, dword ptr fs:[00000030h]	0_2_0225EC9F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0225EC9F mov eax, dword ptr fs:[00000030h]	0_2_0225EC9F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02291CED mov eax, dword ptr fs:[00000030h]	0_2_02291CED
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02291CED mov eax, dword ptr fs:[00000030h]	0_2_02291CED
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02289CC6 mov ecx, dword ptr fs:[00000030h]	0_2_02289CC6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_02289CC6 mov eax, dword ptr fs:[00000030h]	0_2_02289CC6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FD0F mov eax, dword ptr fs:[00000030h]	0_2_0228FD0F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FD0F mov eax, dword ptr fs:[00000030h]	0_2_0228FD0F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FD0F mov eax, dword ptr fs:[00000030h]	0_2_0228FD0F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228FD0F mov eax, dword ptr fs:[00000030h]	0_2_0228FD0F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4D06 mov eax, dword ptr fs:[00000030h]	0_2_022B4D06
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BD60 mov eax, dword ptr fs:[00000030h]	0_2_0227BD60
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BD60 mov eax, dword ptr fs:[00000030h]	0_2_0227BD60
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0227BD60 mov eax, dword ptr fs:[00000030h]	0_2_0227BD60
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9D53 mov eax, dword ptr fs:[00000030h]	0_2_022A9D53
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9D53 mov eax, dword ptr fs:[00000030h]	0_2_022A9D53
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9D53 mov eax, dword ptr fs:[00000030h]	0_2_022A9D53
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9D53 mov eax, dword ptr fs:[00000030h]	0_2_022A9D53
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022A9D53 mov ecx, dword ptr fs:[00000030h]	0_2_022A9D53
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022B4DE0 mov eax, dword ptr fs:[00000030h]	0_2_022B4DE0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228ADDE mov eax, dword ptr fs:[00000030h]	0_2_0228ADDE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228ADDE mov eax, dword ptr fs:[00000030h]	0_2_0228ADDE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228ADDE mov eax, dword ptr fs:[00000030h]	0_2_0228ADDE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0228ADDE mov eax, dword ptr fs:[00000030h]	0_2_0228ADDE
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D01EA mov eax, dword ptr fs:[00000030h]	0_2_023D01EA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D0425 mov eax, dword ptr fs:[00000030h]	0_2_023D0425
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov ecx, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D39F5 mov eax, dword ptr fs:[00000030h]	0_2_023D39F5
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov ecx, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov ecx, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov ecx, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov ecx, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023D6D75 mov eax, dword ptr fs:[00000030h]	0_2_023D6D75
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023F423D mov eax, dword ptr fs:[00000030h]	0_2_023F423D
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023C2237 mov eax, dword ptr fs:[00000030h]	0_2_023C2237
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023C2237 mov ecx, dword ptr fs:[00000030h]	0_2_023C2237
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0244B249 mov eax, dword ptr fs:[00000030h]	0_2_0244B249
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0244B249 mov eax, dword ptr fs:[00000030h]	0_2_0244B249
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0244025C mov eax, dword ptr fs:[00000030h]	0_2_0244025C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0244025C mov eax, dword ptr fs:[00000030h]	0_2_0244025C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0244025C mov eax, dword ptr fs:[00000030h]	0_2_0244025C
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245D265 mov eax, dword ptr fs:[00000030h]	0_2_0245D265
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245D265 mov eax, dword ptr fs:[00000030h]	0_2_0245D265
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0249326B mov eax, dword ptr fs:[00000030h]	0_2_0249326B
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245326F mov eax, dword ptr fs:[00000030h]	0_2_0245326F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245326F mov eax, dword ptr fs:[00000030h]	0_2_0245326F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245326F mov eax, dword ptr fs:[00000030h]	0_2_0245326F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0245326F mov eax, dword ptr fs:[00000030h]	0_2_0245326F
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023BB217 mov eax, dword ptr fs:[00000030h]	0_2_023BB217
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0247F273 mov eax, dword ptr fs:[00000030h]	0_2_0247F273
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0249527E mov eax, dword ptr fs:[00000030h]	0_2_0249527E
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023C8205 mov eax, dword ptr fs:[00000030h]	0_2_023C8205
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_023C8205 mov eax, dword ptr fs:[00000030h]	0_2_023C8205
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022881FC mov eax, dword ptr fs:[00000030h]	0_2_022881FC
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_022868D6 mov eax, dword ptr fs:[00000030h]	0_2_022868D6

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05886760 wsprintfW,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

0_2_05886760

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0588DE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	0_2_0588DE70
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_0588EEFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0588EEFA
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: 0_2_05891E57 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_05891E57

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_058877D0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_058877D0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

0_2_058877D0

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		0_2_058877D0
Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		0_2_058877D0

Source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: Wk6IMAhBNF.exe, 00000000.00000002.4460447783.0000000006D40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 min897506Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program ManagermQ
Source: Wk6IMAhBNF.exe, 00000000.00000002.4458910784.00000000029AC000.00000040.00000800.00020000.00000000.sdmp, Wk6IMAhBNF.exe, 00000000.00000003.2268938025.0000000002544000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0041910C cpuid

0_2_0041910C

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_05885430

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_0588DE70 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,

0_2_0588DE70

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05895C12 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,SetOaNoCache,

0_2_05895C12

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

Code function: 0_2_05886A40 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

0_2_05886A40

Source: Wk6IMAhBNF.exe	Binary or memory string: acs.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: avcenter.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: vsserv.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: cfp.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: avp.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: rtvscan.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: TMBMSRV.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: ashDisp.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: avgwdsvc.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: AYAgent.aye
Source: Wk6IMAhBNF.exe	Binary or memory string: QUHLPSVC.EXE
Source: Wk6IMAhBNF.exe	Binary or memory string: RavMonD.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: Mcshield.exe
Source: Wk6IMAhBNF.exe	Binary or memory string: K7TSecurity.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: Wk6IMAhBNF.exe PID: 2148, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Wk6IMAhBNF.exe

File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Jump to behavior

Remote Access Functionality

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: Wk6IMAhBNF.exe PID: 2148, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	22 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	131 Input Capture	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	211 Process Injection	4 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	21 Software Packing	NTDS	456 System Information Discovery	Distributed Component Object Model	131 Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1071 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	551 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	551 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Indicator Removal	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Wk6IMAhBNF.exe	47%	Virustotal		Browse
Wk6IMAhBNF.exe	58%	ReversingLabs	Win32.Backdoor.Farfli
Wk6IMAhBNF.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.199.100.97	unknown	Hong Kong		136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	true
103.199.100.130	unknown	Hong Kong		136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581277
Start date and time:	2024-12-27 09:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wk6IMAhBNF.exe renamed because original name is a hash value
Original Sample Name:	FF61853AA5A10D3FE8FBE0D5470DB9D0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 142 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:58:01	API Interceptor	1794036x Sleep call for process: Wk6IMAhBNF.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XIAOZHIYUN1-AS-APICIDCNETWORKUS	aQ7bSXduYp.exe	Get hash	malicious	GhostRat, Nitol	Browse	156.225.22.155
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.199.102.178
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.234.199.255
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	156.234.199.204
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	45.207.113.55
	arm5.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	156.226.203.160
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	156.226.185.157
	powerpc.elf	Get hash	malicious	Unknown	Browse	154.222.104.79
	arm6.elf	Get hash	malicious	Unknown	Browse	156.241.59.21
	x86_64.elf	Get hash	malicious	Mirai	Browse	156.253.67.13
XIAOZHIYUN1-AS-APICIDCNETWORKUS	aQ7bSXduYp.exe	Get hash	malicious	GhostRat, Nitol	Browse	156.225.22.155
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.199.102.178
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.234.199.255
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	156.234.199.204
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	45.207.113.55
	arm5.nn-20241218-0633.elf	Get hash	malicious	Mirai, Okiru	Browse	156.226.203.160
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	156.226.185.157
	powerpc.elf	Get hash	malicious	Unknown	Browse	154.222.104.79
	arm6.elf	Get hash	malicious	Unknown	Browse	156.241.59.21
	x86_64.elf	Get hash	malicious	Mirai	Browse	156.253.67.13

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.399987787468489
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Wk6IMAhBNF.exe
File size:	1'151'488 bytes
MD5:	ff61853aa5a10d3fe8fbe0d5470db9d0
SHA1:	bc6f2373b942643d275a062ac01367b197c3ad24
SHA256:	ec234980252c20fc05b927ffa9bc292c88f210bda8e2e532a38cf9cbd1e72557
SHA512:	efaf057bccde37bdda973f32162b8ba622f3068cb070b620ddfada51fe217cc2ee628392e12941fa52094714cbce3636707465dda8548e6c4ea83d9963373699
SSDEEP:	24576:zn9SATrbtCU1YU1ypNXtFwKaUgRirSKlcpnm3tJZGRhJ:70etbj1MN9FwKvS1CO
TLSH:	6035C041EF846235F76206314925B6A8957EADA10F7C866FB3E837196FF02F05433B26
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;................bl.m....bn......bo.a...v...~...D...e...D.......D...Z.......}...........v...f.......q.....b.~.......~.......~..

File Icon


Icon Hash:	24e28cc5858c8084

Static PE Info

General

Entrypoint:	0x5218c1
Entrypoint Section:	.NLDEE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x674D7D76 [Mon Dec 2 09:27:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fd6b522fd68eeeb14e5aef9ca64d0b85

Entrypoint Preview

Instruction
call 00007FD768EB1B01h
push ebx
popad
outsb
imul ebp, dword ptr [bp+65h], 69685320h
insb
outsb
and byte ptr [esi+32h], dh
xor al, 2Eh
xor byte ptr [esi], ch
xor byte ptr [eax], al
pushfd
push esp
std
pop word ptr [esp]
jmp 00007FD768EB1A17h
pop word ptr [esp]
push bp
mov ecx, 11337A34h
pop ebx
mov ch, F7h
jmp 00007FD768EB1B31h
and byte ptr [ebx-66h], ah
cmc
in al, 17h
neg ebx
call 00007FD768EB1AC8h
jns 00007FD768EB1B1Ah
cdq
sal ecx, cl
lodsd
pop eax
leave
pop ecx
cmp bl, cl
and al, ah
scasb
mov ecx, A20B8E9Fh
pop ebx
mov bp, word ptr [esp+03h]
mov bh, byte ptr [esp+06h]
add esp, 0Bh
xchg bh, bl
lea ecx, dword ptr [ebp-34h]
jmp 00007FD768EB1AB3h
lea ebp, dword ptr [edx-32h]
not bp
bsf ebx, eax
mov byte ptr [esp+0Dh], bl
rol cx, 000Ah
jmp 00007FD768EB1B15h
iretd
pop ebp
int 94h
retn 832Ch
in al, dx
adc eax, 2C8DE932h
das
shl bl, 00000006h
mov ebx, dword ptr [esp+10h]
xchg word ptr [esp+03h], bx
jmp 00007FD768EB1AB2h
lea ebx, dword ptr [ebp+ebp+00h]
bswap ecx
pop ebx
xchg byte ptr [esp+0Ch], bh
xchg byte ptr [esp+04h], ch
jmp 00007FD768EB1B50h
aas
push es
mov cl, B0h
mov bl, 8Fh
inc esp
and al, 09h
xchg word ptr [esp+02h], bx
lea ebx, dword ptr [00000000h+edi*4]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x123092	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x123f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11f0e6	0x38	.NLDEE
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x11ee91	0x18	.NLDEE
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37000	0x36200	79c194186c281f93880ebda46cb136fe	False	0.49544872257505773	data	6.604002199264506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x38000	0x15000	0x15000	8e4e4590d98592e23b7557317b6b9f6e	False	0.4557291666666667	data	5.354509808010684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x4d000	0x5000	0x1c00	5d42bf0c5f17814fbff963578d280cd8	False	0.18359375	DOS executable (block device driver ght (c)	3.1457387875637597	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x52000	0x1000	0x600	45e79a2bf91977e2f08fe9fff1122ee2	False	0.392578125	data	3.2112234147515863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x53000	0x1000	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x54000	0x13000	0x12400	49978127ccff3f09c0b02514c7ad2393	False	0.07551637414383562	data	3.249131762489739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x67000	0x4000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.NLDEE	0x6b000	0xb8000	0xb8000	bfb6be4841a29e55ff86d34b12d38b0a	False	0.8560857358186141	data	7.823713533239283	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x123000	0x1000	0x400	616745a10b72bf438d7dda59cb370437	False	0.388671875	data	3.552132181923483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.NLDEE	0x124000	0x1000	0x1000	aecc1fccef0b6640ad544c6ffd37e6f6	False	0.881103515625	data	7.969492875572023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x66260	0x2	data	Chinese	China	5.0
RT_ICON	0x542e0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	Chinese	China	0.04677317637166281
RT_ICON	0x5d788	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	Chinese	China	0.06589513462446858
RT_ICON	0x619b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.09387966804979253
RT_ICON	0x63f58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Chinese	China	0.1346153846153846
RT_ICON	0x65000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Chinese	China	0.19508196721311474
RT_ICON	0x65988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.27570921985815605
RT_DIALOG	0x661c8	0x94	data	Chinese	China	0.6959459459459459
RT_GROUP_ICON	0x65df0	0x5a	data	Chinese	China	0.7777777777777778
RT_VERSION	0x65e50	0x378	data	Chinese	China	0.4166666666666667
RT_MANIFEST	0x66268	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
WS2_32.dll	connect
KERNEL32.dll	ReadFile
USER32.dll	GetCursorPos
ADVAPI32.dll	RegCreateKeyW
ole32.dll	CoSetProxyBlanket
OLEAUT32.dll	VariantClear
WINMM.dll	timeGetTime
IPHLPAPI.DLL	GetAdaptersInfo
d3d11.dll	D3D11CreateDevice
dxgi.dll	CreateDXGIFactory
MSVCRT.dll	strncpy
PSAPI.DLL	GetMappedFileNameW
SHELL32.dll	SHGetFolderPathW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:57:51.073805+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49786	103.199.100.97	8080	TCP
2024-12-27T09:59:01.558575+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49786	103.199.100.97	8080	TCP
2024-12-27T10:00:12.511514+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49979	103.199.100.97	8080	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:57:50.566864967 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:50.686702967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:50.686850071 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:51.073805094 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:51.193733931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.235150099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.239933968 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.359623909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.359684944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.359714985 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.776906967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.776971102 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.777025938 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.777059078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.777059078 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.777095079 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.777129889 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.823285103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.987121105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.987198114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.987235069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.987260103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.987271070 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.987325907 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:52.995486021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.995603085 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:52.995661020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.004059076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.004115105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.004170895 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.012257099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.057674885 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.197392941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.197468996 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.197607040 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.201488018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.201559067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.201598883 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.207982063 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.208146095 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.208189011 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.216377974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.216496944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.216546059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.224811077 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.224855900 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.224903107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.233154058 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.233436108 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.233495951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.241569996 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.241684914 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.241729021 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.250004053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.250104904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.250165939 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.258325100 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.307775974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.408143044 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.408327103 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.408386946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.411900997 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.412020922 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.412070036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.419680119 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.419826984 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.419873953 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.426999092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.427120924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.427175999 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.434526920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.434642076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.434695959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.442065001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.442238092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.442289114 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.449645042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.449831963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.449879885 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.457247019 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.457384109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.457432985 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.464692116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.464843035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.464891911 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.472268105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.472481966 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.472528934 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.479733944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.479832888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.480163097 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.487329006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.487432957 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.487487078 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.494827986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.494997025 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.495043039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.618606091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.618695021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.618757010 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.621783018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.621943951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.621994972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.628151894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.628288031 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.628341913 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.634516001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.634643078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.634696960 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.640896082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.641073942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.641122103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.647248030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.647387028 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.647435904 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.653579950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.653717041 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.653767109 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.659975052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.660094976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.660141945 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.666414976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.666544914 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.666584015 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.672662973 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.672779083 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.672827005 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.679080009 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.679235935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.679291964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.685426950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.685549974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.685595036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.691762924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.691899061 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.691956997 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.698184967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.698333025 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.698384047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.704550028 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.704684019 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.704735994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.710983992 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.711136103 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.711184978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.717333078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.717474937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.717520952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.723726988 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.724334002 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.724387884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.730129957 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.730571985 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.730618954 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.736450911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.736865997 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.736923933 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.742711067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.792052031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.828506947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.828537941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.828588009 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.829756021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.829870939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.829916000 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.834554911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.834700108 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.834747076 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.839385986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.839541912 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.839587927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.844222069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.844351053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.844399929 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.848820925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.848928928 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.848975897 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.853327990 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.853455067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.853504896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.857707977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.857825041 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.857882977 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.862071991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.862226963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.862278938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.866354942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.866400003 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.866451979 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.870533943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.870632887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.870676994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.874701977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.874855995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.874907017 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.878892899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.879009962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.879055023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.883025885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.883079052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.883124113 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.887173891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.887326002 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.887366056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.891354084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.891460896 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.891503096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.895498991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.895627975 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.895673990 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.899684906 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.899898052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.899945974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.903831005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.903964996 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.904011965 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.908046007 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.908250093 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.908298969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.912159920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.912276030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.912328959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.916337013 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.916462898 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.916512012 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.920526981 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.920635939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.920677900 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.924680948 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.924819946 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.924906969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.928829908 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.928949118 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.928993940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.933032036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.933307886 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.933356047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.937170029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.937258005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.937299013 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.941323042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.941442966 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.941493034 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.945477009 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.945595026 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.945638895 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.949615955 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.949724913 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.949774027 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.953815937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.953928947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.953979969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:53.957990885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.958070993 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:53.958122969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:54.038671017 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.038789034 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.038830042 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:54.040034056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.040090084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.040133953 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:54.042855024 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.042958021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.043088913 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:54.045619011 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:54.088933945 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:55.074469090 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:57:55.194164991 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:57:55.194824934 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:00.315437078 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:00.435291052 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:00.435345888 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:00.435415030 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:00.435444117 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:01.096116066 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:01.096473932 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:01.220529079 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:11.479727983 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:11.600488901 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:12.033502102 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:12.073348045 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:12.099569082 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:12.219099998 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:29.026935101 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:29.146572113 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:29.580495119 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:29.635874033 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:29.713563919 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:29.833357096 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:48.636002064 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:48.755772114 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:49.192940950 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:58:49.307766914 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:49.319164991 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:58:49.438720942 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:01.558574915 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:01.678129911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:02.090301037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:02.183434010 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:07.495536089 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:07.495604992 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:07.615268946 CET	8080	49797	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:07.615854025 CET	49797	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:09.444919109 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:09.564560890 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:09.567049980 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:15.319792986 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:15.439464092 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:15.439481974 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:15.439496994 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:15.439574003 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:16.146440029 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:16.147120953 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:16.243935108 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:16.246049881 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:16.266782045 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:17.771935940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:17.891565084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:17.891721010 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.011236906 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.019135952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.138627052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.138735056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.259027958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.259150982 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.303376913 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.378725052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.455390930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.468219995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.513411045 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.573461056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.587796926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.605784893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.723608971 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.723762035 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.725291967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.843317986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.843437910 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:18.933737040 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.963083029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:18.979695082 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.164442062 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.276664972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.311073065 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.413297892 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.413419008 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.430593014 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.532975912 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.533020020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.614264965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.614362955 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.652625084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.734499931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.734550953 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.854110956 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.854131937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.854181051 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:19.973784924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:19.973923922 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.055592060 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.055671930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.094144106 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.175132990 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.175229073 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.294671059 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.295373917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.295447111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.455986977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.456118107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.496129990 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.542486906 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.575699091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.575763941 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.695362091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.699043036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.703947067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.859927893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.862051964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.905332088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:20.906321049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:20.981604099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.025899887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.025991917 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.109133005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.145699978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.182832003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.255373955 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.319267035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.323029995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.374933958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.379060030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.442583084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.442814112 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.498701096 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.561147928 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.561322927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.562416077 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.680952072 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.681190014 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.762568951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.762670994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:21.800767899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.882221937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:21.968486071 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.002212048 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.088088036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.088233948 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.207839966 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.207937956 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.245223045 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.327538013 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.327610016 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.413702965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.413772106 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.447211027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.533461094 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.614867926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.682832956 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:22.857187986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:22.979711056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:23.058260918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:23.182831049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:23.680972099 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:23.800662994 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:23.800725937 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:23.920403004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:23.920520067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.040091038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.040179968 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.159950018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.160136938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.212294102 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.279916048 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.283049107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.402654886 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.402740002 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.422276020 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.564049959 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.567054987 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.632708073 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.635077000 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.686562061 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.686625004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.754673958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.806282997 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.806440115 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.842710018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.888024092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.891025066 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:24.968053102 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:24.968122959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.087810040 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.087892056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.089047909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.171325922 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.248127937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.248379946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.289736032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.368084908 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.368141890 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.487819910 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.491103888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.682847023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.689373970 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.870364904 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:25.893754959 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:25.979739904 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.094996929 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:26.182849884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.296612978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:26.370338917 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.494052887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.655988932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:26.656049967 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.775631905 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:26.775685072 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:26.895194054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:26.895242929 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.014919043 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.014981031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.025396109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.180027008 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.180108070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.267230034 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.267333984 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.299701929 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.386971951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.387022018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.476310968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.507081985 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.514323950 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.633950949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.634051085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.708256006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.753695965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.755158901 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.874718904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.874857903 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.953249931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:27.955136061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:27.994385004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.074826956 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.074897051 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.155160904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.155230045 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.194536924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.274848938 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.274898052 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.355376005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.359066010 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.394382954 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.394440889 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.478737116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.514029026 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.556552887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.591603041 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.757762909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.757823944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.936012030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:28.939125061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:28.958957911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.058794975 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.058887959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.160326004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.178543091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.190736055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.311427116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.311486959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.367522955 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.431442022 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.546034098 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.609357119 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.682929039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.810456991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.842066050 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.854969978 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:29.961620092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:29.963067055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:29.974544048 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:30.011627913 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.015081882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.083255053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.087203026 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.134751081 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.207401991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.211075068 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.330579996 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.330634117 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.373188972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.374748945 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:30.428086996 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.450169086 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.459578991 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:30.472640038 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.579180002 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:30.583403111 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.592231035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.643151045 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.762682915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.780023098 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.793785095 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.857106924 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:30.939971924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:30.943120003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.037267923 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.039140940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.062726974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.158812046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.158884048 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.238356113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.239093065 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.278472900 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.278539896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.358577967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.358649015 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.398087978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.480293989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.480453968 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.481388092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.647979021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.648044109 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.679795027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.767605066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.767649889 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.880954027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:31.881022930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:31.887105942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.002310038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.004092932 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.082045078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.123831987 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.127110958 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.246762991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.247080088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.325272083 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.327075958 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.623995066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.624031067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.624068022 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.727766991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.743618011 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.743671894 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.863255024 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.867095947 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:32.986701965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:32.986938000 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.035696030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.106483936 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.106628895 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.226356030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.227072001 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.279051065 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.283090115 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.348416090 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.351171017 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.473159075 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.475099087 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.480732918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.611907959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.639940977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.643066883 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.672236919 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.672297001 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.762595892 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.792004108 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.792048931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:33.876383066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.911655903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:33.963874102 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.083472967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.083642006 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.086457968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.118603945 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.118686914 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.238276005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.238384962 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.319536924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.408019066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.408076048 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.527673960 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.527725935 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.559323072 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.682895899 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.692009926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.695111036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.729130030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.814716101 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.814826012 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.930257082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:34.930334091 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:34.934377909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.050024986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.051183939 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.137495995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.139112949 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.172286034 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.172346115 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.258658886 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.258816004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.292012930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.373545885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.378314018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.450418949 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.511889935 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.579627037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.583090067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.631473064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.702693939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.703089952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.823159933 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.823216915 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:35.825095892 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:35.885974884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.000004053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.000430107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.024507046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.073467970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.121186018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.121340036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.225600958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.227077961 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.240878105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.347098112 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.351082087 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.427099943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.431091070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.470942974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.470992088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.550857067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.551001072 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.590593100 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.669507980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.669589996 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.671847105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.789304018 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.811930895 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:36.870310068 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.931550980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:36.960628986 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.080468893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.099214077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.113720894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.182847023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.260052919 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.263194084 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.281878948 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.281929970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.383047104 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.402096987 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.402164936 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.483084917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.483290911 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.522409916 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.602938890 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.681205988 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.684238911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.776632071 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.800802946 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.800851107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.885430098 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:37.885507107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:37.920454979 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.005225897 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.005280018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.086625099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.086726904 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.126753092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.207094908 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.207144976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.326729059 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.326857090 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.327943087 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.371953964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.488106012 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.488220930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.527992964 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.607916117 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.608184099 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.728373051 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.728468895 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.729604006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.776616096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:38.892062902 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:38.929111004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:39.073484898 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.131114006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:39.182862997 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.341114998 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:39.385973930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.567702055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.687268972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:39.691096067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.810625076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:39.877762079 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:39.997395039 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.099107027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.182863951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.309243917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.354336977 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.474076986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.518765926 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.519526005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.638356924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.638571978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.758230925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.758277893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.877914906 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:40.877991915 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:40.885685921 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.040004015 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.040086031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.095940113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.159877062 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.160072088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.279632092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.279867887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.306031942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.351432085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.444109917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.446460962 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.516659021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.566060066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.682863951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.726710081 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.870409966 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:41.936765909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:41.979741096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:42.147049904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:42.370377064 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:42.563800097 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:42.683443069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:42.683500051 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:42.803052902 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:42.803103924 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:42.922611952 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:42.955353975 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.075082064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.115863085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.131378889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.235605001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.271099091 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.281033039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.341495037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.385994911 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.400490999 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.400546074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.520047903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.520275116 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.551479101 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.551532030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.671097994 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.671322107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.761631012 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.763102055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.843956947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.844145060 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:43.882740974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.963763952 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:43.971760988 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.011053085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.171943903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.171997070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.213242054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.213314056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.291662931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.332916021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.335113049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.415095091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.454817057 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.479799032 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.562494040 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.616211891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.682400942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.682706118 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.802371979 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.803108931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.817373991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.819159985 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:44.939055920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:44.939248085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.031768084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.032085896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.100044966 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.103101015 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.151712894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.155109882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.223083019 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.223128080 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.241944075 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.315946102 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.327383995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.342717886 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.380547047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.476490974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.500420094 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.519253969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.638855934 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.639102936 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.701601028 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.759442091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.759535074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.879230976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.883104086 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:45.945239067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:45.945307970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.002651930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.002701998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.064894915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.122498035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.123107910 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.146327972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.147140980 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.266797066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.267111063 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.323915958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.327284098 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.432053089 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.446827888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.524882078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.526422024 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.646153927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.646323919 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.726013899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.726135969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.765887976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.845717907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.846026897 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:46.927341938 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.965675116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:46.967125893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.086812973 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.086882114 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.133615017 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.182914972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.206505060 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.206552029 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.326083899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.326152086 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.343605995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.465569019 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.492007017 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.553184986 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.553677082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.672895908 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.672986031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.763847113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.792547941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.792593956 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.912293911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:47.912343025 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:47.973968029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.031899929 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.049561024 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.169570923 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.169621944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.217169046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.217278004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.289182901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.336829901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.338774920 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.418443918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.458849907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.463390112 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.582953930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.619678974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.646934032 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.793795109 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:48.793840885 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:48.807993889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.811117887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.820837021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.870589018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:48.913578033 CET	8181	49958	103.199.100.130	192.168.2.5
Dec 27, 2024 09:59:48.913727999 CET	49958	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 09:59:48.930687904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:48.931060076 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.025698900 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.025768995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.050652981 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.132280111 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.145374060 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.195741892 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.252021074 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.315366983 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.319119930 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.438816071 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.438890934 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.493314981 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.493385077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.558597088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.613013029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.613097906 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.694511890 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.732630968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.732686996 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.852402925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.852500916 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:49.895720005 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.972368002 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:49.972438097 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.092087030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.092175007 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.096998930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.167041063 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.256031036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.257150888 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.293652058 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.376760006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.386002064 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.496989012 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.573519945 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.707262039 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.713474035 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.730240107 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.833180904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.833260059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.849838018 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.849939108 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.917366982 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:50.917467117 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:50.952887058 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.037070036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.037126064 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.156841040 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.157006025 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.245006084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.245079041 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.276546001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.276648998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.364614010 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.364763975 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.396172047 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.478049040 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.478106976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.484252930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.597646952 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.597692013 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.685764074 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.685815096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.717178106 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.805527925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.807163954 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.918705940 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:51.918792009 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:51.926672935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.038528919 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.039242983 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.128326893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.131140947 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.158862114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.250849009 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.250904083 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.370534897 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.370615959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.392329931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.532095909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.532149076 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.571908951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.571974039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.651783943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.696702003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.773175001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.816318989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:52.827442884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:52.974169970 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:53.182074070 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:53.182883978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:53.385997057 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:53.392077923 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:53.559681892 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:53.739716053 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:53.859338999 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:53.859397888 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:53.978931904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:53.979108095 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.098773003 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.098819017 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.218481064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.271083117 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.291774035 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.411412001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.415184021 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.481367111 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.534754038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.543478012 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.663620949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.667185068 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.691535950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.795401096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.828036070 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.831150055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.901626110 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:54.903141975 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:54.950767040 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.022789001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.067924023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.111977100 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.182888985 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.187743902 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.270776033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.322021008 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.370398998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.390590906 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.532299995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.682955027 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.742378950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:55.870518923 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:55.952610970 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:56.182889938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:56.724170923 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:56.843905926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.255625963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.342233896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:57.520493031 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:57.576215029 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:57.640382051 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.640400887 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.640405893 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.640409946 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.695830107 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.697247982 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:57.816864014 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.817154884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:57.936902046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:57.937304974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.057022095 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.064336061 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.064901114 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.088768959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.112430096 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.182979107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.184497118 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.208367109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.208448887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.322737932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.323760033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.327919006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.443460941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.445198059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.532994986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.535365105 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.564735889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.644766092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.644844055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.654920101 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.764429092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.764482975 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.766108990 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.886013031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.928040028 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:58.928091049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:58.965938091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.047776937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.047880888 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.167380095 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.167438030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.167473078 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.287087917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.287178993 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.373724937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.406903982 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.427911997 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.446990013 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.566700935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.567151070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.608211994 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.682977915 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.686829090 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.686892033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.806828976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.806925058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 09:59:59.853262901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.926481962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 09:59:59.926559925 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.008033037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.011157036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.046200991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.131159067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.131336927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.214656115 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.214718103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.251079082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.251133919 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.334292889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.334405899 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.370871067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.424550056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.453959942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.481293917 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.601506948 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.603153944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.655389071 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.659182072 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:00.778830051 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.897212029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:00.951421976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.098429918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.182888031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.299813032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.316287994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.496458054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.496530056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.616858959 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.616928101 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.736522913 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.736809015 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:01.847671986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.856283903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:01.927485943 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.047132969 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.049179077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.057704926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.061209917 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.180780888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.216124058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.304717064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.304838896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.378995895 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.379148006 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.427603960 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.498836994 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.498898029 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.502487898 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.573522091 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.660092115 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.661732912 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.700186968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.701317072 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.781251907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.820949078 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.821821928 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:02.901281118 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.941562891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:02.979801893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.109246016 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:03.182908058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.319232941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:03.386025906 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.529557943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:03.648340940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.697127104 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.816692114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:03.816744089 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:03.936260939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:03.936306000 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.056178093 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.056315899 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.176449060 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.176495075 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.228655100 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.276638985 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.296094894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.382653952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.438785076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.438901901 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.502729893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.503211975 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.558451891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.622800112 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.622992992 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.648834944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.784037113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.784248114 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.859106064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.859293938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.903804064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:04.905268908 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:04.978900909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.024842024 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.024976969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.108067989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.108333111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.145880938 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.145950079 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.228521109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.228655100 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.266176939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.318274021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.318389893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.348659039 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.437988997 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.438040972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.549974918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.550031900 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.557549000 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.669677019 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.669728994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.758966923 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.759016991 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.789401054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.878539085 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.878599882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.990955114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:05.991030931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:05.998110056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.110603094 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.110735893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.199608088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.230312109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.243257046 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.362879038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.369411945 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.431688070 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.437179089 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.489017010 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.493191004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.556859970 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.557995081 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.612890959 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.613619089 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.673255920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.677131891 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.677517891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.733208895 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.733474970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.796725988 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.797740936 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.814142942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.816911936 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.895992994 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.897269011 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:06.917326927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.936521053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:06.937784910 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.016984940 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.054343939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.057276011 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.099946976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.100111961 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.176985025 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.179932117 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.218333006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.219599962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.219702959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.299561977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.304231882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.339286089 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.420984030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.421040058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.423743963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.540654898 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.540739059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.630168915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.630212069 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:07.660334110 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.749850035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.862296104 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:07.979825020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:08.105387926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:08.182912111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:08.306466103 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:08.370434046 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:08.652343988 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:08.771960974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:08.772018909 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:08.891580105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:08.891680956 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.011231899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.011392117 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.131221056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.131377935 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.183945894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.184042931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.253648043 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.303649902 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.303781986 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.394161940 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.394258976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.423353910 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.513832092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.514262915 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.604465008 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.604521036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.633831978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.724057913 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.724144936 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.835438967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.835504055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:09.843662977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.955092907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:09.955164909 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.045146942 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.045238972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.074759960 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.165150881 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.165220976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.276160955 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.276247978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.284732103 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.395802021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.395875931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.486202002 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.515422106 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.515465021 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.635116100 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.716893911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:10.759030104 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:10.961393118 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:11.073553085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:11.162659883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:11.386053085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:11.906722069 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.026493073 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.026561022 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.146208048 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.146284103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.265857935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.266000986 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.386703014 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.386774063 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.438126087 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.438194036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.506833076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.511513948 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.511627913 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.557867050 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.561747074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.631326914 CET	8080	49979	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.631397009 CET	49979	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.648197889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.681327105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.681368113 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:12.800935030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.858525991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:12.884387016 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.004070044 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.004125118 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.101300955 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.103207111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.123893023 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.222877026 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.223202944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.302344084 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.303282022 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.342808962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.343281984 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.422925949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.422985077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.462863922 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.542543888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.543179989 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.544049025 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.683002949 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.703999043 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.704061031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.743983030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.744035959 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.823661089 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.823776960 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.943392992 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:13.943821907 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:13.945246935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.104005098 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.104075909 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.144957066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.223681927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.223795891 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.344017029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.345865011 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.349359035 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.449218035 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:14.512046099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.512108088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.545712948 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.568876982 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:14.569046974 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:14.620234966 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.631686926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.631766081 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.752800941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.752813101 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.753000021 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:14.872556925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.960808039 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:14.984618902 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.104235888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.104295969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.205293894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.205476046 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.223877907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.224054098 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.325184107 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.343760014 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.351187944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.406359911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.407156944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.470916033 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.526813030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.527082920 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.646821976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.647069931 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.649350882 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.807979107 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.808475018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.848129034 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.848365068 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.928571939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.928816080 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:15.968095064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:15.968293905 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.048561096 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.049086094 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.049182892 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.132128000 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.132433891 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.168669939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.249958992 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.250129938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.251940012 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.369803905 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.375253916 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.451114893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.494987011 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.542001009 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.661681890 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.669898033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.693243027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.820513964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.832046032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.832091093 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.863095999 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.947134018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:16.951687098 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:16.951879978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.071439981 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.099479914 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.136291027 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.182936907 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.219409943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.219487906 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.339232922 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.344135046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.344173908 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.420680046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.427187920 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.504112959 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.511168003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.546972036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.551166058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.621886969 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.622081995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.630728006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.670969963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.741843939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.747123003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.823039055 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.825190067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.866822004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.867218018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.944845915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:17.945154905 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:17.986872911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.064851999 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.065063000 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.065073967 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.182930946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.188131094 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.188276052 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.348017931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.348077059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.395519972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.467827082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.468044043 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.587687969 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.587868929 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.605510950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.669229984 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.669289112 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:18.747970104 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.870455980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:18.979892969 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:19.110152960 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:19.183026075 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:19.354120016 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:19.479784966 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.061464071 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:20.065129995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.181771040 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.181792021 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.181829929 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.181845903 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.185252905 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.185551882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.307018042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.307184935 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.427506924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.427733898 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.547746897 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.547861099 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.596683979 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.667536020 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.667752981 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.787383080 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.795638084 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.796118021 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:20.806600094 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:20.870430946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:20.915689945 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:20.927278042 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.016872883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.017271996 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.088015079 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.136991024 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.137347937 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.226964951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.229576111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.256865978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.257406950 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.349203110 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.349335909 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.376946926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.458417892 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.458477974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.468862057 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.578197002 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.578273058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.670173883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.670228004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.697921038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.789982080 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.790154934 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.899283886 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:21.899374962 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:21.909730911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.019103050 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.019180059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.111357927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.138983965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.276722908 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.359750032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.436104059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.555742979 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.555852890 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.601423979 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.601557970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.675462008 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.675656080 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.757143021 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.757266998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.795270920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.876857042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.876908064 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.967499971 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:22.967602968 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:22.996465921 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.087301970 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.087383986 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.198389053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.198447943 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.206878901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.318275928 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.329961061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.420000076 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.420238018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.449690104 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.449971914 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.539835930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.540080070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.569464922 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.651113033 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.651247978 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.659651995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.770797968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.771027088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.861042976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.861349106 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:23.890877962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:23.981007099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:24.092057943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:24.185219049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:24.333287001 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:24.479906082 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:24.534643888 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:24.673542976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:24.837281942 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:24.956940889 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:24.956993103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.076550007 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.076661110 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.196429968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.196480989 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.316165924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.316220045 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.368792057 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.435734034 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.455302954 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.575189114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.575253963 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.578814030 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.682943106 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.735995054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.736042976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.789242983 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.789488077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.855592012 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.855746031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.909070015 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.909157038 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:25.975343943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:25.999155998 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.076031923 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.077312946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.197086096 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.197268009 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.209347963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.335196018 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.360059977 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.360255003 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.453289986 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.453391075 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.480201006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.480283976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.573772907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.599925995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.649519920 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.654351950 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.769319057 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:26.776698112 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:26.897233009 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:27.073582888 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:27.098413944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:27.182951927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:27.299592972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:27.386085987 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:27.806988001 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:27.926701069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:27.926780939 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.046386003 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.046447039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.166573048 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.166688919 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.286299944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.286395073 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.338459969 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.405916929 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.405971050 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.525615931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.525686026 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.548453093 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.682938099 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.691991091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.692064047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.758934975 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.811534882 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.811620951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.931272984 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:28.931467056 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:28.969738960 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.051136017 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.051304102 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.170892954 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.173834085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.179054976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.336041927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.337253094 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.389365911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.393465042 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.456868887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.513147116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.513238907 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.603511095 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.605540037 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.632848024 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.633933067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.725136995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.725682020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:29.753535032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.813898087 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.845482111 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:29.886079073 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.046926975 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:30.182944059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.289278984 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:30.386060953 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.490550995 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:30.562087059 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.689066887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.808716059 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:30.836040974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:30.955713987 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:30.955775023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.075396061 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.077801943 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.197417974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.220473051 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.316834927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.384303093 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.430630922 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.479837894 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.552032948 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.553800106 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.640638113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.641525030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.673433065 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.761063099 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.761662006 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.881226063 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:31.881375074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:31.915512085 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.044274092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.045305014 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.157485008 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.157910109 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.164915085 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.277522087 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.281361103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.358402967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.361331940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.401068926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.401238918 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.480989933 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.520916939 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.601283073 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.682955027 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:32.802638054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:32.886104107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:33.003881931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:33.073590994 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:33.781732082 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:33.901645899 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:33.901904106 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.021603107 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.023252964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.143171072 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.143222094 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.262972116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.273493052 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.313431978 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.386075020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.393150091 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.393266916 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.512875080 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.512942076 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.523490906 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.641361952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.676100969 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.733751059 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.820950031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.940639973 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:34.941791058 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:34.944032907 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.104120016 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.105467081 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.154192924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.225085974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.225260973 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.292519093 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:35.292519093 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:35.345091105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.345288992 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.364382982 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.412312031 CET	8181	49980	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:35.412559986 CET	49980	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:35.480731964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.508083105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.508200884 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.574620962 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.627870083 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.683048964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.784842014 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:35.873284101 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:35.994986057 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:36.186204910 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:36.205295086 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:36.370454073 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:36.601993084 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:36.721637964 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:36.759850979 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:36.879533052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:36.879581928 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:36.999253035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.038701057 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.133696079 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.158312082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.179071903 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.298652887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.298717976 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.343544006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.418417931 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.418560028 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.418642044 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.539041042 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.539077044 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.539288044 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.539288044 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.586896896 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.587229013 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.659502029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.659713030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.707597971 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.707835913 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.779934883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.786747932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.786823034 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.868536949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.868659019 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.907038927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.980791092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:37.981004953 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:37.988301039 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.100722075 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.101006031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.184494019 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.184690952 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.220691919 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.220854044 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.304384947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.304536104 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.340655088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.422199011 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.422278881 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.424197912 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.542257071 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.555118084 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.625724077 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.625973940 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.675237894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.675468922 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.745974064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.746061087 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.795356989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.865762949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.865823030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:38.869358063 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:38.979839087 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:39.067159891 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:39.067223072 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:39.268378973 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:39.268444061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:39.469939947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:39.470022917 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:39.671087980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:39.671243906 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:39.872319937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:39.872395039 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:40.076221943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:40.076301098 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:40.286165953 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:40.286354065 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:40.496485949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:40.496557951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:40.706706047 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:40.707303047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:40.916924000 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:40.917009115 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.028306007 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.031279087 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.148123980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.148247957 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.151001930 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.229450941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.268064976 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.268141031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.352320910 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.387773037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.422245979 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.541902065 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.589086056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.682990074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:41.833276987 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:41.882612944 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:42.002238989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:42.034527063 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:42.182971001 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:42.423445940 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:42.483258009 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:42.940555096 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:42.955240965 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.060336113 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.060376883 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.060421944 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.060452938 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.116138935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.116307020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.235949993 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.236152887 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.355751038 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.356193066 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.465694904 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.466073036 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.475986958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.476032972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.486346006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.585684061 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.636102915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.636156082 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.696659088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.696728945 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.755717993 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.755775928 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:43.816987991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.875418901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.906789064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:43.979854107 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.117125988 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.148797035 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.312028885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.312247038 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.327229023 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.370608091 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.432004929 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.435343981 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.554955006 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.555073977 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.675090075 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.675280094 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.680146933 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.835903883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.835997105 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.890264988 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:44.890338898 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:44.955899000 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.009917974 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.021091938 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.100841045 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.100984097 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.140840054 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.220594883 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.238255024 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.310708046 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.358413935 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.359513998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.479140043 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.479372025 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.520873070 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.523329020 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.599827051 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.603385925 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.643033981 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.723434925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.723496914 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.730879068 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.870595932 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.884593964 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:45.887279987 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:45.941740990 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.006859064 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.007000923 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.126873016 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.127012968 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.151374102 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.288197041 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.288254023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.361680984 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.361845016 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.407812119 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.481527090 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.484189987 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.571877003 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.603841066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.603890896 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.609072924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.683043957 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.764060020 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.764132023 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.805058956 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.805113077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.884140968 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:46.887289047 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:46.924735069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.006784916 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.006921053 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.137978077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.207581043 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.207659960 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.258373022 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.327267885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.327383995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.446966887 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.447056055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.449048996 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.557987928 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.608454943 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.608622074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.648206949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.648277998 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.729391098 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.731350899 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.768027067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.849958897 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.851103067 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.851202965 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:47.970854044 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:47.970918894 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.050700903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.050787926 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.091378927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.170687914 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.170821905 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.290415049 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.290504932 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.292654991 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.453579903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.453668118 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.492016077 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.573622942 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.573637009 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.573760033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.693259954 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.693319082 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.693562984 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.813286066 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.813358068 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:48.894120932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.933020115 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:48.935281038 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.055063963 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.055445910 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.134318113 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.175045967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.182988882 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.190047026 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.309824944 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.310045004 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.376307964 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.376559973 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.429606915 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.496176958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.510188103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.621211052 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.621273041 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.629826069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.740855932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.740911961 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.822805882 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.822891951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.860552073 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.863331079 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.942222118 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.942632914 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.942709923 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:49.983062029 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:49.983287096 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.062536955 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.063265085 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.103135109 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.145185947 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.182955980 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.183068991 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.302885056 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.302979946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.384501934 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.384556055 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.424138069 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.504297972 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.504422903 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.624224901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.624283075 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.632965088 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.776735067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.784074068 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.803015947 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.825645924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.900033951 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:50.922696114 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:50.922760963 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.026957035 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.027024031 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.042392015 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.147094965 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.147172928 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.228241920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.228353024 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.266941071 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.355900049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.468373060 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.470345974 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.475472927 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.590195894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.590317965 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.676950932 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.677025080 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.710033894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.796936989 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.797058105 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:51.911469936 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.916678905 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:51.964101076 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.011329889 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.118140936 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.118304014 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.130945921 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.238104105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.248574972 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.332346916 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.368186951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.368274927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.488334894 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.488456011 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.569672108 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.608109951 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.608161926 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.689487934 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.689573050 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.727819920 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.809453964 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.809551001 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:52.929709911 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:52.929801941 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.092833042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.092997074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.131079912 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.212968111 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.223506927 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.343605042 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.373200893 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.406788111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.545047998 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.545109034 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.708039045 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.708106995 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.727915049 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.827774048 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.830670118 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.929378033 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.931299925 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:53.950476885 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:53.951292992 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.051162958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.051291943 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.070955992 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.139055967 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.139131069 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.170977116 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.171188116 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.258807898 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.290967941 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.372342110 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.439354897 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.456789970 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.576703072 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.617382050 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.677611113 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.778034925 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:54.850240946 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.932074070 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:54.988253117 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.103995085 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.104103088 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.223809004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.223875999 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.667593002 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.667627096 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.682990074 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.788535118 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.788553953 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.788577080 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.788590908 CET	8080	49981	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.788666964 CET	49981	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.788917065 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.802496910 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.840048075 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.840198040 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.874707937 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.875020981 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:55.908399105 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:55.994659901 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:56.200627089 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:56.386110067 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:56.445451975 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:56.531199932 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.079816103 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.199822903 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.199884892 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.319531918 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.319673061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.439483881 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.443351030 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.563030958 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.563472033 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.611474037 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.611620903 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.683049917 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.705708981 CET	49982	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:57.731282949 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.739825010 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.821640015 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.821806908 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:57.825367928 CET	8181	49982	103.199.100.130	192.168.2.5
Dec 27, 2024 10:00:57.825444937 CET	49982	8181	192.168.2.5	103.199.100.130
Dec 27, 2024 10:00:57.859479904 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.941430092 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:57.941529036 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.031810999 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.031915903 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.060971022 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.061033010 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.151657104 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.151777983 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.262135983 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.262248993 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.271281004 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.381973028 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.385415077 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.472790956 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.472953081 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.505079985 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.592720032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.592812061 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.706455946 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.706545115 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.712683916 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.826242924 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.826304913 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:58.914139032 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.945985079 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:58.946163893 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.065845013 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.065942049 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.151396036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.185689926 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.186353922 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.306058884 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.387116909 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.462757111 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.507412910 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.573620081 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.713510036 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.792037964 CET	49786	8080	192.168.2.5	103.199.100.97
Dec 27, 2024 10:00:59.923685074 CET	8080	49786	103.199.100.97	192.168.2.5
Dec 27, 2024 10:00:59.980014086 CET	49786	8080	192.168.2.5	103.199.100.97

Target ID:	0
Start time:	03:56:52
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\Wk6IMAhBNF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wk6IMAhBNF.exe"
Imagebase:	0x400000
File size:	1'151'488 bytes
MD5 hash:	FF61853AA5A10D3FE8FBE0D5470DB9D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000000.1999206035.0000000000438000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.2218149347.0000000002548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.4458721208.000000000277E000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	52.7%
Signature Coverage:	26.3%
Total number of Nodes:	1903
Total number of Limit Nodes:	112

Executed Functions

Function 0040DC56 Relevance: 93.2, APIs: 5, Strings: 48, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DC5D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040DD4A

Part of subcall function 00410818: __EH_prolog3_catch.LIBCMT ref: 0041081F

__aulldiv.LIBCMT ref: 0040DDF8
GetCursorPos.USER32(?), ref: 0040E169
GetCursorPos.USER32(?), ref: 0040E17A

Strings

Detect as physical environment based on mouse movement.[-], xrefs: 0040E1A2
Detect as a VM based on executable run path.[+], xrefs: 0040E057
Detect as physical environment based on MAC address prefix.[-], xrefs: 0040DF48
@, xrefs: 0040DCA6
Detect as a VM based on mouse movement.[+], xrefs: 0040E194
Detect as physical environment based on system boot time.[-], xrefs: 0040DE20
Detect as physical environment based on CPU temperature.[-], xrefs: 0040DEE6
Detect as physical environment based on NetBIOS name.[-], xrefs: 0040DFAA
VoidWalker, xrefs: 0040DFEE
Detect as a VM based on current process filename.[+], xrefs: 0040E025
Detect as a VM based on temp file count.[+], xrefs: 0040DEA7
Detect as a VM based on hardware information.[+], xrefs: 0040DDC8
Detect as a VM based on total disk size.[+], xrefs: 0040DD64
Detect as physical environment based on Hyper-V presence.[-], xrefs: 0040DE81
Detect as a VM based on RDTSC timing.[+], xrefs: 0040E1EC
@TD, xrefs: 0040DC90, 0040E200
\\.\PhysicalDrive0, xrefs: 0040DD0E
Detect as physical environment based on hardware information.[-], xrefs: 0040DDD6
Detect as a VM based on the number of CPU cores.[+], xrefs: 0040DC7D
Detect as a VM based on motherboard info.[+], xrefs: 0040E130
Detect as physical environment based on motherboard info.[-], xrefs: 0040E13E
Detect as a VM based on CPU temperature.[+], xrefs: 0040DED8
Detect as a VM based on power capabilities.[+], xrefs: 0040E0CC
Detect as physical environment based on the number of CPU cores.[-], xrefs: 0040DC8B
Detect as physical environment based on current process filename.[-], xrefs: 0040E033
Detect as a VM based on DLLs loaded.[+], xrefs: 0040E089
Detect as physical environment based on executable run path.[-], xrefs: 0040E065
Detect as physical environment based on GPU memory.[-], xrefs: 0040DF17
Detect as physical environment based on physical memory size.[-], xrefs: 0040DCEF
Detect as a VM based on NetBIOS name.[+], xrefs: 0040DF9C
Detect as a VM based on Hyper-V presence.[+], xrefs: 0040DE5F
Detect as physical environment based on power capabilities.[-], xrefs: 0040E0DA
Detect as a VM based on MAC address prefix.[+], xrefs: 0040DF3A
Detect as a VM based on license values.[+], xrefs: 0040E0FE
Detect as a VM based on physical memory size.[+], xrefs: 0040DCE1
Detect as a VM based on usernames.[+], xrefs: 0040DF6B
Detect as physical environment based on rundll32 parent process.[-], xrefs: 0040DFDB
Detect as physical environment based on RDTSC timing.[-], xrefs: 0040E1FB
Detect as physical environment based on temp file count.[-], xrefs: 0040DEB5
Detect as physical environment based on total disk size.[-], xrefs: 0040DD72
Detect as physical environment based on specific processes.[-], xrefs: 0040DDA4
Detect as a VM based on GPU memory.[+], xrefs: 0040DF09
Detect as a VM based on system boot time.[+], xrefs: 0040DE12
Detect as a VM based on specific processes.[+], xrefs: 0040DD96
Detect as physical environment based on usernames.[-], xrefs: 0040DF79
Detect as physical environment based on DLLs loaded.[-], xrefs: 0040E097
Detect as a VM based on rundll32 parent process.[+], xrefs: 0040DFCD
Detect as physical environment based on license values.[-], xrefs: 0040E10C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Cursor$H_prolog3_H_prolog3_catchUnothrow_t@std@@@__aulldiv__ehfuncinfo$??2@
String ID: @$@TD$Detect as a VM based on CPU temperature.[+]$Detect as a VM based on DLLs loaded.[+]$Detect as a VM based on GPU memory.[+]$Detect as a VM based on Hyper-V presence.[+]$Detect as a VM based on MAC address prefix.[+]$Detect as a VM based on NetBIOS name.[+]$Detect as a VM based on RDTSC timing.[+]$Detect as a VM based on current process filename.[+]$Detect as a VM based on executable run path.[+]$Detect as a VM based on hardware information.[+]$Detect as a VM based on license values.[+]$Detect as a VM based on motherboard info.[+]$Detect as a VM based on mouse movement.[+]$Detect as a VM based on physical memory size.[+]$Detect as a VM based on power capabilities.[+]$Detect as a VM based on rundll32 parent process.[+]$Detect as a VM based on specific processes.[+]$Detect as a VM based on system boot time.[+]$Detect as a VM based on temp file count.[+]$Detect as a VM based on the number of CPU cores.[+]$Detect as a VM based on total disk size.[+]$Detect as a VM based on usernames.[+]$Detect as physical environment based on CPU temperature.[-]$Detect as physical environment based on DLLs loaded.[-]$Detect as physical environment based on GPU memory.[-]$Detect as physical environment based on Hyper-V presence.[-]$Detect as physical environment based on MAC address prefix.[-]$Detect as physical environment based on NetBIOS name.[-]$Detect as physical environment based on RDTSC timing.[-]$Detect as physical environment based on current process filename.[-]$Detect as physical environment based on executable run path.[-]$Detect as physical environment based on hardware information.[-]$Detect as physical environment based on license values.[-]$Detect as physical environment based on motherboard info.[-]$Detect as physical environment based on mouse movement.[-]$Detect as physical environment based on physical memory size.[-]$Detect as physical environment based on power capabilities.[-]$Detect as physical environment based on rundll32 parent process.[-]$Detect as physical environment based on specific processes.[-]$Detect as physical environment based on system boot time.[-]$Detect as physical environment based on temp file count.[-]$Detect as physical environment based on the number of CPU cores.[-]$Detect as physical environment based on total disk size.[-]$Detect as physical environment based on usernames.[-]$VoidWalker$\\.\PhysicalDrive0
API String ID: 2337057263-1148611144
Opcode ID: 89195aa43a705b2d82cbe94d82dcd2d5688d9cd5c86b34a1c6ad5e9790caa631
Instruction ID: 80c3a512bf09a135a5fd71949b2be695d2aede728182df62d3a464da82110bad
Opcode Fuzzy Hash: 89195aa43a705b2d82cbe94d82dcd2d5688d9cd5c86b34a1c6ad5e9790caa631
Instruction Fuzzy Hash: 17E16E71F4430496EB14B7B658566AE1216AF90708F20D83FB5027F2C7CFBCD886869E

Function 05885430 Relevance: 91.4, APIs: 40, Strings: 12, Instructions: 429
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

_memset.LIBCMT ref: 0588546C
_memset.LIBCMT ref: 05885485
_memset.LIBCMT ref: 0588549B
gethostname.WS2_32(?,00000100), ref: 058854AF
gethostbyname.WS2_32(?), ref: 058854BC
inet_ntoa.WS2_32 ref: 058854D4
_strcat_s.LIBCMT ref: 058854E7
_strcat_s.LIBCMT ref: 05885500
inet_ntoa.WS2_32 ref: 05885521
_strcat_s.LIBCMT ref: 05885534
_strcat_s.LIBCMT ref: 0588554D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0588557A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0588558E
GetLastInputInfo.USER32(?), ref: 058855A1
GetTickCount.KERNEL32 ref: 058855A7
wsprintfW.USER32 ref: 058855DC
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 058855F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 05885609
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 05885660
wsprintfW.USER32 ref: 05885679
GetForegroundWindow.USER32 ref: 058856A2
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 058856B9
lstrlenW.KERNEL32(000008CC), ref: 058856C6
lstrlenW.KERNEL32(00000994), ref: 05885712
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 05885783
GetProcAddress.KERNEL32(00000000), ref: 0588578A
GetNativeSystemInfo.KERNEL32(?), ref: 0588579B
GetSystemInfo.KERNEL32(?), ref: 058857A6
wsprintfW.USER32 ref: 058857DF
GetCurrentProcessId.KERNEL32 ref: 058857F1
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 05885807
GetProcessImageFileNameW.PSAPI(00000000,?,00000104), ref: 05885824
CloseHandle.KERNEL32(?), ref: 05885858
GetTickCount.KERNEL32 ref: 058858B9
__time64.LIBCMT ref: 058858C8
__localtime64.LIBCMT ref: 058858FF
wsprintfW.USER32 ref: 05885938
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 0588594D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 0588595C
GetCurrentHwProfileW.ADVAPI32(?), ref: 05885969

Strings

X86, xrefs: 05885981, 058859A3
AppEvents, xrefs: 058856D3, 0588571F
REMARK, xrefs: 05885718
1.0, xrefs: 058856F5
GROUP, xrefs: 058856CC
%d min, xrefs: 058855D6
GetNativeSystemInfo, xrefs: 05885743
, xrefs: 058854EF, 0588553C
x64, xrefs: 058857C6
X86 %s, xrefs: 058857D9
x86, xrefs: 058857CD, 058857D2
kernel32.dll, xrefs: 05885748

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memset$CountCurrentHandleTickWindowinet_ntoalstrlen$AddressCloseDirectoryFileForegroundImageInputLastLocaleModuleNameNativeOpenProcProfileText__localtime64__time64_mallocgethostbynamegethostname
String ID: $%d min$1.0$AppEvents$GROUP$GetNativeSystemInfo$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 9717835-1006841886
Opcode ID: ff368cb4239cfcb06563f9a3e45add9f7abac2156689aa1994d0ff6a89b77eef
Instruction ID: 8dae75140f962dfac6a1b6afaecc78c9611fd4c19260db7eb583ded7a367bf26
Opcode Fuzzy Hash: ff368cb4239cfcb06563f9a3e45add9f7abac2156689aa1994d0ff6a89b77eef
Instruction Fuzzy Hash: 10F1B2B5A40704AFEB24EB64DC85FEB77B8EF48701F004559FA1AD7280EA74AA44CF51

Function 0588DE70 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 332
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 05890430: __fassign.LIBCMT ref: 05890426

Sleep.KERNEL32(00000000), ref: 0588DEC4
CloseHandle.KERNEL32(00000000), ref: 0588DEF1
GetLocalTime.KERNEL32(?), ref: 0588DF09
wsprintfW.USER32 ref: 0588DF40
SetUnhandledExceptionFilter.KERNEL32(058875A0), ref: 0588DF4E
CloseHandle.KERNEL32(00000000), ref: 0588DF67
EnumWindows.USER32(05885C90,?), ref: 0588E0B2

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

Sleep.KERNEL32(00004E20), ref: 0588E0C5
EnumWindows.USER32(05885C90,?), ref: 0588E0D9
Sleep.KERNEL32(00000BB8), ref: 0588E110
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0588E153
Sleep.KERNEL32(00000FA0,?,?,?,00000208,103.199.100.130), ref: 0588E1CD
RegOpenKeyExW.KERNEL32 ref: 0588E1F4
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0588E214
CloseHandle.KERNEL32(?), ref: 0588E25F

Part of subcall function 0588F919: ___set_flsgetvalue.LIBCMT ref: 0588F93E
Part of subcall function 0588F919: __calloc_crt.LIBCMT ref: 0588F94A
Part of subcall function 0588F919: __getptd.LIBCMT ref: 0588F957
Part of subcall function 0588F919: CreateThread.KERNEL32(00000000,00000000,0588F8B4,00000000,00000000,0588DF63), ref: 0588F98E
Part of subcall function 0588F919: GetLastError.KERNEL32(?,?,00000000,?,0588DF63,00000000,00000000,05885F10,00000000,00000000,00000000), ref: 0588F998
Part of subcall function 0588F919: _free.LIBCMT ref: 0588F9A1
Part of subcall function 0588F919: __dosmaperr.LIBCMT ref: 0588F9AC

Sleep.KERNEL32(000003E8,?,?,?,00000208,103.199.100.130), ref: 0588E2A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000208,103.199.100.130), ref: 0588E2D0
CloseHandle.KERNEL32(?,?,?,00000208,103.199.100.130), ref: 0588E2D7
Sleep.KERNEL32(000003E8,?,?,00000208,103.199.100.130), ref: 0588E2E2
CloseHandle.KERNEL32(?), ref: 0588E300
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000208,103.199.100.130), ref: 0588E323
CloseHandle.KERNEL32(?,?,?,00000208,103.199.100.130), ref: 0588E32A
Sleep.KERNEL32(00000000,?,?,?,?,00000208,103.199.100.130), ref: 0588E344
CloseHandle.KERNEL32(?), ref: 0588E362

Strings

8181, xrefs: 0588DFBB, 0588E002, 0588E05F, 0588E0E9, 0588E121
103.199.100.130, xrefs: 0588DFA7, 0588DFEE, 0588E04B, 0588E100, 0588E161
Console, xrefs: 0588E1DE
103.199.100.97, xrefs: 0588DF9D
8282, xrefs: 0588E058
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0588DF3A
103.199.100.130, xrefs: 0588DFE4
8181, xrefs: 0588DFFB
8080, xrefs: 0588DFB4
IpDatespecial, xrefs: 0588E20E
199.100.130, xrefs: 0588E041

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleSleep$CreateEnumObjectSingleWaitWindows$ErrorEventExceptionFilterLastLocalOpenQueryThreadTimeUnhandledValue___set_flsgetvalue__calloc_crt__dosmaperr__fassign__getptd_free_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$103.199.100.130$103.199.100.130$103.199.100.97$199.100.130$8080$8181$8181$8282$Console$IpDatespecial
API String ID: 3288573104-749776100
Opcode ID: cd3b61d9f2246cd6a9a37fdef66d096b73d21fd2415ff7f55a4f18fb10f06c7b
Instruction ID: c620f51d1094134687cfcd992bec2c1a474fab71959c5c3b15ea868e3fb96e45
Opcode Fuzzy Hash: cd3b61d9f2246cd6a9a37fdef66d096b73d21fd2415ff7f55a4f18fb10f06c7b
Instruction Fuzzy Hash: DEC16EB1654341AFE720EF64D88AE7ABBACFB84704F000919FD56D6281EB74AD44CB53

Function 0588BBD0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 0588BBEF
GetDC.USER32(00000000), ref: 0588BBFC
CreateCompatibleDC.GDI32(00000000), ref: 0588BC02
GetDC.USER32(00000000), ref: 0588BC0D
GetDeviceCaps.GDI32(00000000,00000008), ref: 0588BC1A
GetDeviceCaps.GDI32(00000000,00000076), ref: 0588BC22
ReleaseDC.USER32(00000000,00000000), ref: 0588BC33
GetSystemMetrics.USER32(0000004E), ref: 0588BC58
GetSystemMetrics.USER32(0000004F), ref: 0588BC86
GetSystemMetrics.USER32(0000004C), ref: 0588BCD8
GetSystemMetrics.USER32(0000004D), ref: 0588BCED
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0588BD06
SelectObject.GDI32(?,00000000), ref: 0588BD14
SetStretchBltMode.GDI32(?,00000003), ref: 0588BD20
GetSystemMetrics.USER32(0000004F), ref: 0588BD2D
GetSystemMetrics.USER32(0000004E), ref: 0588BD40
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 0588BD67
_memset.LIBCMT ref: 0588BDDA
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 0588BDF7
_memset.LIBCMT ref: 0588BE0F

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

DeleteObject.GDI32(?), ref: 0588BE83
DeleteObject.GDI32(?), ref: 0588BE8D
ReleaseDC.USER32(00000000,?), ref: 0588BE99
DeleteObject.GDI32(?), ref: 0588BF3F
DeleteObject.GDI32(?), ref: 0588BF49
ReleaseDC.USER32(00000000,?), ref: 0588BF55

Strings

(, xrefs: 0588BD9E
gfff, xrefs: 0588BC70
6, xrefs: 0588BDC1
gfff, xrefs: 0588BC98

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: 6b9a73a75af8b97133f3377f789b775ec7978abca7907339da2e1985c2377f98
Instruction ID: c0c22a30f5a8e511b9fd3fef60456d3ed3c8c8c02f25cf92b2bfb26cf1e2cc5e
Opcode Fuzzy Hash: 6b9a73a75af8b97133f3377f789b775ec7978abca7907339da2e1985c2377f98
Instruction Fuzzy Hash: ACD11FB1E01318AFDB14EFA9E849AAEBBB9FF44300F144529F906E7240D774AD45CB51

Function 05886A40 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(75A773E0), ref: 05886A64
wsprintfW.USER32 ref: 05886A77

Part of subcall function 058868E0: GetCurrentProcessId.KERNEL32(A97BC7BB,00000000,00000000,75A773E0,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886908
Part of subcall function 058868E0: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886917
Part of subcall function 058868E0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886930
Part of subcall function 058868E0: CloseHandle.KERNEL32(00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 0588693B

_memset.LIBCMT ref: 05886A92
GetVersionExW.KERNEL32(?), ref: 05886AAB
GetCurrentProcess.KERNEL32(00000008,?), ref: 05886AE2
OpenProcessToken.ADVAPI32(00000000), ref: 05886AE9
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 05886B0F
GetLastError.KERNEL32 ref: 05886B19
LocalAlloc.KERNEL32(00000040,?), ref: 05886B2D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 05886B55
GetSidSubAuthorityCount.ADVAPI32 ref: 05886B68
GetSidSubAuthority.ADVAPI32(00000000), ref: 05886B76
LocalFree.KERNEL32(?), ref: 05886B85
CloseHandle.KERNEL32(?), ref: 05886B92
wsprintfW.USER32 ref: 05886BEB

Strings

None/%s, xrefs: 05886BB7
NO/, xrefs: 05886BAF
-N/, xrefs: 05886BBF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: 56e73aacecf82c8c91a0ba3ba016528c9de63f561481ba0ba64bc6c12dfc00cb
Instruction ID: 94a4582edc6b41fc338414258ab984790c52e1a8abdcd1735db0039821cbdd6b
Opcode Fuzzy Hash: 56e73aacecf82c8c91a0ba3ba016528c9de63f561481ba0ba64bc6c12dfc00cb
Instruction Fuzzy Hash: 7C41A475A00218ABFB30AB65DC89FFA7B79FB49714F080095FE07D6140EA74AD94CB61

Function 0040CB1E Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CB25

Part of subcall function 0040EF6C: char_traits.LIBCPMT ref: 0040EF85

Part of subcall function 0040C806: __EH_prolog3_GS.LIBCMT ref: 0040C810
Part of subcall function 0040C806: CoInitialize.OLE32(00000000), ref: 0040C821
Part of subcall function 0040C806: CoCreateInstance.COMBASE(0043AB58,00000000,00000001,0043AA88,?), ref: 0040C841
Part of subcall function 0040C806: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0040C8B8
Part of subcall function 0040C806: CoUninitialize.COMBASE ref: 0040C8DA

Part of subcall function 0040C806: CoUninitialize.COMBASE ref: 0040C9B8

Part of subcall function 0040FB5D: _memcmp.LIBVCRUNTIME ref: 0040FBB4

Part of subcall function 0040C806: CoUninitialize.COMBASE ref: 0040CAE9

Strings

VMware, xrefs: 0040CBB7, 0040CBBC, 0040CBC7, 0040CC49, 0040CC4E, 0040CC59
Win32_DiskDrive, xrefs: 0040CBA2
Virtual Machine, xrefs: 0040CC83, 0040CC88, 0040CC90, 0040CC91
VirtualBox, xrefs: 0040CC67, 0040CC6C, 0040CC74, 0040CC75
Win32_BaseBoard, xrefs: 0040CB5A
Caption, xrefs: 0040CB8F
None, xrefs: 0040CB75
VBOX, xrefs: 0040CBD9, 0040CBDE, 0040CBE6, 0040CBE7
SerialNumber, xrefs: 0040CB47
Model, xrefs: 0040CC21
Win32_computersystem, xrefs: 0040CC34
Virtual HD, xrefs: 0040CBF9, 0040CBFE, 0040CC06, 0040CC07

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Uninitialize$H_prolog3_$BlanketCreateInitializeInstanceProxy_memcmpchar_traits
String ID: Caption$Model$None$SerialNumber$VBOX$VMware$Virtual HD$Virtual Machine$VirtualBox$Win32_BaseBoard$Win32_DiskDrive$Win32_computersystem
API String ID: 2745930265-3403752223
Opcode ID: afba524459cc619bef8070b93cc53d1656c5124e5d9a5aeab20820540dee5502
Instruction ID: 2c79ee3c88a6652044b09f023e0d0dd3da2de80707b64472bd0806eeba81ef43
Opcode Fuzzy Hash: afba524459cc619bef8070b93cc53d1656c5124e5d9a5aeab20820540dee5502
Instruction Fuzzy Hash: 4541BCA1900104EBEF10B779C8979FE7A348A96738F64033EF810772C2DA7C1D49966A

Function 05887480 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75A773E0,?,?,?,0588561E,0000035E,000002FA), ref: 0588748C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 058874A2
swprintf.LIBCMT ref: 058874DF

Part of subcall function 05887400: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,05887513), ref: 0588742D
Part of subcall function 05887400: GetProcAddress.KERNEL32(00000000), ref: 05887434
Part of subcall function 05887400: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,05887513), ref: 05887442

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 05887537
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 05887553
RegCloseKey.KERNEL32(000002FA), ref: 05887576
FreeLibrary.KERNEL32(00000000,?,?,?,0588561E,0000035E,000002FA), ref: 05887588

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0588752D
ProductName, xrefs: 0588754D
%d.%d.%d, xrefs: 058874D7
ntdll.dll, xrefs: 05887487
RtlGetNtVersionNumbers, xrefs: 0588749C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: 0ca0b9f77e96e9c2192f1394d82237c4c55d11d38ed807be0997d8d0c37ef453
Instruction ID: 668f785ef5cb4569f9ebde4b18ef48ab1d8692e78891c798cc708635cd248800
Opcode Fuzzy Hash: 0ca0b9f77e96e9c2192f1394d82237c4c55d11d38ed807be0997d8d0c37ef453
Instruction Fuzzy Hash: DC318876A512087BEB14EBA4CC46FBF7BBCEB44740F104158BE07E6141DA759E44C7A1

Function 0040C523 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 191comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C52A
CoInitializeEx.COMBASE(00000000,00000000), ref: 0040C536
CoInitializeSecurity.COMBASE(00000000,?,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C54E
CoCreateInstance.COMBASE(0043AB58,00000000,00000001,0043AA88,?), ref: 0040C572

Part of subcall function 0040C466: __EH_prolog3.LIBCMT ref: 0040C46D
Part of subcall function 0040C466: new.LIBCMT ref: 0040C476
Part of subcall function 0040C466: SysAllocString.OLEAUT32(?), ref: 0040C497
Part of subcall function 0040C466: _com_issue_error.COMSUPP ref: 0040C4AD

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C5E4
VariantClear.OLEAUT32(?), ref: 0040C6B9
CoUninitialize.COMBASE(?,?,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C6EF

Strings

SELECT * FROM MSAcpi_ThermalZoneTemperature, xrefs: 0040C5F9
ROOT\WMI, xrefs: 0040C580
CurrentTemperature, xrefs: 0040C6AA
WQL, xrefs: 0040C60B

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3Initialize$AllocBlanketClearCreateInstanceProxySecurityStringUninitializeVariant_com_issue_error
String ID: CurrentTemperature$ROOT\WMI$SELECT * FROM MSAcpi_ThermalZoneTemperature$WQL
API String ID: 55904104-758785639
Opcode ID: 6b42160d87e1f121732a507b0567528ed7a655f6cb0655fd1ab74eac948b6031
Instruction ID: 0c63fec1ebbd1063192dc824a3d4b9ed42997d3643afbfb779d655078e42d065
Opcode Fuzzy Hash: 6b42160d87e1f121732a507b0567528ed7a655f6cb0655fd1ab74eac948b6031
Instruction Fuzzy Hash: 996149B0A00219EFEB14DFA4CCD49BFB7B9EF48754B104669F511B7290CB35AD028B64

Function 05886760 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 05885320: InterlockedDecrement.KERNEL32(00000008), ref: 0588536F
Part of subcall function 05885320: SysFreeString.OLEAUT32(00000000), ref: 05885384
Part of subcall function 05885320: SysAllocString.OLEAUT32(058A5040), ref: 058853D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,058A5040,05886974,058A5040,00000000,75A773E0), ref: 058867C4
GetLastError.KERNEL32 ref: 058867CE
GetProcessHeap.KERNEL32(00000008,?), ref: 058867E6
HeapAlloc.KERNEL32(00000000), ref: 058867ED
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0588680F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 05886841
GetLastError.KERNEL32 ref: 0588684B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 058868B6
HeapFree.KERNEL32(00000000), ref: 058868BD

Strings

NONE_MAPPED, xrefs: 05886858

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: bf5dc519f83b6da9f2b48b3d7db9aa55ac57b19e9f29b9a8a123f493dc2a0e9a
Instruction ID: 036c6066b2a107010dc07781742bc0b24e4e59bc75e010160449e3ea8b36f104
Opcode Fuzzy Hash: bf5dc519f83b6da9f2b48b3d7db9aa55ac57b19e9f29b9a8a123f493dc2a0e9a
Instruction Fuzzy Hash: 2B41A9B5600208ABEB20EB65DD49FBE7779EB84700F004498FE0AE7140EF745E858F65

Function 05886C20 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,7591DF80,00000000,75A773E0), ref: 05886C5B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 05886C7A
_memset.LIBCMT ref: 05886CB1
GlobalMemoryStatusEx.KERNEL32(?), ref: 05886CC4
swprintf.LIBCMT ref: 05886D09
swprintf.LIBCMT ref: 05886D1C

Strings

@, xrefs: 05886CBD
%sFree%d Gb , xrefs: 05886D11
:, xrefs: 05886C50
HDD:%d, xrefs: 05886CFE

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: 8eb4ba3f83888823f863952d0c16fc474f4fa607b402e173484f34f50a99334b
Instruction ID: cf7b5a667cb8eb95387351fa7c362e11d12e8a4cc27f637dedf353b176bbbba1
Opcode Fuzzy Hash: 8eb4ba3f83888823f863952d0c16fc474f4fa607b402e173484f34f50a99334b
Instruction Fuzzy Hash: 693150B6E0020C9BEB14DFE9DC45FEEB7B9FB48700F504219E91AA7240EA746905CB90

Function 05886ED0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(058A568C,?,A97BC7BB,7591DF80,00000000,75A773E0), ref: 05886F3A
swprintf.LIBCMT ref: 0588710E
std::_Xinvalid_argument.LIBCPMT ref: 058871B7

Strings

vector<T> too long, xrefs: 058871B2
%s%s %d %d , xrefs: 05887103
%s%s %d*%d , xrefs: 05887327

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: c61a4716315564855ec2c1764d8e7929d83327d7b4b53102f8a48bcd93b4253d
Instruction ID: fe0792a755e364ea0af929579a15538feea5b7e725ea9b1a1ab057ca6c2313ba
Opcode Fuzzy Hash: c61a4716315564855ec2c1764d8e7929d83327d7b4b53102f8a48bcd93b4253d
Instruction Fuzzy Hash: 12E15471A002259FDF24EA24CC80BFEB375FB85700F2445A9DD5AE7284D771AE818B91

Function 0040CEF5 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CEFF

Part of subcall function 00411365: __EH_prolog3_catch.LIBCMT ref: 0041136C

GetAdaptersInfo.IPHLPAPI(00000000), ref: 0040CFD3
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040CFF6

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

Strings

08-00-27, xrefs: 0040CF04
00-0C-29, xrefs: 0040CF3D
00-50-56, xrefs: 0040CF4E
00-03-FF, xrefs: 0040CF1C
00-05-69, xrefs: 0040CF29

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: AdaptersInfo$DeallocateH_prolog3_H_prolog3_catchstd::_
String ID: 00-03-FF$00-05-69$00-0C-29$00-50-56$08-00-27
API String ID: 140774986-3516324377
Opcode ID: a8648ae8c57cef04309381a6926909f22cbb29df705be5f16881c2efe024e1c6
Instruction ID: cad030cf8234abf9314854909dd205eff32562fb78da9b9eee7dc8479228d978
Opcode Fuzzy Hash: a8648ae8c57cef04309381a6926909f22cbb29df705be5f16881c2efe024e1c6
Instruction Fuzzy Hash: 14819A31E01258DEEB20DBA4CC41BEEBBB5AF14314F5401EAE10977282DB785E89CF65

Function 05887400 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,05887513), ref: 0588742D
GetProcAddress.KERNEL32(00000000), ref: 05887434
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,05887513), ref: 05887442
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,05887513), ref: 0588744A

Strings

GetNativeSystemInfo, xrefs: 05887408
kernel32.dll, xrefs: 0588740D

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 307934246c41b54c4f09ca5f4059dfd5ff9e5efed7556316bc4c43e8195d6835
Instruction ID: 306b17d0d2e8ea921931b00b96ac0b038a86ca682260bb09dd5d3859e5d5ed76
Opcode Fuzzy Hash: 307934246c41b54c4f09ca5f4059dfd5ff9e5efed7556316bc4c43e8195d6835
Instruction Fuzzy Hash: 0301EC74D092099FDF50EFB495456BEBBF5EB08200F504569ED0AE3341EA3AAE508B61

Function 05886020 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588604C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 05886058
Process32FirstW.KERNEL32(00000000,00000000), ref: 05886089
Process32NextW.KERNEL32(00000000,0000022C), ref: 058860DF
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 058860E6

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 862717e684e8c1d2e533eb34457a48905abfdc2eb55d5748b5b147552846935d
Instruction ID: 55a938b9edc3cf3c303d249df29658cdefbc8a6d4f685a65a20a25ccb91ecfb2
Opcode Fuzzy Hash: 862717e684e8c1d2e533eb34457a48905abfdc2eb55d5748b5b147552846935d
Instruction Fuzzy Hash: 4A2194316101189BEB20FF68AC59BFAB369FF24314F104295EC1AD7180FB31AE05C655

Function 0040BC8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040BC93
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BCC5

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

@, xrefs: 0040BD07

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catch_ThrowUser
String ID: @
API String ID: 2496864217-2766056989
Opcode ID: 2de8dc4e35383c6151940d4016f9c810659b6c960c2a302111626511353e57d0
Instruction ID: ae7c116213ff3d901724b6428fc8427c71a3f9cab7b4ef2a80dbfd93885d7ade
Opcode Fuzzy Hash: 2de8dc4e35383c6151940d4016f9c810659b6c960c2a302111626511353e57d0
Instruction Fuzzy Hash: D511A671D0026C65DB22ABA68C89F7F6E78DF87BA0F04501FF50867141CB7C4546EEA6

Function 00404BBD Relevance: 3.8, APIs: 2, Instructions: 802networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00404F4E
recv.WS2_32(?,?,00040000,00000000), ref: 004050D0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: ac29f364758362306f86bd3f715e760089c0395256dff397d52ad160623d8a14
Instruction ID: efe57192649d8688e423c31ea2ba61c287f9bb0601e35bcbe0f9d9de6db3ce85
Opcode Fuzzy Hash: ac29f364758362306f86bd3f715e760089c0395256dff397d52ad160623d8a14
Instruction Fuzzy Hash: 3B0218B79C9A8CAFF230EAC56C59B72B79CE313A37F300B33E966D26D0D66854418550

Function 0040BC00 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040BC07
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BC20

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID:
API String ID: 1841272387-0
Opcode ID: 39fda0efeca56565c6fa06b1fc5ec53f4701eb728d21d9137ee5ceea68e223a5
Instruction ID: c7a0f4040fa537f1793bcdd69a76fca78c649a4b054b484e010122540f5b1e4c
Opcode Fuzzy Hash: 39fda0efeca56565c6fa06b1fc5ec53f4701eb728d21d9137ee5ceea68e223a5
Instruction Fuzzy Hash: 76F0BB21D4012C76DA22A7B29D8CE7F6D7CDF8BAA1F50505FF008A21408F2C4546EEFA

Function 0040BAA0 Relevance: 3.1, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040BAAA
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BB05

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catch_ThrowUser
String ID:
API String ID: 2496864217-0
Opcode ID: 7b59d06170d4ad62566acd0a9c4d59ccc159564280425c00108b25958848e823
Instruction ID: 758e7640c992d458a83e73611db6df2efd19529b5e74a096fe474286059fe2e7
Opcode Fuzzy Hash: 7b59d06170d4ad62566acd0a9c4d59ccc159564280425c00108b25958848e823
Instruction Fuzzy Hash: 54011231D4022C66CB25AB618C8ABFFAE78DF46B55F00509EF108A6141CB784A459FE9

Function 023D6D75 Relevance: 2.2, Instructions: 2248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d59eba33419220fab1722354699e203160e3d14fdc26a004ab78ce9c5ec21f3
Instruction ID: d7d626a57004030ac816f2d830c0f32aaa39e1c59d18c400e42b2c8c91efc9fe
Opcode Fuzzy Hash: 3d59eba33419220fab1722354699e203160e3d14fdc26a004ab78ce9c5ec21f3
Instruction Fuzzy Hash: AC13AE72A00255CFDB25CF68D8807ADFBB6FF49304F1481AAD859AB381D734A946CF90

Function 023D39F5 Relevance: 1.6, Instructions: 1603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557fd95e002be5ae85579bb77ed6a08b49850f2ddf8d9112cf3ddefca6f25630
Instruction ID: 5050fd458292a6a9b7bf383c05c5322d7e38423eb10b8580391627bdfa2fca36
Opcode Fuzzy Hash: 557fd95e002be5ae85579bb77ed6a08b49850f2ddf8d9112cf3ddefca6f25630
Instruction Fuzzy Hash: 50E2DF71A00255DFDB25CF68D880BADBBF2FF49304F1481A9E949AB786D734A845CF90

Function 02404305 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0247674F,?,00000000), ref: 0240430F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 702c7e317ab3f53b736964da102ab380ae45d93e5f7a9feff75c1bb93bc30af3
Instruction ID: d3738fe992ee4f186145fced47513772438de4ca036a9cc469de244c76204be5
Opcode Fuzzy Hash: 702c7e317ab3f53b736964da102ab380ae45d93e5f7a9feff75c1bb93bc30af3
Instruction Fuzzy Hash: 6A900271601900D2454071588804406600597E13013F6C115A0654564CCA188955A2A9

Function 0226AEAF Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

, xrefs: 0226AECF

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1d98501bcb5a5088169635d4871e9d7fe3341a7799f594ef6beebcf001f3873c
Instruction ID: 04764a0fb4a94eb1609d06aedbfce296c3bb061d03378d940b7fba78be8cad5f
Opcode Fuzzy Hash: 1d98501bcb5a5088169635d4871e9d7fe3341a7799f594ef6beebcf001f3873c
Instruction Fuzzy Hash: 82015A3243424AEFCF15AFE1D90CAAE3B65EB48398F118028F806A1164D7759AA0EF11

Function 023D0425 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9130d9898f645e41b3a0fceade0e7b254e8ecd59db69927599aa03c2b03ea7
Instruction ID: 4a04af3c41b4d0d09238366abef598eb11aca61d96a2f1dad27c00b6cd652e7f
Opcode Fuzzy Hash: 2e9130d9898f645e41b3a0fceade0e7b254e8ecd59db69927599aa03c2b03ea7
Instruction Fuzzy Hash: 21F1CC71B00611DFDB29CF69D894B6AB7B6FF84704F1081A9E8169B781C734E985CF90

Function 023D01EA Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f51087a112ed96416a85086d81112186fb0f796a0a6a7488d17344b655bfdc8
Instruction ID: 296a7496e8f11303feebaf3b5632dca6e4a0bc35272bc5c8773f316ff84f9aa4
Opcode Fuzzy Hash: 6f51087a112ed96416a85086d81112186fb0f796a0a6a7488d17344b655bfdc8
Instruction Fuzzy Hash: DFB12632B04655AFDB25CBAAC890BBEBBFAEF84704F15019AD5519B381CB70E941CB50

Function 0040D249 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D253

Part of subcall function 00411365: __EH_prolog3_catch.LIBCMT ref: 0041136C

Strings

Johnson, xrefs: 0040D2EB
user, xrefs: 0040D34F
Sandbox, xrefs: 0040D28E
Sangfor, xrefs: 0040D3DB
sand box, xrefs: 0040D363
test user, xrefs: 0040D39F
milozs, xrefs: 0040D313
malware, xrefs: 0040D377
virus, xrefs: 0040D3B3
Miller, xrefs: 0040D2FF
timmy, xrefs: 0040D33B
Hong Lee, xrefs: 0040D2C3
Peter Wilson, xrefs: 0040D327
CurrentUser, xrefs: 0040D276
JOHN-PC, xrefs: 0040D3EF
maltest, xrefs: 0040D38B
John Doe, xrefs: 0040D3C7
HAPUBWS, xrefs: 0040D2AF
Emily, xrefs: 0040D29B
IT-ADMIN, xrefs: 0040D2D7

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_H_prolog3_catch
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$JOHN-PC$John Doe$Johnson$Miller$Peter Wilson$Sandbox$Sangfor$maltest$malware$milozs$sand box$test user$timmy$user$virus
API String ID: 3862090230-243956707
Opcode ID: 1c66b16550f99bcd323c21c3f8f68982231fbfbce7b62f4824458308cdcb34b6
Instruction ID: a740bf118985a8ba2e6b965ac6ed2a48cb7c2ed2878fac0725f1b94998e77058
Opcode Fuzzy Hash: 1c66b16550f99bcd323c21c3f8f68982231fbfbce7b62f4824458308cdcb34b6
Instruction Fuzzy Hash: 96513D30D01258DADB25EB60C896BDDB7346B14708F6401FEA549362C2DFB81F8CDA69

Function 05889E40 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009A20,?,?,00000000), ref: 05889E6B
GdipGetImageHeight.GDIPLUS(Function_00009A20,?,?,00000000), ref: 05889EEC
GdipGetImageWidth.GDIPLUS(Function_00009A20,?,?,00000000), ref: 05889F14
GdipGetImagePaletteSize.GDIPLUS(Function_00009A20,?,?,00000000), ref: 05889F6F
_malloc.LIBCMT ref: 05889FB0

Part of subcall function 0588F563: __FF_MSGBANNER.LIBCMT ref: 0588F57C
Part of subcall function 0588F563: __NMSG_WRITE.LIBCMT ref: 0588F583
Part of subcall function 0588F563: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F5A8

_free.LIBCMT ref: 05889FF0
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 0588A018
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 0588A0A7
GdipBitmapLockBits.GDIPLUS(Function_00009A20,?,00000001,?,?,?,00000000), ref: 0588A102
_free.LIBCMT ref: 0588A124
_memcpy_s.LIBCMT ref: 0588A173
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 0588A1C0
GdipCreateBitmapFromScan0.GDIPLUS(?,?,058A5968,00022009,?,00000000,?,00000000), ref: 0588A21C
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 0588A23C
GdipDrawImageI.GDIPLUS(00000000,Function_00009A20,00000000,00000000,?,00000000), ref: 0588A257
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 0588A264
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 0588A26B
_free.LIBCMT ref: 0588A286

Strings

&, xrefs: 05889ED1

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateColorContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeTableUnlockWidth_malloc_memcpy_s
String ID: &
API String ID: 640422297-3042966939
Opcode ID: c36449dcc92491b5c2fe8ae4ca171e670c041e2e68d5f567d421a06bd095be62
Instruction ID: 4d27251c164c17bf668210dcdb2c72aaad519b126bb2d69066d62e0b89f9b28e
Opcode Fuzzy Hash: c36449dcc92491b5c2fe8ae4ca171e670c041e2e68d5f567d421a06bd095be62
Instruction Fuzzy Hash: B1D192B0A002199FDB24EF54CC84BBAB7B5FF48314F0085A9EA0AE7240D774AE85CF55

Function 05882DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 05882DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 05882DC7
timeGetTime.WINMM ref: 05882DCD
socket.WS2_32(00000002,00000001,00000006), ref: 05882DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 05882E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 05882E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 05882E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 05882E5D
gethostbyname.WS2_32(00000000), ref: 05882E6B
htons.WS2_32(?), ref: 05882E8D
connect.WS2_32(?,?,00000010), ref: 05882EAB

Strings

0u, xrefs: 05882F1C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: f48b57cb0070dc486c75aabcae1bf7021ab87a1e698406494c7e063f676d07c5
Instruction ID: c57a5b4c5f5629cbd5cc5f10d6fe4ceb0ceee9b58e4590123bd4933dc4e4a6d0
Opcode Fuzzy Hash: f48b57cb0070dc486c75aabcae1bf7021ab87a1e698406494c7e063f676d07c5
Instruction Fuzzy Hash: EC617075A40304AFE720EFA4DC46FAAB7B8FF48710F104519FA56E76D0DAB0B9048B65

Function 0588ACF0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 347
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 0588AD2E
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,80000001,00000000,?), ref: 0588AD4A

Strings

Console\0, xrefs: 0588B0BD
Console, xrefs: 0588AD0E
%s_bin, xrefs: 0588AE0A
IpDatespecial, xrefs: 0588AD44

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: fedc5c187d2f06c3b46d88cc99732ac24f8d1d271fafd12cab3862796d9cd84e
Instruction ID: f22098ec1b0e337f4b07745715215c7eed2c75ed277b1564474f4c76b6455b84
Opcode Fuzzy Hash: fedc5c187d2f06c3b46d88cc99732ac24f8d1d271fafd12cab3862796d9cd84e
Instruction Fuzzy Hash: 76C1BDB1600301ABE714EF28DC4AB7777A9EB94714F044529FD8ADB281E775ED04C7A2

Function 05886120 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0588615B
lstrcatW.KERNEL32(058B1F50,058A5000,?,A97BC7BB,00000AD4,00000000,75A773E0), ref: 0588619D
lstrcatW.KERNEL32(058B1F50,058A524C,?,A97BC7BB,00000AD4,00000000,75A773E0), ref: 058861A9
CoCreateInstance.OLE32(058A2480,00000000,00000017,058A567C,?,?,A97BC7BB,00000AD4,00000000,75A773E0), ref: 058861F0
_memset.LIBCMT ref: 0588629E
wsprintfW.USER32 ref: 05886306
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0588632F
_memset.LIBCMT ref: 05886346

Part of subcall function 05886020: _memset.LIBCMT ref: 0588604C
Part of subcall function 05886020: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 05886058

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 05886300

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1221949200-4035668053
Opcode ID: 89ef40b19ebad12c14fd40a855f393ca65452543db00ff410bc30849e6f54731
Instruction ID: d90bbd08d52f71c261c30cfb807d21c3afebb9cb75a4c39d0a3a4677d48a027c
Opcode Fuzzy Hash: 89ef40b19ebad12c14fd40a855f393ca65452543db00ff410bc30849e6f54731
Instruction Fuzzy Hash: 028176B1A10268ABEB20DB55DC45FAEB7B8EB44704F044188FF09E7241E774AE80DF65

Function 05885F10 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,058AEE04), ref: 05885F36
GetLastError.KERNEL32 ref: 05885F3E
Sleep.KERNEL32(000003E8), ref: 05885F55
CreateMutexW.KERNEL32(00000000,00000000,058AEE04), ref: 05885F60
GetLastError.KERNEL32 ref: 05885F62
_memset.LIBCMT ref: 05885F89
lstrlenW.KERNEL32(?), ref: 05885F96
lstrcmpW.KERNEL32(?,058A5218), ref: 05885FBC
Sleep.KERNEL32(000003E8), ref: 05885FC7
GetModuleHandleW.KERNEL32(00000000), ref: 05885FD4
GetConsoleWindow.KERNEL32 ref: 05885FDE

Strings

open, xrefs: 05885F98
key, xrefs: 05885FA1

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: key$open
API String ID: 2922109467-2893384115
Opcode ID: 3625d7442ac34aa7d0513b7f603adf5c266089b48a5dd25bc9850ba6c1aafea8
Instruction ID: c82e23c7f68ee57656f00e42b0c9fec18149a6defc36b37a15060466132804df
Opcode Fuzzy Hash: 3625d7442ac34aa7d0513b7f603adf5c266089b48a5dd25bc9850ba6c1aafea8
Instruction Fuzzy Hash: 1E21E136654304ABE620FB64AC46F6A7798EB84700F100929FE46D71C0EF74BD08CAA3

Function 0040C806 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 238
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0040C810
CoInitialize.OLE32(00000000), ref: 0040C821
CoCreateInstance.COMBASE(0043AB58,00000000,00000001,0043AA88,?), ref: 0040C841
CoUninitialize.COMBASE ref: 0040C8DA

Part of subcall function 0040C466: __EH_prolog3.LIBCMT ref: 0040C46D
Part of subcall function 0040C466: new.LIBCMT ref: 0040C476
Part of subcall function 0040C466: SysAllocString.OLEAUT32(?), ref: 0040C497
Part of subcall function 0040C466: _com_issue_error.COMSUPP ref: 0040C4AD

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0040C8B8
CoUninitialize.COMBASE ref: 0040C9B8

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

Strings

SELECT * FROM , xrefs: 0040C8F1
ROOT\CIMV2, xrefs: 0040C84F
WQL, xrefs: 0040C928

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Uninitialize$AllocBlanketCreateDeallocateH_prolog3H_prolog3_InitializeInstanceProxyString_com_issue_errorstd::_
String ID: ROOT\CIMV2$SELECT * FROM $WQL
API String ID: 115743266-1972049189
Opcode ID: 8f7339e58dd4261f4a7628e53cd33fd972a00d9235bbcc0f996b60dd26809251
Instruction ID: 9520bbf863120fca48183976df3bb85adcecea4f5cebccfa541607eded1f5bf3
Opcode Fuzzy Hash: 8f7339e58dd4261f4a7628e53cd33fd972a00d9235bbcc0f996b60dd26809251
Instruction Fuzzy Hash: E9914EB1A01218DFDB60DB54CC94BAAB778EF44304F1441EDF60AA7291CB789E85CF68

Function 0588BFC0 Relevance: 19.7, APIs: 13, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,A97BC7BB,?,00000000,?), ref: 0588BFFE
GlobalLock.KERNEL32(00000000), ref: 0588C00A
GlobalUnlock.KERNEL32(00000000), ref: 0588C01F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0588C035
EnterCriticalSection.KERNEL32(058AFBA4), ref: 0588C073
LeaveCriticalSection.KERNEL32(058AFBA4), ref: 0588C084

Part of subcall function 05889DD0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 05889DF4
Part of subcall function 05889DD0: GdipDisposeImage.GDIPLUS(?), ref: 05889E08

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0588C0AC

Part of subcall function 0588A450: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0588A47D
Part of subcall function 0588A450: _free.LIBCMT ref: 0588A4F3

GetHGlobalFromStream.OLE32(?,?), ref: 0588C0CD
GlobalLock.KERNEL32(?), ref: 0588C0D7
GlobalFree.KERNEL32(00000000), ref: 0588C0EF

Part of subcall function 05889B90: DeleteObject.GDI32(?), ref: 05889BC2
Part of subcall function 05889B90: EnterCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889BD3
Part of subcall function 05889B90: EnterCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889BE8
Part of subcall function 05889B90: GdiplusShutdown.GDIPLUS(00000000,?,?,?,05889B6B), ref: 05889BF4
Part of subcall function 05889B90: LeaveCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889C05
Part of subcall function 05889B90: LeaveCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889C0C

GlobalSize.KERNEL32(00000000), ref: 0588C105
GlobalUnlock.KERNEL32(?), ref: 0588C181
GlobalFree.KERNEL32(00000000), ref: 0588C1A9

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 02f24c96ac09ba8599252c6e5038bf99a5ce0a523dc0b7e3645a484449ac7329
Instruction ID: 83af5278806502ac5ab95936d6ee2288b8432f56e788872b4d6935e273e3ce50
Opcode Fuzzy Hash: 02f24c96ac09ba8599252c6e5038bf99a5ce0a523dc0b7e3645a484449ac7329
Instruction Fuzzy Hash: C6613EB5D10218AFDB10EFA8D8899AEBBB9FF48710F104129F916E7240DB34AD05CF61

Function 05886460 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05886492
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 058864B2
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 058864F4
_memset.LIBCMT ref: 05886530
_memset.LIBCMT ref: 0588655E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000AD4,75A773E0), ref: 0588658A
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75A773E0), ref: 05886593
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75A773E0), ref: 058865A5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,75A773E0), ref: 058865F5
lstrlenW.KERNEL32(?), ref: 05886605

Strings

Software\Tencent\Plugin\VAS, xrefs: 058864A8

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: 033f929b5e8de9d5d4a4379c0c527886ce83545d6b97052b3fea82b3e1e082db
Instruction ID: 7f31921823b8325ee211bc6f062f69b5f85bf9d283635e28db9996dccff4a460
Opcode Fuzzy Hash: 033f929b5e8de9d5d4a4379c0c527886ce83545d6b97052b3fea82b3e1e082db
Instruction Fuzzy Hash: A84175F5B40219ABDB34EB54DD85FFA7378EF44600F0041A9FB0AF6041EA70AE858B64

Function 05886286 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 125stringregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588629E
wsprintfW.USER32 ref: 05886306
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0588632F
_memset.LIBCMT ref: 05886346
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 05886382
lstrcatW.KERNEL32(058B1F50,?), ref: 0588639E
lstrcatW.KERNEL32(058B1F50,058A524C), ref: 058863AA
RegCloseKey.ADVAPI32(00000000), ref: 058863B3
lstrlenW.KERNEL32(058B1F50,?,A97BC7BB,00000AD4,00000000,75A773E0), ref: 058863F7
lstrcatW.KERNEL32(058B1F50,058A52C4,?,A97BC7BB,00000AD4,00000000,75A773E0), ref: 0588640B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 05886300

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1671694837-4035668053
Opcode ID: 4299ebcab87ec35440688f7ac7ea0f08dc06c30897b97d4772c3229076a2c4c7
Instruction ID: 861d6d39278a83e2d57fec7ccc8342bf29c1db019cd8c17143d1209115b1f3f0
Opcode Fuzzy Hash: 4299ebcab87ec35440688f7ac7ea0f08dc06c30897b97d4772c3229076a2c4c7
Instruction Fuzzy Hash: 194186B16002689ADB34DB55CC55FFEB7B8EF48704F0441C8FB49A6281EA746E80DF64

Function 0040B1D4 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 435COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040B1DB
new.LIBCMT ref: 0040B24B

Part of subcall function 004028D1: __EH_prolog3_catch_GS.LIBCMT ref: 004028DB
Part of subcall function 004028D1: __CxxThrowException@8.LIBVCRUNTIME ref: 00402979

__CxxThrowException@8.LIBVCRUNTIME ref: 0040B418

Strings

103.199.100.97, xrefs: 0040B2B0
8080, xrefs: 0040B2E1, 0040B37B, 0040B46A
103.199.100.130, xrefs: 0040B34A
103.199.100.97, xrefs: 0040B2BA, 0040B354, 0040B452
5, xrefs: 0040B4DF
8080, xrefs: 0040B2DA
B, xrefs: 0040B40B

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$H_prolog3_catchH_prolog3_catch_
String ID: 103.199.100.130$103.199.100.97$103.199.100.97$5$8080$8080$B
API String ID: 98217301-1444392773
Opcode ID: 47d9daeef4d3209eae45cbf431f718fe92535ce3f45df06c6634c580522dc4f8
Instruction ID: 627e5c4fc20fcd7c1fea17cce080d21d0ef25ac72cdc71b494a25d7dfd5891bf
Opcode Fuzzy Hash: 47d9daeef4d3209eae45cbf431f718fe92535ce3f45df06c6634c580522dc4f8
Instruction Fuzzy Hash: CC91B515886E6C69D23673614C8DAFE745DDFA331BF112337E891D0261CF6C064789AE

Function 0588A450 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0588A47D
_malloc.LIBCMT ref: 0588A4C1
_free.LIBCMT ref: 0588A4F3
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 0588A512
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 0588A584
GdipDisposeImage.GDIPLUS(00000000), ref: 0588A58F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0588A5B5
GdipDisposeImage.GDIPLUS(00000000), ref: 0588A5CD

Strings

&, xrefs: 0588A569

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: b8cd744a4e6f2ecfa4c9f8d86c4c978c5cef488862564e82a96d1ee346f02ef9
Instruction ID: 56ee18491bbf6febf45e28fb39d2393fb82e518e11e115bcb60a426a041d958e
Opcode Fuzzy Hash: b8cd744a4e6f2ecfa4c9f8d86c4c978c5cef488862564e82a96d1ee346f02ef9
Instruction Fuzzy Hash: 7E516371A002199FDB14EFE4D8489FEB7B9FF48210F044119ED06E7290D734AD45CBA1

Function 00408269 Relevance: 13.9, APIs: 2, Strings: 5, Instructions: 1690COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004085C9

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

!jWW, xrefs: 004087A1
Console\0, xrefs: 004083FF, 00408DB2
e, xrefs: 004082AB
{vU_, xrefs: 0040873D
45748404e431b11b2e469590a2b52759, xrefs: 004084A7

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID: !jWW$45748404e431b11b2e469590a2b52759$Console\0$e${vU_
API String ID: 2513928553-1001513282
Opcode ID: 769aa0166993147af42cec2fe8af969429d5ea3364c3d6662663f521f31a9749
Instruction ID: ae781606f217e08613b33236576e902dbc81fd8844841d1b591bdced9623e9f0
Opcode Fuzzy Hash: 769aa0166993147af42cec2fe8af969429d5ea3364c3d6662663f521f31a9749
Instruction Fuzzy Hash: 92822ABB989A8CBFF120E6C56C69B72B75CE313A37F301B37F966C2790D65854418190

Function 0588C9B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,058A11E8,A97BC7BB,00000000,00000001,00000000), ref: 0588C9F1
RegQueryInfoKeyW.ADVAPI32(058A11E8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0588CA20
_memset.LIBCMT ref: 0588CA84
_memset.LIBCMT ref: 0588CA93
RegEnumValueW.ADVAPI32(058A11E8,?,00000000,?,00000000,?,00000000,?), ref: 0588CAB2

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

Part of subcall function 0588F5F7: std::exception::exception.LIBCMT ref: 0588F646
Part of subcall function 0588F5F7: std::exception::exception.LIBCMT ref: 0588F660
Part of subcall function 0588F5F7: __CxxThrowException@8.LIBCMT ref: 0588F671

RegCloseKey.KERNEL32(058A11E8,?,?,?,?,?,?,?,?,?,?,?,00000000,058A11E8,000000FF), ref: 0588CBC3

Strings

Console\0, xrefs: 0588C9E4

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: 41ff215e1124148a01459551826dc3768356eca6d3b015f98aa727f57ce45cb6
Instruction ID: c1cc88c77a7eaf00d1d54dec53b4975ba83c14241244f9ead1e98e41b4be1fad
Opcode Fuzzy Hash: 41ff215e1124148a01459551826dc3768356eca6d3b015f98aa727f57ce45cb6
Instruction Fuzzy Hash: 8E610EB1E00219AFDB04DFA8D885EAEB7B9FB48310F144569F915E7245DB34AD01CBA1

Function 0588BA60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

_memset.LIBCMT ref: 0588BA81
GetLastInputInfo.USER32(?), ref: 0588BA97
GetTickCount.KERNEL32 ref: 0588BA9D
wsprintfW.USER32 ref: 0588BAC6
GetForegroundWindow.USER32 ref: 0588BACF
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 0588BAE3

Strings

%d min, xrefs: 0588BAC0

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: e47a666aa1fff42558902caec9aafa6910c53e06ce8384b44f986e506981b66f
Instruction ID: 982a287622272e2253245a0ef471600f7c91aa37e36ebefad49096e9c189a3ad
Opcode Fuzzy Hash: e47a666aa1fff42558902caec9aafa6910c53e06ce8384b44f986e506981b66f
Instruction Fuzzy Hash: 16419575A00214ABDB10EFA8D889EAF7BB9EF44710F088154FD09DB355E674AE44CBE1

Function 058868E0 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(A97BC7BB,00000000,00000000,75A773E0,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886908
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886917
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 05886930
CloseHandle.KERNEL32(00000000,?,00000000,058A0FCB,000000FF,?,05886A83,00000000), ref: 0588693B
SysStringLen.OLEAUT32(00000000), ref: 0588698E
SysStringLen.OLEAUT32(00000000), ref: 0588699C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,058A0FCB,000000FF), ref: 058869FE
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,058A0FCB,000000FF), ref: 05886A04

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: 89de22e83b943be4c849e33e2d6c64ee930d67a827cbf8e1fa17166462622584
Instruction ID: 6cba2885662d272f23960d76827f0e45103af7c0add6e43cb0514d8f6fa1646d
Opcode Fuzzy Hash: 89de22e83b943be4c849e33e2d6c64ee930d67a827cbf8e1fa17166462622584
Instruction Fuzzy Hash: 6141D572E402189BDB10EFA9CD85ABEF7F8FB94710F144515ED26E7240EB756D008BA1

Function 0040E21F Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040E229

Part of subcall function 0040DC56: __EH_prolog3_GS.LIBCMT ref: 0040DC5D
Part of subcall function 0040DC56: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040DD4A

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E24D

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

!!!, xrefs: 0040E342
!!, xrefs: 0040E369
c, xrefs: 0040E23D
v4:%d, xrefs: 0040E30E

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_H_prolog3_catch_ThrowUnothrow_t@std@@@User__ehfuncinfo$??2@
String ID: !!$!!!$c$v4:%d
API String ID: 3962320563-2754867093
Opcode ID: 123bfd44f6b178990913d7ba7eec121d4a56842681cc32fe6126031ba21ad18d
Instruction ID: 7bc45ed4ea60eb1dafc130ecb2d4e3acd60c322b16c83d1f4977d11e0af54f6d
Opcode Fuzzy Hash: 123bfd44f6b178990913d7ba7eec121d4a56842681cc32fe6126031ba21ad18d
Instruction Fuzzy Hash: 6E31C826A91B5C2BF20577A24CCEB3C551CEB7270BF06132BF596D60E0CD744E438969

Function 05886D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05886DB5
RegOpenKeyExW.KERNEL32(80000001,AppEvents,00000000,00020019,?,000008CC,00000000), ref: 05886DD9
RegQueryValueExW.KERNEL32(?,?,00000000,00000001,?,00000208), ref: 05886E2F
lstrcmpW.KERNEL32(?,058A5040), ref: 05886E45

Strings

AppEvents, xrefs: 05886DD3

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmp
String ID: AppEvents
API String ID: 3592097068-2318512526
Opcode ID: de3af7c41fefb7c7c5d17c2bebdfafdeee3a45ff1fa9add4cbfd54bd1cc47056
Instruction ID: 8ef5d5ab1d56787f1f6b1cbc5189919b4230383f7e759436dcfb0de21cc52b5d
Opcode Fuzzy Hash: de3af7c41fefb7c7c5d17c2bebdfafdeee3a45ff1fa9add4cbfd54bd1cc47056
Instruction Fuzzy Hash: B2415771901218ABDB34DF95DC8DBAEB7B9FB48720F104299E81AD6240E7749E80CF50

Function 0588F919 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0588F93E
__calloc_crt.LIBCMT ref: 0588F94A
__getptd.LIBCMT ref: 0588F957
CreateThread.KERNEL32(00000000,00000000,0588F8B4,00000000,00000000,0588DF63), ref: 0588F98E
GetLastError.KERNEL32(?,?,00000000,?,0588DF63,00000000,00000000,05885F10,00000000,00000000,00000000), ref: 0588F998
_free.LIBCMT ref: 0588F9A1
__dosmaperr.LIBCMT ref: 0588F9AC

Part of subcall function 0588F80B: __getptd_noexit.LIBCMT ref: 0588F80B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 8289d086db4b80bd071c4e45121d5c603356cb4af59ca7539bbf362fe17a5bc5
Instruction ID: f1a15479247385f022bea20d2b669d5e9425667226feb894b26ded1d38d06a13
Opcode Fuzzy Hash: 8289d086db4b80bd071c4e45121d5c603356cb4af59ca7539bbf362fe17a5bc5
Instruction Fuzzy Hash: 1011E53320470A7FEB25BFA89C89DBB3BD9EF44724B140429FE15C6150EB30DC1186A2

Function 0588F8B4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0588F8BA

Part of subcall function 05893B90: TlsGetValue.KERNEL32(00000000,05893CE9,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000), ref: 05893B99
Part of subcall function 05893B90: DecodePointer.KERNEL32(?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6,0000000D), ref: 05893BAB
Part of subcall function 05893B90: TlsSetValue.KERNEL32(00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6), ref: 05893BBA

___fls_getvalue@4.LIBCMT ref: 0588F8C5

Part of subcall function 05893B70: TlsGetValue.KERNEL32(?,?,0588F8CA,00000000), ref: 05893B7E

___fls_setvalue@8.LIBCMT ref: 0588F8D8

Part of subcall function 05893BC4: DecodePointer.KERNEL32(?,?,?,0588F8DD,00000000,?,00000000), ref: 05893BD5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0588F8E1
ExitThread.KERNEL32 ref: 0588F8E8
GetCurrentThreadId.KERNEL32 ref: 0588F8EE
__freefls@4.LIBCMT ref: 0588F90E

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 157cf1c78a7b0e67af081e8f79e417568dd13551f135eb8534a40c18d2ff61f5
Instruction ID: 748d45850f81617e4c13d8aeed25529b2dbfbc86b1fd6911ea68e2fb4bafebb2
Opcode Fuzzy Hash: 157cf1c78a7b0e67af081e8f79e417568dd13551f135eb8534a40c18d2ff61f5
Instruction Fuzzy Hash: 94F01274600341AFDB1CBF79C90DD2E7BA9EE442547248958BD05C7211EE35DD81CBA2

Function 0040824C Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 652COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00408256

Strings

Console\0, xrefs: 004083FF
e, xrefs: 004082AB
45748404e431b11b2e469590a2b52759, xrefs: 004084A7

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch
String ID: 45748404e431b11b2e469590a2b52759$Console\0$e
API String ID: 3886170330-629985466
Opcode ID: 50b706e70de4de0f723b4fc6144bbfa0a3f8de438d2a5a090e821d549b0ec00b
Instruction ID: 968056f4663a5bf7a65357fed2d1c67a8e8a13bed8e7e62878ac9812bb02e024
Opcode Fuzzy Hash: 50b706e70de4de0f723b4fc6144bbfa0a3f8de438d2a5a090e821d549b0ec00b
Instruction Fuzzy Hash: 54E1F8BB989A8CAFF130E6C56C69B72B79CE313A37F301B37F966D1790DA1954018190

Function 0040CDBF Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

D3D11CreateDevice.D3D11(00000000,00000001,00000000,00000000,00000000,00000000,00000007,?,?,?), ref: 0040CE00
CreateDXGIFactory.DXGI(00445420,?), ref: 0040CE35

Part of subcall function 00410818: __EH_prolog3_catch.LIBCMT ref: 0041081F

Strings

Failed to create DXGI factory., xrefs: 0040CE3F
Failed to create D3D11 device., xrefs: 0040CE0A
@TD, xrefs: 0040CE0F, 0040CE44

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Create$DeviceFactoryH_prolog3_catch
String ID: @TD$Failed to create D3D11 device.$Failed to create DXGI factory.
API String ID: 2844046087-104575095
Opcode ID: 3b112c7fb986bae99d802b6b302170207aff9a7d46dbf808f79ee2335c3de06f
Instruction ID: ce3aecbf7d2233ee4cf59cfa48850e23a3f411b985804bfd3dd35abd15130d05
Opcode Fuzzy Hash: 3b112c7fb986bae99d802b6b302170207aff9a7d46dbf808f79ee2335c3de06f
Instruction Fuzzy Hash: 0B315B71204201AFC710DF65C888A6BBBE9FF89754F104A2EF45ACB251DB34D845CBA6

Function 05886660 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0588666B
CoCreateInstance.OLE32(058A46FC,00000000,00000001,058A471C,?,?,?,?,?,?,?,?,?,?,05885863), ref: 05886682
SysFreeString.OLEAUT32(?), ref: 0588671C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,05885863), ref: 0588674D

Strings

FriendlyName, xrefs: 0588670B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: bdd290b281525eb7dea48cdaefd579bbfb6cfd4e4f4c7764e11cf01bb19fcf79
Instruction ID: 4cfb3ee129f686c46cc86e42fefb7a6d3d56ba7b73125c73093e266a5fb756e5
Opcode Fuzzy Hash: bdd290b281525eb7dea48cdaefd579bbfb6cfd4e4f4c7764e11cf01bb19fcf79
Instruction Fuzzy Hash: DA312F75710205AFDB10DB99DC81EAAB7B9EFC9704F148194F905EB250DBB1ED41CB60

Function 0588F5F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0588F611

Part of subcall function 0588F563: __FF_MSGBANNER.LIBCMT ref: 0588F57C
Part of subcall function 0588F563: __NMSG_WRITE.LIBCMT ref: 0588F583
Part of subcall function 0588F563: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F5A8

std::exception::exception.LIBCMT ref: 0588F646
std::exception::exception.LIBCMT ref: 0588F660
__CxxThrowException@8.LIBCMT ref: 0588F671

Strings

bad allocation, xrefs: 0588F63F

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: 177bcb30f68e19706f6f85410b1e856c78460265dbacec3f013bc988d2ad2c21
Instruction ID: 5d5dfe5623242728e35dd81c7c6619509b4315858bf1f0b5d6c164cd1d91f100
Opcode Fuzzy Hash: 177bcb30f68e19706f6f85410b1e856c78460265dbacec3f013bc988d2ad2c21
Instruction Fuzzy Hash: 06F0F975A0430966FF04FB59D829A7E3ABAFF40654F140004EF11E5190EB709E05CF51

Function 0040BDC1 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040BDC8
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BDF3

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

GetCursorPos.USER32(?), ref: 0040BE34
GetCursorPos.USER32(?), ref: 0040BE44
GetCursorPos.USER32(?), ref: 0040BE4F

Part of subcall function 0040BD45: __EH_prolog3_catch.LIBCMT ref: 0040BD4C
Part of subcall function 0040BD45: __CxxThrowException@8.LIBVCRUNTIME ref: 0040BD65

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Cursor$Exception@8H_prolog3_catchThrow$DispatcherExceptionUser
String ID:
API String ID: 2186074414-0
Opcode ID: 051f3c0c323beada23aad27c6c4bd549df6de3e9425fdc20355bf109c3b9770e
Instruction ID: 7b536314480e95965393dee5022c960bc3ec5933b6f9912406064fe6e91dc01d
Opcode Fuzzy Hash: 051f3c0c323beada23aad27c6c4bd549df6de3e9425fdc20355bf109c3b9770e
Instruction Fuzzy Hash: 00318D72C0030C6ACF22BBB19C45DEFBA7DEF99350F016656F51172052DB3999508AA8

Function 05882D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 05882D5C
CancelIo.KERNEL32(?), ref: 05882D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 05882D6F
closesocket.WS2_32(?), ref: 05882D79
SetEvent.KERNEL32(00000001), ref: 05882D83

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: c404973424fc2d9ff67aeaee8bb5e6091ae0b0a5ea594f3a67726dd0caa4697b
Instruction ID: 7c160c39ff21d9f72542aeecdde0dba25e81efe5e090ee2c9e21b1981c1ff0b4
Opcode Fuzzy Hash: c404973424fc2d9ff67aeaee8bb5e6091ae0b0a5ea594f3a67726dd0caa4697b
Instruction Fuzzy Hash: 7CF03179110704AFD3349F54DD49B667BF8FB49B11F10061DFA9396680DAB0B9048B90

Function 00407875 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 503COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040787C
__CxxThrowException@8.LIBVCRUNTIME ref: 00407A51

Strings

IpDates_info, xrefs: 00407B38, 00407B3D, 00407B70, 00407B97, 00407BCA
SOFTWARE, xrefs: 00407AE6

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow
String ID: IpDates_info$SOFTWARE
API String ID: 1118002619-2243437601
Opcode ID: 874d002dc55d2f8a31b6f6f44f3816a83acad443a15d5fc6b426ee4f48164aa1
Instruction ID: 10e9237137a0567be675d0e40c5e67b37cf8aa5439e9b3662b6fba5421a2e3f4
Opcode Fuzzy Hash: 874d002dc55d2f8a31b6f6f44f3816a83acad443a15d5fc6b426ee4f48164aa1
Instruction Fuzzy Hash: 6CB1D67B9CAA8CAFF120E6C56C6DB72B75CE313A3BF201B33F966D16D0DA5854018154

Function 0040B4AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040B418

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

8080, xrefs: 0040B46A
103.199.100.97, xrefs: 0040B452
5, xrefs: 0040B4DF

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID: 103.199.100.97$5$8080
API String ID: 2513928553-3308959486
Opcode ID: 1c2419a10260abf028730e2b63b76b65c8f5b56ae5cfa0932e6f0868f0440fc4
Instruction ID: 491107047e45d6097c320fcffd7296d0947ab78874c78590a837ce98dcb5e82d
Opcode Fuzzy Hash: 1c2419a10260abf028730e2b63b76b65c8f5b56ae5cfa0932e6f0868f0440fc4
Instruction Fuzzy Hash: 2D11C615C41A1C26D23673614C8DBFE696CDBA7B1BF10222BF891D1261CF2C054799EA

Function 0040788F Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 486COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00407A51

Strings

IpDates_info, xrefs: 00407B38, 00407B3D, 00407B70, 00407B97, 00407BCA
SOFTWARE, xrefs: 00407AE6

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: IpDates_info$SOFTWARE
API String ID: 2005118841-2243437601
Opcode ID: 5b98d0d7d1d6b75b75b1fe1b5808de0115f83000fc6395c6cfb3cfa07b2229d6
Instruction ID: c5bc4179376dd7b189c07d8aa7ddaa88292b5f9c2d1760f246e8fa44e7a49247
Opcode Fuzzy Hash: 5b98d0d7d1d6b75b75b1fe1b5808de0115f83000fc6395c6cfb3cfa07b2229d6
Instruction Fuzzy Hash: 1CA1F6BB989A8CBFF120E6C56C69B72B79CE313A3BF301B33F966D16D0DA5814018154

Function 0040BFE0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040BFEA
__CxxThrowException@8.LIBVCRUNTIME ref: 0040C02D

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040EF6C: char_traits.LIBCPMT ref: 0040EF85

Part of subcall function 0040BEE3: __EH_prolog3_catch.LIBCMT ref: 0040BEEA
Part of subcall function 0040BEE3: __CxxThrowException@8.LIBVCRUNTIME ref: 0040BF3D

Part of subcall function 0040F82D: std::_Deallocate.LIBCONCRT ref: 0040F85D

Part of subcall function 00410A2B: __EH_prolog3.LIBCMT ref: 00410A32

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

Strings

C:\Users\, xrefs: 0040C0E1

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DeallocateException@8Throwstd::_$DispatcherExceptionH_prolog3H_prolog3_catchH_prolog3_catch_Userchar_traits
String ID: C:\Users\
API String ID: 1189702893-773679268
Opcode ID: fa24dc5e13bb1faadbffbb8d8e08a101af343b1da8a32206841914c27c868cfc
Instruction ID: 579beb7774ef81d81f54cc86b884fe02d13e32e5f7928c4170b2804dc7836af2
Opcode Fuzzy Hash: fa24dc5e13bb1faadbffbb8d8e08a101af343b1da8a32206841914c27c868cfc
Instruction Fuzzy Hash: 07512171900128AAD731A7618CD8EFF6E7CEF96754F4041BEF009A1091CF781E86DEA5

Function 00402503 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040250A
__CxxThrowException@8.LIBVCRUNTIME ref: 00402569

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

?, xrefs: 0040255C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID: ?
API String ID: 1841272387-1684325040
Opcode ID: be633443fca854b8a6801f576492c5d81f4b54105de0b2c41f056ad151ac7f69
Instruction ID: af8992980a6b85c46003d11c26060e63a31c8a0de1cd2ad6dff2200a9b5e7270
Opcode Fuzzy Hash: be633443fca854b8a6801f576492c5d81f4b54105de0b2c41f056ad151ac7f69
Instruction Fuzzy Hash: 4D312777989B48AFE320DB859C59F73B7ACE306B36F204B3BF516D2780C76854008690

Function 00407E37 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00407E3E

Part of subcall function 00402503: __EH_prolog3_catch.LIBCMT ref: 0040250A
Part of subcall function 00402503: __CxxThrowException@8.LIBVCRUNTIME ref: 00402569

__CxxThrowException@8.LIBVCRUNTIME ref: 00407EB0

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

,, xrefs: 00407EA8

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow$DispatcherExceptionUser
String ID: ,
API String ID: 1909432332-3772416878
Opcode ID: 1a1d2add909aebd2b6f8ab4aee3e04c869c340dfe42bb6eda9b530e565984e8d
Instruction ID: 68a7cc2c8cc175f887444c34314a3a5935ec1bb89bbdc42fe844f187ed75860a
Opcode Fuzzy Hash: 1a1d2add909aebd2b6f8ab4aee3e04c869c340dfe42bb6eda9b530e565984e8d
Instruction Fuzzy Hash: 04214C77989A4CAFF720EBC59859BB6B7A8E31273BF300B37F855D6290C77844418194

Function 004028D1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004028DB

Part of subcall function 00401337: __EH_prolog3_catch.LIBCMT ref: 0040133E
Part of subcall function 00401337: __CxxThrowException@8.LIBVCRUNTIME ref: 004013A1

__CxxThrowException@8.LIBVCRUNTIME ref: 00402979

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

%, xrefs: 00402963

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$DispatcherExceptionH_prolog3_catchH_prolog3_catch_User
String ID: %
API String ID: 3938975101-2567322570
Opcode ID: b1b3c2fcf86f81c222246e9ca72806171ba81e01a31bb5471524e53a41b72fe3
Instruction ID: c9f0add260b14b006c40b488b30b8be75c4a589c2e11b926704216346cae6e44
Opcode Fuzzy Hash: b1b3c2fcf86f81c222246e9ca72806171ba81e01a31bb5471524e53a41b72fe3
Instruction Fuzzy Hash: AB3159B2844B88AFE320DF858C55BA6F7E8F716726F204B6FE856D27C0C7B855008A45

Function 00403382 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00403389
__CxxThrowException@8.LIBVCRUNTIME ref: 004033EA

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

T, xrefs: 004033DA

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catch_ThrowUser
String ID: T
API String ID: 2496864217-3187964512
Opcode ID: 87d6251b5da49ad2f934743c30d6550920393f05051bcb7d0b3a2ca311411567
Instruction ID: 12613343b11007ba840df2cc38af007157d100582f555deff79d08e98271834c
Opcode Fuzzy Hash: 87d6251b5da49ad2f934743c30d6550920393f05051bcb7d0b3a2ca311411567
Instruction Fuzzy Hash: 0E210877889A8CAFE310EAC59C99BB6B7ACE31663BF200B37E552D22D0C77804018550

Function 0040DB3E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DB45

Strings

Failed to retrieve SMBIOS data., xrefs: 0040DB82
@TD, xrefs: 0040DB87

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: @TD$Failed to retrieve SMBIOS data.
API String ID: 2427045233-3072738943
Opcode ID: 2791b63c62851ca5110f69857475545b464a158cc474895fdd1d1006a71bb654
Instruction ID: 26e134bd895d06ac0eff5e9b2d60050664a9375fc38ee0122e915127dce4fd49
Opcode Fuzzy Hash: 2791b63c62851ca5110f69857475545b464a158cc474895fdd1d1006a71bb654
Instruction Fuzzy Hash: 3731F571A041109ADB10ABF68C45AEFBB38AF55354F10003FF405772C2DEBC5989C6A8

Function 00402009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00402010
__CxxThrowException@8.LIBVCRUNTIME ref: 00402069

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 00401D5A: __EH_prolog3_catch.LIBCMT ref: 00401D61
Part of subcall function 00401D5A: __CxxThrowException@8.LIBVCRUNTIME ref: 00401DBA

Strings

!, xrefs: 0040205C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow$DispatcherExceptionUser
String ID: !
API String ID: 1909432332-2657877971
Opcode ID: f0b57cc09cccfd552b82e856e81fe43e9980225237bade98c31005282472936e
Instruction ID: 17bc1d38ccccf9da31e2b97f15685a9a0674ec7319e75f6fc75b70c0bd949b75
Opcode Fuzzy Hash: f0b57cc09cccfd552b82e856e81fe43e9980225237bade98c31005282472936e
Instruction Fuzzy Hash: 871129B7988648AFE320E7C59C59BB6B7ACE306B3AF304B37F515D63C0D76854018294

Function 0040CCB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040CCBE

Strings

TEMP, xrefs: 0040CCD5
,WD, xrefs: 0040CD52

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: ,WD$TEMP
API String ID: 2427045233-2441283989
Opcode ID: a02e88b0b9070ec293d8bea5835d348d6de8d0262300830da3c741e07e951c4f
Instruction ID: 8a1d809d1ef78157a82ba2e099721d3f64ab7d2ff48e7a80826bf373777e0975
Opcode Fuzzy Hash: a02e88b0b9070ec293d8bea5835d348d6de8d0262300830da3c741e07e951c4f
Instruction Fuzzy Hash: EE21E371500224DBDB249B318C84AEFBA789F19314F10427FF842B61C2DB3C4A86C6AC

Function 0040BB46 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040BB4D
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BB6D

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040BAA0: __EH_prolog3_catch_GS.LIBCMT ref: 0040BAAA
Part of subcall function 0040BAA0: __CxxThrowException@8.LIBVCRUNTIME ref: 0040BB05

Part of subcall function 0040ED81: __EH_prolog3.LIBCMT ref: 0040ED88
Part of subcall function 0040ED81: std::locale::_Init.LIBCPMT ref: 0040EDA4

Part of subcall function 00411257: __EH_prolog3.LIBCMT ref: 00411261

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

Strings

^C:\\[A-Za-z0-9_]+, xrefs: 0040BB83

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3H_prolog3_catch_Throw$DeallocateDispatcherExceptionInitUserstd::_std::locale::_
String ID: ^C:\\[A-Za-z0-9_]+
API String ID: 934996010-2490631579
Opcode ID: b89e39eb0490dcd7d7ce70d72413b2139c062432dbd937802cec89452050380c
Instruction ID: 76440841934ae42911752f9e8910e75b57d9bd6d59572f3fa326fa0c95d1bc6f
Opcode Fuzzy Hash: b89e39eb0490dcd7d7ce70d72413b2139c062432dbd937802cec89452050380c
Instruction Fuzzy Hash: 4C116030E41109EBDB04EB95C892BEDB374EF14304F90806EE111771C2D7B86A49CBA8

Function 00403D6C Relevance: 5.2, APIs: 3, Instructions: 695networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 00403F73

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 17db0f7cee2588996764523463c2b98cc7b4e320836cab16ca05546324b50a4c
Instruction ID: 3420f69c6643b25b588e24b998e6d2c6baab0e9dfe01738a8529c0a17f5b4746
Opcode Fuzzy Hash: 17db0f7cee2588996764523463c2b98cc7b4e320836cab16ca05546324b50a4c
Instruction Fuzzy Hash: ECE1E9B7999A8CBFF220EAC56C69B72B79CE317A7BF200B37F966C17D0D61454018150

Function 05883160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0588316B
InterlockedExchange.KERNEL32(?,00000001), ref: 05883183
GetCurrentThreadId.KERNEL32 ref: 0588322F

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: 42a463b901d826cd9bc78c07d94b5ff22a558c7162191c7c05a2b96b06a150c7
Instruction ID: 1c2bd49267fe883546ee2f8044dac745d99b97b2bef9174ec36ca4944c7e412c
Opcode Fuzzy Hash: 42a463b901d826cd9bc78c07d94b5ff22a558c7162191c7c05a2b96b06a150c7
Instruction Fuzzy Hash: 913136742006069FD728EF69C988A7AB7A5FF44B15B10C92DEC5ACB615DB31FC42CB90

Function 058811B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 058811E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 05881226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05881255

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 236cb0df7a15ea95606ce99af45d05e2167be51be06c4593bec2fd5590c3a3db
Instruction ID: fef2e3fe75d24c2a9090e13477c94de26ec1e66e360905195f7efd52a035a0b3
Opcode Fuzzy Hash: 236cb0df7a15ea95606ce99af45d05e2167be51be06c4593bec2fd5590c3a3db
Instruction Fuzzy Hash: 29217F75B00709ABDB14AFA9D84AB6EFBF4EF40705F008569EC59D2640EB30BC50C744

Function 05881100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0588112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0588115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05881192

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 24be8b7ece68146da563316d21e7cfeb9f766002830924940dee198cb3da59ab
Instruction ID: a213d4275c5ef1d6c33dc2d94b89bc30c7ae89b540a22eb974bf5bfdaff26e0a
Opcode Fuzzy Hash: 24be8b7ece68146da563316d21e7cfeb9f766002830924940dee198cb3da59ab
Instruction Fuzzy Hash: 61117274A10705ABDB10AFA9D886B6EFBF8FF04705F008469ED59D2640EA70A950C750

Function 05889DD0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 05889DF4
GdipDisposeImage.GDIPLUS(?), ref: 05889E08
GdipDisposeImage.GDIPLUS(?), ref: 05889E2B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: d42acf8c949d6876404ff5011557904af78d3a6ca368fd9a6f111bae0abe85f1
Instruction ID: bbf59382056ebc51f8eec316ae7ed1026db1df167b6968fcdfeade1e38d11c57
Opcode Fuzzy Hash: d42acf8c949d6876404ff5011557904af78d3a6ca368fd9a6f111bae0abe85f1
Instruction Fuzzy Hash: 40F0A475A00219A78B20EF98D8448BFBBB8FB45611B00415AFD46F7300DB709E09CBD1

Function 05889AB0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(058AFBA4), ref: 05889ACC
GdiplusStartup.GDIPLUS(058AFBA0,?,?), ref: 05889B05
LeaveCriticalSection.KERNEL32(058AFBA4), ref: 05889B16

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: b667acd012e2e5f4ccf066896680de5ee756f28f5b3a47a370734d43b1d35dae
Instruction ID: 374a3ac8007c1adfc0621e9fb6c8355a2b4f6874c9ab7d5f63a9df01211756f6
Opcode Fuzzy Hash: b667acd012e2e5f4ccf066896680de5ee756f28f5b3a47a370734d43b1d35dae
Instruction Fuzzy Hash: 06F096396412099FFB10AF90E86B7FBBBF8F704305F500199EE05D2240DB761945CB91

Function 0588F854 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0588F859

Part of subcall function 05893CD2: GetLastError.KERNEL32(00000001,00000000,0588F810,0588F5EC,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 05893CD6
Part of subcall function 05893CD2: ___set_flsgetvalue.LIBCMT ref: 05893CE4
Part of subcall function 05893CD2: __calloc_crt.LIBCMT ref: 05893CF8
Part of subcall function 05893CD2: DecodePointer.KERNEL32(00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6), ref: 05893D12
Part of subcall function 05893CD2: GetCurrentThreadId.KERNEL32 ref: 05893D28
Part of subcall function 05893CD2: SetLastError.KERNEL32(00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6), ref: 05893D40

__freeptd.LIBCMT ref: 0588F863

Part of subcall function 05893E94: TlsGetValue.KERNEL32(?,?,05890FE0,00000000,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893EB5
Part of subcall function 05893E94: TlsGetValue.KERNEL32(?,?,05890FE0,00000000,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893EC7
Part of subcall function 05893E94: DecodePointer.KERNEL32(00000000,?,05890FE0,00000000,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893EDD
Part of subcall function 05893E94: __freefls@4.LIBCMT ref: 05893EE8
Part of subcall function 05893E94: TlsSetValue.KERNEL32(00000021,00000000,?,05890FE0,00000000,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893EFA

ExitThread.KERNEL32 ref: 0588F86C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 0476b9d76573518b57458645e33c4a2d900b7647b0228173ad8c02818d1d41c4
Instruction ID: ae90e45ad89d955fa6d72a45269a0599c230d260a9895591416c0bdaa9e7bfee
Opcode Fuzzy Hash: 0476b9d76573518b57458645e33c4a2d900b7647b0228173ad8c02818d1d41c4
Instruction Fuzzy Hash: 6FC04C252047056B9F693776D90E91B7A5D9D802517580424BD16C5450EE68EC51C591

Function 00404459 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001006,00007530,00000004), ref: 004044F8

Strings

0u, xrefs: 0040449A

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID: 0u
API String ID: 3981526788-3203441087
Opcode ID: 2ec25f9e855f01c84e2c1c84fd174d171f9bc3c3dea4bd620a6f1bba0b7cb63e
Instruction ID: 64a7f87d9de9356d5e1512be59539b78a0242b11c1a43f0dc5c3ff17c1536ee9
Opcode Fuzzy Hash: 2ec25f9e855f01c84e2c1c84fd174d171f9bc3c3dea4bd620a6f1bba0b7cb63e
Instruction Fuzzy Hash: D321DBB7989A8CBFF220E6C96C59FB2B79CE317A37F200B33F566D26D0D65454414150

Function 00402525 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00402569

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

?, xrefs: 0040255C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID: ?
API String ID: 2513928553-1684325040
Opcode ID: d0231abb252f7106d999a84c14e1b2eea359a30ac76ad482a171f5f9517c7e1e
Instruction ID: 9962193b77ff82c32004584eb7a5168ce0267ddf037ef70ac147005707e08246
Opcode Fuzzy Hash: d0231abb252f7106d999a84c14e1b2eea359a30ac76ad482a171f5f9517c7e1e
Instruction Fuzzy Hash: D221F8B7988B48AFE220DBC59C59F73BBECE306A32F204B37F516D2790D66854008590

Function 00404462 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001006,00007530,00000004), ref: 004044F8

Strings

0u, xrefs: 0040449A

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID: 0u
API String ID: 3981526788-3203441087
Opcode ID: 57ca7a072de2ed18f1e3ba61e8e1f80e23f743b5dba62e109dd568f5606d826b
Instruction ID: df1abba1ea3ee45a4b30b4b0efb1a0f8eef6a57142bb947dd8c6bfd902225f66
Opcode Fuzzy Hash: 57ca7a072de2ed18f1e3ba61e8e1f80e23f743b5dba62e109dd568f5606d826b
Instruction Fuzzy Hash: 96210AB7988A88BFF220E6C96C69F72779CE306A37F300B33F666D26D0D65854018150

Function 00404541 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?), ref: 0040455B

Strings

^, xrefs: 004045B1

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID: ^
API String ID: 3981526788-1590793086
Opcode ID: 11cd5256ade67e317f33362be2a8db927069440fc6fa32aa94354572500e2a79
Instruction ID: 48cdc7f5c70a7e3abc7cae44bb3e34536eddf169e82be26ccf0a2b487289459a
Opcode Fuzzy Hash: 11cd5256ade67e317f33362be2a8db927069440fc6fa32aa94354572500e2a79
Instruction Fuzzy Hash: F821F5B7988B4CAFF720DAC59C99BB6BBACE306B26F200737E915D62D0D77840418640

Function 0040339A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004033EA

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

T, xrefs: 004033DA

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID: T
API String ID: 2513928553-3187964512
Opcode ID: 65cb8cd847f7b591314e5732bae563f49c534b62ee740015a9a6c406e8a2a20d
Instruction ID: c8534ef946fb98b9fb9741ef752f2d98087b0be08feae6552eed4e090f179c80
Opcode Fuzzy Hash: 65cb8cd847f7b591314e5732bae563f49c534b62ee740015a9a6c406e8a2a20d
Instruction Fuzzy Hash: CE11E9B7889A8CAFE310EAC59C99B7677ACE316A3BF300B37E552D22D0C37804058550

Function 00401658 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004015FC

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Part of subcall function 00401AB9: __EH_prolog3_catch.LIBCMT ref: 00401AC0
Part of subcall function 00401AB9: __CxxThrowException@8.LIBVCRUNTIME ref: 00401B19

Strings

S, xrefs: 0040169C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$H_prolog3_catch$DispatcherExceptionUser
String ID: S
API String ID: 1529331208-543223747
Opcode ID: ca0ed306f8fa36f6d853eeafd4e370bfce1951623856e4dc6e5acd4e27a55a19
Instruction ID: 3398e1a75d19d0947390e72e0f243b3760cb84173d611f923f4ac05ad618cb73
Opcode Fuzzy Hash: ca0ed306f8fa36f6d853eeafd4e370bfce1951623856e4dc6e5acd4e27a55a19
Instruction Fuzzy Hash: F11108B7949648AFE220E6C59C69F76B3ACE306B36F204B37E516D27D0C73854018550

Function 00401668 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004015FC

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Part of subcall function 00401AB9: __EH_prolog3_catch.LIBCMT ref: 00401AC0
Part of subcall function 00401AB9: __CxxThrowException@8.LIBVCRUNTIME ref: 00401B19

Strings

S, xrefs: 0040169C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$H_prolog3_catch$DispatcherExceptionUser
String ID: S
API String ID: 1529331208-543223747
Opcode ID: 5de438ec38938960e911c989a667b8d571a55fda99dde5b6cd31afab71bd85f9
Instruction ID: 811d75084cc2afbc1176e07fa2c92146d0a86461eba8b5b3cd2127f380c1243d
Opcode Fuzzy Hash: 5de438ec38938960e911c989a667b8d571a55fda99dde5b6cd31afab71bd85f9
Instruction Fuzzy Hash: 0B1102B7988A88AFE210E6C69C65F66B3ACE305B36F204B37F516D26D0D63C54018690

Function 00402025 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00402069

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 00401D5A: __EH_prolog3_catch.LIBCMT ref: 00401D61
Part of subcall function 00401D5A: __CxxThrowException@8.LIBVCRUNTIME ref: 00401DBA

Strings

!, xrefs: 0040205C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$DispatcherExceptionH_prolog3_catchUser
String ID: !
API String ID: 4275536761-2657877971
Opcode ID: 383dbd838330131de09e5ce676752096658c0ffd69670b6849b3c1839085ea0a
Instruction ID: 223cb2ed7e661e47eeaff321a66ea6261fbe39dd794d82501610d7a2db39b4ec
Opcode Fuzzy Hash: 383dbd838330131de09e5ce676752096658c0ffd69670b6849b3c1839085ea0a
Instruction Fuzzy Hash: 861148B7988748AFE220E7C59C69F6277ACE306B35F304F37F616D63C0D26854018190

Function 004053F3 Relevance: 3.2, APIs: 2, Instructions: 229timeCOMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00405480

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

timeGetTime.WINMM ref: 004055D4

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowTimeUsertime
String ID:
API String ID: 3406684975-0
Opcode ID: 8bf632c6fc6ab888d7330dbb03045e0a41f7cd4f98b2188270bc014d28ba6444
Instruction ID: 4f5f671991000db5e23d4cbf4c0a50735e15c195ad0698e7cb3a1719dc032d44
Opcode Fuzzy Hash: 8bf632c6fc6ab888d7330dbb03045e0a41f7cd4f98b2188270bc014d28ba6444
Instruction Fuzzy Hash: 6F512D77888B8CAFE320EAC59C59B76B7ACE316B37F200B37E556D22D0C77854418690

Function 00404275 Relevance: 3.2, APIs: 2, Instructions: 216COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001001,00040000,00000004), ref: 00404357
setsockopt.WS2_32(?,0000FFFF,00001002,00040000,00000004), ref: 004043F5

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 960f4ca0e59693487a3a96dbe32bdfff4b2b2cd3dd8f0bf4438264e2b4c5a794
Instruction ID: fddf6e3b4ac1b3c1ff349376bf80a6be98797cddeec1d76f344daa4e2a97487e
Opcode Fuzzy Hash: 960f4ca0e59693487a3a96dbe32bdfff4b2b2cd3dd8f0bf4438264e2b4c5a794
Instruction Fuzzy Hash: 9D41D7B79C9A8CBFF220E6C56C59B72B79CE317A3BF204B33F962D26D0D66454018550

Function 0040427E Relevance: 3.2, APIs: 2, Instructions: 207COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00001001,00040000,00000004), ref: 00404357
setsockopt.WS2_32(?,0000FFFF,00001002,00040000,00000004), ref: 004043F5

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 5814d8cc007d1c83be4714993ac71439f6d860807f9e96dc756286c175bda606
Instruction ID: 6496c5a105f67301ab278f820404743f632b65aa9403c342606c08f9235e8254
Opcode Fuzzy Hash: 5814d8cc007d1c83be4714993ac71439f6d860807f9e96dc756286c175bda606
Instruction Fuzzy Hash: 5641DAB79C9A8C7FF220E6C56C59F72B79CE316A3BF204B33F962D26D0D66454018550

Function 05883360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 05883413
_memmove.LIBCMT ref: 058834A5

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 5a6f0daadccfdc51fa3b4c3b12dad84326209c8819e6cb4363274ebb9f464c2a
Instruction ID: c6864fed878d32a092c64298b3227035c3be205a39021e07fa409a817799b4e5
Opcode Fuzzy Hash: 5a6f0daadccfdc51fa3b4c3b12dad84326209c8819e6cb4363274ebb9f464c2a
Instruction Fuzzy Hash: C751BB72700205AFD711EE69C8C4A7AB7AAFF94A147148A6CED1ADB700DB30FC41CB90

Function 0040155F Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00401566
__CxxThrowException@8.LIBVCRUNTIME ref: 004015FC

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Part of subcall function 00401AB9: __EH_prolog3_catch.LIBCMT ref: 00401AC0
Part of subcall function 00401AB9: __CxxThrowException@8.LIBVCRUNTIME ref: 00401B19

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow$DispatcherExceptionUser
String ID:
API String ID: 1909432332-0
Opcode ID: 5149fa856a0395b8a5a63d2a57ea0a96386f33a18f50b2f8085278bdaff77415
Instruction ID: f34c89d5b8cb1b2927071957f23081b73250a4d6d92962cee6002b194feaf5b2
Opcode Fuzzy Hash: 5149fa856a0395b8a5a63d2a57ea0a96386f33a18f50b2f8085278bdaff77415
Instruction Fuzzy Hash: 9E310CB7989A8CAFE220E6C55C55FB6B7ACE306B36F300B37F516D27D0D72854018190

Function 00401337 Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040133E
__CxxThrowException@8.LIBVCRUNTIME ref: 004013A1

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID:
API String ID: 1841272387-0
Opcode ID: 7bcbc2341318f0be3fc3e479d69a680518d283c9b7ba04cba39951af487da58d
Instruction ID: c7bc97929b2ba8a89c5762af2199561234cf26633e00258494d7f3dece0c91b6
Opcode Fuzzy Hash: 7bcbc2341318f0be3fc3e479d69a680518d283c9b7ba04cba39951af487da58d
Instruction Fuzzy Hash: CE213AB798AA4CAFE320EA855C55BB2F7ACE31373BF305737E515D6390CB2550028550

Function 0040BEE3 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040BEEA
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BF3D

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID:
API String ID: 1841272387-0
Opcode ID: 53ed5e1a12d8fe7e7c38122a07c8297069b615a077add51c106c3663b2c81edd
Instruction ID: 1a0b96cc3a998007a1eb4402417b60683fd925bd8ac75d198e4a7710b51ac139
Opcode Fuzzy Hash: 53ed5e1a12d8fe7e7c38122a07c8297069b615a077add51c106c3663b2c81edd
Instruction Fuzzy Hash: 9131FA70900219AED721AF669C88D7FBEBDEF86764B10042EF404A7250CB785D45DEFA

Function 004027FE Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00402805
__CxxThrowException@8.LIBVCRUNTIME ref: 0040285E

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID:
API String ID: 1841272387-0
Opcode ID: fdfedf63033aee9b8c97155ed098b0020affd4bdfc44d2c16da10399c93aab8f
Instruction ID: 2588b1279e6270a7440988bd04a8a6f54f54ea4613f9d21b63665e2ec0b03905
Opcode Fuzzy Hash: fdfedf63033aee9b8c97155ed098b0020affd4bdfc44d2c16da10399c93aab8f
Instruction Fuzzy Hash: F721387798474CAFE720EBC4D859BB6B7A8E706B3AF304A37E415D63C0D77844418690

Function 05882FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 05883043
recv.WS2_32(?,?,00040000,00000000), ref: 05883064

Part of subcall function 0588F80B: __getptd_noexit.LIBCMT ref: 0588F80B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: b0c712a2a26100d26f5dfa3bf6e686e482efa5cfd9837144bba8aa8e4ea34557
Instruction ID: 7ef9bc4abbbf616b1baab6e43ddff645d4813709a1056bb29af0c705fcb4c02d
Opcode Fuzzy Hash: b0c712a2a26100d26f5dfa3bf6e686e482efa5cfd9837144bba8aa8e4ea34557
Instruction Fuzzy Hash: 6F2181706043189FDF20BF68CC49BB677A4EF04710F140994ED05EB190DAB0AD85CBA2

Function 0040C25B Relevance: 3.1, APIs: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0040C262
__CxxThrowException@8.LIBVCRUNTIME ref: 0040C29F

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DeallocateDispatcherExceptionException@8H_prolog3_catch_ThrowUserstd::_
String ID:
API String ID: 170170546-0
Opcode ID: 5c2cc91d5385ab337b35d654ab0a91e9128b34a27ff32cd322a483362cb4cf85
Instruction ID: 360c8f84779fdead0fc0ad8b389c4da751a175b1c16ff25dcd2ce2adb5e19af8
Opcode Fuzzy Hash: 5c2cc91d5385ab337b35d654ab0a91e9128b34a27ff32cd322a483362cb4cf85
Instruction Fuzzy Hash: 7E111231D40128A6DB21A7B69C89FBF6E38EF86B60F50412FF114760C08F7C5546EEA6

Function 05883260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 05883291
send.WS2_32(?,?,?,00000000), ref: 058832CE

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 7ca8e27eecf8a0e8401a5da1018426036067da864ab42236731c4c9b316c8a24
Instruction ID: 9c8652b905c54d60fdefe1a00ca3ab5675cd093c058bf7e46b5503967d4f2f04
Opcode Fuzzy Hash: 7ca8e27eecf8a0e8401a5da1018426036067da864ab42236731c4c9b316c8a24
Instruction Fuzzy Hash: 14114872B05304B7D720DA2EDC89B6EBB98FB41765F104825FD0DD7280DB70AC418250

Function 058830E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0588310A
timeGetTime.WINMM ref: 05883124

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 7234701df53972d8ad5d21835bb1794bea6104bbe3a993d664636980542a0faf
Instruction ID: 46886982d48c2e314a247132d1e9eb5cfe1ad889a9f60680fa23d4a23ba30477
Opcode Fuzzy Hash: 7234701df53972d8ad5d21835bb1794bea6104bbe3a993d664636980542a0faf
Instruction Fuzzy Hash: A401BC39244206AFD311EF28CCC8B79B7A6FB99B01F144624E90587290CB31BDC6C7D1

Function 0040BD45 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040BD4C
__CxxThrowException@8.LIBVCRUNTIME ref: 0040BD65

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID:
API String ID: 1841272387-0
Opcode ID: 0781529f1884889c8c5f33fe4d4b84b7696d880079f5f7635e13c4264ea732bd
Instruction ID: a7d4cb33f4c24b0cec264d0deaec169705958f490ff2fb92e1fc918a86c985c4
Opcode Fuzzy Hash: 0781529f1884889c8c5f33fe4d4b84b7696d880079f5f7635e13c4264ea732bd
Instruction Fuzzy Hash: 82F09C31D6070E9EDB02DEB4C856B9D7778AF19390F50D31BB004F7181EB7495819B55

Function 0588E370 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0588DE70,00000000,00000000,00000000), ref: 0588E38B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,05891058,?,?,?,?,?,?,058A6188,0000000C,05891100,?), ref: 0588E399

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 643e78817577dc660d4f1ed9a3deeb8225d6c5be52765fda58917c066a148750
Instruction ID: 534bb265604de7aadcfbcadeecba6108d3635f0d09569d44ad7c0d61541dadcd
Opcode Fuzzy Hash: 643e78817577dc660d4f1ed9a3deeb8225d6c5be52765fda58917c066a148750
Instruction Fuzzy Hash: EEE012B0414245BFEF10BB64AC89D363BDCE314310B200211FC25C6290DA74BC80C720

Function 0588F873 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0588F87F

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

Part of subcall function 0588F854: __getptd_noexit.LIBCMT ref: 0588F859
Part of subcall function 0588F854: __freeptd.LIBCMT ref: 0588F863
Part of subcall function 0588F854: ExitThread.KERNEL32 ref: 0588F86C

__XcptFilter.LIBCMT ref: 0588F8A0

Part of subcall function 0589407D: __getptd_noexit.LIBCMT ref: 05894083

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 8c2d57116dd5f9afefbe8c3302532b32e0022e333825c90242f9e2a9195df864
Instruction ID: 33eb6e39909d51dbc25074349ecf49bfcf2d2f2f80ace60b6d419549557b721b
Opcode Fuzzy Hash: 8c2d57116dd5f9afefbe8c3302532b32e0022e333825c90242f9e2a9195df864
Instruction Fuzzy Hash: C7E0ECB1A007009FEF5CFBA4C859E7D7B65EF54705F240088E9019B2B1DB799D45DA22

Function 058962F3 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0589630B

Part of subcall function 05898D4B: __mtinitlocknum.LIBCMT ref: 05898D61
Part of subcall function 05898D4B: __amsg_exit.LIBCMT ref: 05898D6D
Part of subcall function 05898D4B: EnterCriticalSection.KERNEL32(00000000,00000000,?,05893DF6,0000000D,058A6230,00000008,05893EED,00000000,?,05890FE0,00000000,058A6168,00000008,05891045,?), ref: 05898D75

__tzset_nolock.LIBCMT ref: 0589631C

Part of subcall function 05895C12: __lock.LIBCMT ref: 05895C34
Part of subcall function 05895C12: ____lc_codepage_func.LIBCMT ref: 05895C7B
Part of subcall function 05895C12: __getenv_helper_nolock.LIBCMT ref: 05895C9D
Part of subcall function 05895C12: _free.LIBCMT ref: 05895CD4
Part of subcall function 05895C12: _strlen.LIBCMT ref: 05895CDB
Part of subcall function 05895C12: __malloc_crt.LIBCMT ref: 05895CE2
Part of subcall function 05895C12: _strlen.LIBCMT ref: 05895CF8
Part of subcall function 05895C12: _strcpy_s.LIBCMT ref: 05895D06
Part of subcall function 05895C12: __invoke_watson.LIBCMT ref: 05895D1B
Part of subcall function 05895C12: _free.LIBCMT ref: 05895D2A

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 701ab96d12712c2a87cefde1a80281e5a1fd15d6cb7ea5f118217178bd8c0d21
Instruction ID: 279bba8f2ec58f19ad18ba1c9ba676a44e9bc4a79b5de0130f0bbc01f20caf6a
Opcode Fuzzy Hash: 701ab96d12712c2a87cefde1a80281e5a1fd15d6cb7ea5f118217178bd8c0d21
Instruction Fuzzy Hash: 99E0CD30A41311D9EE197BEE550951F7B70FFE1B11F5C0149AC80D50C0DD740D429653

Function 05886EA9 Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,05886E87), ref: 05886EB6
RegCloseKey.ADVAPI32(?), ref: 05886EBF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d1b038988b87d4fcb31c093f9e3bc8af48a5d9af618205fdb370c07b4858a3a6
Instruction ID: d625461c225fe0e879b148be58fa8f7baada91aabe368c82d88bdc729e367383
Opcode Fuzzy Hash: d1b038988b87d4fcb31c093f9e3bc8af48a5d9af618205fdb370c07b4858a3a6
Instruction Fuzzy Hash: A6C09B72D1103857CF10D7A4FC4594D77B85F4C210F1180C2B605B3114C634BD41CF90

Function 00404BAE Relevance: 2.1, APIs: 1, Instructions: 612networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00404F4E
recv.WS2_32(?,?,00040000,00000000), ref: 004050D0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: a421e57506cbe14cc2ce190a7c79759d927c530002768d923d84ebbac425a713
Instruction ID: 49a2f7da404b625249a32cd7692e85dcb67c372cfff0e12a18ccb6021e8313ef
Opcode Fuzzy Hash: a421e57506cbe14cc2ce190a7c79759d927c530002768d923d84ebbac425a713
Instruction Fuzzy Hash: 23D1A6B79C9A8CAFF220E6C56C69B72B79CE313A37F300B33E966D16D0D65854418590

Function 00403D63 Relevance: 1.9, APIs: 1, Instructions: 406networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 00403F73

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 48ce7ec1df7c59ace0878a26501cd4f3d25244ed5dcfc266241acb0cb9df4f51
Instruction ID: 427e4929b13a99d62705b7894d47f5b3cdc59fd0936fd6e5dd61fe008e6691d2
Opcode Fuzzy Hash: 48ce7ec1df7c59ace0878a26501cd4f3d25244ed5dcfc266241acb0cb9df4f51
Instruction Fuzzy Hash: 5091F9B7999A8CBFF220EAD56CA9B72B79CD31397BF200B37F966C1690D61854018160

Function 004045C5 Relevance: 1.8, APIs: 1, Instructions: 291networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00404777

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 3c0bdefa0330a23e1166972c187c32c30933b685273871fa4e9b9be3cdf0bae3
Instruction ID: e2932c03992df029e037be51ae7facf8480625bf4253c7ee6efa6d5978ea715b
Opcode Fuzzy Hash: 3c0bdefa0330a23e1166972c187c32c30933b685273871fa4e9b9be3cdf0bae3
Instruction Fuzzy Hash: F351D8B7989A8CBFF220EAC56C69F72B79CE317A37F200B33F966D16D0D65854018190

Function 004045CE Relevance: 1.8, APIs: 1, Instructions: 282networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00404777

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Ioctl
String ID:
API String ID: 3041054344-0
Opcode ID: 4d15bafa83d224e3b7d2a10e2fab81b21094e2ecd3aa14761efadf4994bd7db0
Instruction ID: 9526a585e8d6de3bbfc57107f87e5eb456f107fa1e0619f39ed654d06b90629f
Opcode Fuzzy Hash: 4d15bafa83d224e3b7d2a10e2fab81b21094e2ecd3aa14761efadf4994bd7db0
Instruction Fuzzy Hash: 7551C7B7989A8CBFF220EAC56C69F72B79CE317A37F200B33F966D16D0D65854018190

Function 004F15BF Relevance: 1.7, APIs: 1, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(004F16B7,?,00000004,00000040,?,?,004F1595), ref: 004F1602

Memory Dump Source

Source File: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b3e2e26e12dc87767a2c570f88c579fbcfd8a53e7a448634394f5ea87b438120
Instruction ID: 68ff67f9d07e77c6e6d61c8f1a88245ce5a92f72ba2f4a6eb926ff465044159e
Opcode Fuzzy Hash: b3e2e26e12dc87767a2c570f88c579fbcfd8a53e7a448634394f5ea87b438120
Instruction Fuzzy Hash: C141283250C208EBDB10FF11C9425BA77E6AF84704F58081BE7869B231D738A912DB8F

Function 00401577 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004015FC

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Part of subcall function 00401AB9: __EH_prolog3_catch.LIBCMT ref: 00401AC0
Part of subcall function 00401AB9: __CxxThrowException@8.LIBVCRUNTIME ref: 00401B19

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$H_prolog3_catch$DispatcherExceptionUser
String ID:
API String ID: 1529331208-0
Opcode ID: 81b3664c51658b730b172021a82d2e60659d506f757bcbb0ba70a12c2d6abe31
Instruction ID: 0aeeca30e4b6b72a5ef697a379779fba4e5f551919b5e7e175dc64f926755ad4
Opcode Fuzzy Hash: 81b3664c51658b730b172021a82d2e60659d506f757bcbb0ba70a12c2d6abe31
Instruction Fuzzy Hash: F621FBB7988A88AFE220E6C59C65F76B7ACE306A36F300B37F516D27D0D76854018190

Function 00401355 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004013A1

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID:
API String ID: 2513928553-0
Opcode ID: ae8b8033c6243a9f075311f3abe85c467a7e4e60954b04cddbc19af5d2001eb4
Instruction ID: 1f57a336439bd719dfdd525a7a61ee89b15920b2056cef97b8e63d903bfd20b4
Opcode Fuzzy Hash: ae8b8033c6243a9f075311f3abe85c467a7e4e60954b04cddbc19af5d2001eb4
Instruction Fuzzy Hash: BB1129B798AA4CAFE320DAC59C59BB2F7ACE317637F308B37E415D2690C72950028590

Function 00403B79 Relevance: 1.6, APIs: 1, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00403BC0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 16a13caeafb7fa22cc3ca8b3dc351e3565d63a82df92d44b7bded52b7ad5ebd5
Instruction ID: 7db0104d75c140099f8443ccc315c25807cdd804811e74faee2cd90b5ee88d59
Opcode Fuzzy Hash: 16a13caeafb7fa22cc3ca8b3dc351e3565d63a82df92d44b7bded52b7ad5ebd5
Instruction Fuzzy Hash: B91108B79C9A88BFF130EAC56C69B72B79CE302A37F200B37F912D27D0D65554018150

Function 00401BD3 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00401C3C

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow__floor_pentium4
String ID:
API String ID: 2457699348-0
Opcode ID: 224c9e45b2d27edf53adf674c219c934f7631aab86358383652982ed0df9a724
Instruction ID: 38359e74e22959d586143c1e7d248b865d989df890bb6bea26221316be0be554
Opcode Fuzzy Hash: 224c9e45b2d27edf53adf674c219c934f7631aab86358383652982ed0df9a724
Instruction Fuzzy Hash: 10214C71540B08AFE310EF65DC45BA9BBF8EB09765F10862BF446F7290DB3494808618

Function 0040281A Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040285E

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8ThrowUser
String ID:
API String ID: 2513928553-0
Opcode ID: 2ea6a3bffdddacc6e6226561113e71871c3eee23053dee7462be0febc3fe56aa
Instruction ID: 44b206e5b7eb95d1573f759f48dccc0809119720aaeac39973624ef8493f10cc
Opcode Fuzzy Hash: 2ea6a3bffdddacc6e6226561113e71871c3eee23053dee7462be0febc3fe56aa
Instruction Fuzzy Hash: AF110477988748AFE720EBD4D869B66BBA8E706B36F304A37E516D63C0D37844418690

Function 00401E7D Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00401EDD

Part of subcall function 00401891: __EH_prolog3_catch.LIBCMT ref: 00401898
Part of subcall function 00401891: __CxxThrowException@8.LIBVCRUNTIME ref: 004018F1

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow__floor_pentium4
String ID:
API String ID: 2457699348-0
Opcode ID: bfab972bb9b0181d7663b6d2c90f6b33c4a1280d9968e217cdae45112fbdc5b7
Instruction ID: a083d6634491f3e3ffd0fe8e7a64a01b5e9820adfea1e857aab7a14686004dc0
Opcode Fuzzy Hash: bfab972bb9b0181d7663b6d2c90f6b33c4a1280d9968e217cdae45112fbdc5b7
Instruction Fuzzy Hash: E0212C72900A089FD711EF65DC95B59BBB4FB09771F14863BF909FB291E73884808B98

Function 00403B82 Relevance: 1.6, APIs: 1, Instructions: 75networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00403BC0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: f2a024eb85a8589b0dfd7f5124df27c2e617e7ec4347d23f3156247cc61842ca
Instruction ID: 156df80eaa3a9cd1b6b290dd6e74887305d72ac7276ae3ad8e17c4dd1474cb22
Opcode Fuzzy Hash: f2a024eb85a8589b0dfd7f5124df27c2e617e7ec4347d23f3156247cc61842ca
Instruction Fuzzy Hash: 8A11D6B7988B88AFF220EAC56C69B327B9CE306A76F200B37F516D67D0D65844018150

Function 00401BDC Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00401C3C

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow__floor_pentium4
String ID:
API String ID: 2457699348-0
Opcode ID: d6c84756b6fbf601fb854442ebb8dc9809b7fe42b47e4487d8e3755c681d21b5
Instruction ID: 6859fc5f457ba43b8b4e1f91fbe173df23dca8f024f8f5674980d8ffa8ed19cd
Opcode Fuzzy Hash: d6c84756b6fbf601fb854442ebb8dc9809b7fe42b47e4487d8e3755c681d21b5
Instruction Fuzzy Hash: 22213871500B08AFE311EF65DC51B69BBF8EB08B65F10852BF546F7290D73898808A18

Function 004060CA Relevance: 1.6, APIs: 1, Instructions: 51networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 00406119

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 9a607c971fbc1b9a05e80e4d710e7cdf936215a65a5d72d3e31cae9591534659
Instruction ID: 391f9e5f477f5b69a7be163d07de6ff7d235d26d8a1a80c6c48969dbd6ec0880
Opcode Fuzzy Hash: 9a607c971fbc1b9a05e80e4d710e7cdf936215a65a5d72d3e31cae9591534659
Instruction Fuzzy Hash: 77F0F677984A48AFE720ABD99C59BB6BB68E306632F100B33F512E62A0C72584008754

Function 004060D3 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 00406119

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2342ff3d89ade561285c3f9dfb7c381d1b663c0d5d62ce1f8a962841aa085b53
Instruction ID: 82b08bf2852a893624ee8714b3a20becac123d8e96897c75e4b48596348d49ec
Opcode Fuzzy Hash: 2342ff3d89ade561285c3f9dfb7c381d1b663c0d5d62ce1f8a962841aa085b53
Instruction Fuzzy Hash: D3F02473984A48AFE710DBD89C15B6A7BA8F309731F204A33F612E62A0C32984108794

Function 0588AD7B Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32 ref: 0588AD90

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ExchangeInterlocked
String ID:
API String ID: 367298776-0
Opcode ID: 05224ecbe9818dcf94952b7fae004db61953893bac615721e638167601b7145c
Instruction ID: 34a0f9320645e879d556a0dad2f8803ec178f31dfa8b0b9aaa2a86e0ac620c1e
Opcode Fuzzy Hash: 05224ecbe9818dcf94952b7fae004db61953893bac615721e638167601b7145c
Instruction Fuzzy Hash: FAF089363083864FC711DE64E895A69FB54FF86221F4486EBEA448B182C6319C59D7E1

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,E826D012), ref: 00401020

Part of subcall function 0041871B: __onexit.LIBCMT ref: 00418721

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Startup__onexit
String ID:
API String ID: 1034835647-0
Opcode ID: b962cd1775d17826f4094ac5bba1205115c106db0ab0e2a3d2044d5428ae31b3
Instruction ID: ad6f5502b40e12d28c2601b8d06bf468c4c147878f5bab7edd95b4fb12a4dd2d
Opcode Fuzzy Hash: b962cd1775d17826f4094ac5bba1205115c106db0ab0e2a3d2044d5428ae31b3
Instruction Fuzzy Hash: 19E0617160474047D314A73AAC53BB6B7D89F89305F40497FE99AC70D1DF3455068A4B

Function 004F1630 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(004F16B7,?,00000004,00000040,?,?,004F1595), ref: 004F1602

Memory Dump Source

Source File: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7dd796084cc0716593e56c66aca0a8b2eb5ccede691efad210a75bb77fff29c0
Instruction ID: a9b7c8aeff95e80a3fd5a39cede63f3f7132a03c169b755d0948bd8735fc96b6
Opcode Fuzzy Hash: 7dd796084cc0716593e56c66aca0a8b2eb5ccede691efad210a75bb77fff29c0
Instruction Fuzzy Hash: 7CD05E70504209D79A20FB7099531AE33A65E8470CF54481EEA9893121DB28AA2A4AAB

Function 024028BF Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B39C,000000FF,00000007,00000000,00000004,00000000,?,?,?,0244B0AE,00000065,00000000,?,0244A643,FFFFFFE0,00000000), ref: 024028D9

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0c8d8a839ae5cab81025d682d6d5e8e18988fa8771bb9019b0ad9e76903669f1
Instruction ID: 566ce3e0263a86db5437ec948299dbae86295702f6de5559af0704fc3b273ddc
Opcode Fuzzy Hash: 0c8d8a839ae5cab81025d682d6d5e8e18988fa8771bb9019b0ad9e76903669f1
Instruction Fuzzy Hash: BCB09B729018C5D9DE15E760460C7177A0067D0701F76C162D1030659A4778C1D5F375

Function 02402845 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(023C1044,?,00000009,00000018,00000000,?,?), ref: 0240284F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a71e7081c76ecea2634b383d37da205dec0b05006cc2aab41f4ac2f785934223
Instruction ID: dcb199de52116b1cba56a78b0317bf21098c0fdefd7e90470ebb778446e5a7d2
Opcode Fuzzy Hash: a71e7081c76ecea2634b383d37da205dec0b05006cc2aab41f4ac2f785934223
Instruction Fuzzy Hash: 52900231201804D2D50072588404B4A410597E0301FB6C015A0514658DC95589617161

Function 02403945 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0243C931,?,00020019,?,00000000,?,?,76E91B54,76E85DD8,76E91AB0,00000000,?,0000020A,?,?,00000000), ref: 0240394F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a85b341f0fc1f59f4692e111faf1b471c986634ed5bcee361d653d18a0b1ef7d
Instruction ID: a7eb46da7fb45dbc78358d5416c891934bac48ddb4ee52765059e23198b027d7
Opcode Fuzzy Hash: a85b341f0fc1f59f4692e111faf1b471c986634ed5bcee361d653d18a0b1ef7d
Instruction Fuzzy Hash: 2590023120180492D90171589804647000587D4301FB6D511A052455CECA54896171A1

Function 02402D45 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244397F,00000000,?,00000000,00000004,00004000,00000004,00000000,00000000,00000004,?,00000004,76FA5D80,00000000,00000000,?), ref: 02402D4F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e3fb03b96d9fc1abf01bfd89bb3a5a2b5f13ad449933a34650d3808e96cd021a
Instruction ID: 1d37e05ba6ef58002bdccb02757db2f2c5e30ecbb05cfe990c76d29b6f4bde6d
Opcode Fuzzy Hash: e3fb03b96d9fc1abf01bfd89bb3a5a2b5f13ad449933a34650d3808e96cd021a
Instruction Fuzzy Hash: 3590023124180892D5407158C4147070006C7D0601FB6C011A0124558DCA168A6576F1

Function 02402955 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(023E364E,000000FA,00000001,?,00000050,?,00000000), ref: 0240295F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1aa760f0423e8c16879561bfc721d428e02946f17030f1d3d397e97d8c416353
Instruction ID: 44aaf8fb4bacf8727daf9a5c8ac0f724ad8c527ba2b932c8cd2d9832c68326ff
Opcode Fuzzy Hash: 1aa760f0423e8c16879561bfc721d428e02946f17030f1d3d397e97d8c416353
Instruction Fuzzy Hash: 7B90023120180492D50075989408646000587E0301FB6D011A5124559ECA6589917171

Function 02402A65 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0241BF13,?,00000000,00000000,?,00000220,?,?,?,00000001,?,76E87EAC,?,?,00000002,?), ref: 02402A6F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 278828995a27b8956cc06e1055ee92603db052533a6763caa458df4a24c26c24
Instruction ID: 65c57d2d79997967c621c0cfa28fb185a7a6604d0be66ab69f75c34d33d808f9
Opcode Fuzzy Hash: 278828995a27b8956cc06e1055ee92603db052533a6763caa458df4a24c26c24
Instruction Fuzzy Hash: 9C90023124180492D54171588404606000997D0241FF6C012A0524558ECA558B56BAA1

Function 02402C65 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02400298,?,00000000,00000001,00000000,00000000,00000000,?,?,?,?,00000000), ref: 02402C6F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9c108ca8da4b7945a0a9952683abbeebe51abec1548ac5c3ebd004b90cba5b90
Instruction ID: f1fbd36493b9b43dd1b27881c55b4b890ae4995d64617fcdfce7fc223b740b08
Opcode Fuzzy Hash: 9c108ca8da4b7945a0a9952683abbeebe51abec1548ac5c3ebd004b90cba5b90
Instruction Fuzzy Hash: CA900231601800D245407168C8449064005ABE12117B6C121A0A98554DC959896566A5

Function 02402A75 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(023F3C1A,?,?,?,00000021,00100020,?), ref: 02402A7F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e1831f3b80571ff245ffa1ac3cea228793df76da1466f4aa8b8e933eac318279
Instruction ID: d94a385240ea5cc5cb523d8d4d9802149a19af9c33e221ce7300a4ada19dde67
Opcode Fuzzy Hash: e1831f3b80571ff245ffa1ac3cea228793df76da1466f4aa8b8e933eac318279
Instruction Fuzzy Hash: B390023160580492D54171588454706001987D0241FF6C012A0124558DCA558B56B6E1

Function 02402815 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B210,00000004,00000004,000F0007,C0000001,?,00000004,08000000,00000000,00000065,00000000,00000000,00000058), ref: 0240281F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dd1357673929edd627d5002cf9b22b1c21bc2a403287383c9e2e20cba39850d4
Instruction ID: a7c3278bab233e358864312cb0a9fac2fa44294094936769d81f40b09dbb6f4b
Opcode Fuzzy Hash: dd1357673929edd627d5002cf9b22b1c21bc2a403287383c9e2e20cba39850d4
Instruction Fuzzy Hash: AA90027120280093450571588414616400A87E0201BB6C021E1114594DC92589917165

Function 02402B15 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(023F2FD7,?,?,?,?), ref: 02402B1F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 11d94716a0a9a50aea8195846aaae944c1793c340b99bc1e967f78cb2f04d93e
Instruction ID: 9dc4532990c3311a998ece6e45485afd5e8534d6e25cb276fd3244faad9b1279
Opcode Fuzzy Hash: 11d94716a0a9a50aea8195846aaae944c1793c340b99bc1e967f78cb2f04d93e
Instruction Fuzzy Hash: 7890027120180092D54171589404706400997E0241FF6C013A0614558CC9158A56A261

Function 02402915 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02433C2F,?,00000009,00000018,00000000,00000000,00000000,00000000), ref: 0240291F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9c74aefc6d850f881e4025fd3ffb9272c4f9300d69bd7779120de17ec40eed9
Instruction ID: d93bdadf144966689d6c613757223a2a96fe6a0621c1ea02d9638c1ec833a575
Opcode Fuzzy Hash: e9c74aefc6d850f881e4025fd3ffb9272c4f9300d69bd7779120de17ec40eed9
Instruction Fuzzy Hash: E1900231201808D2D50071588404B46000587E0301FB6C016A0224658DCA15C9517561

Function 02402925 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B240,000000FF,0000001C,0000000C,00008000,00000000,00000000,?,0244B084,000000FF,00000000,00000000,0000000C,00001000,00000004,76F8D260), ref: 0240292F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe7a695d54c47184f6869f139371b110fb42ca037c2ef3b0bac4e3626bfa7998
Instruction ID: 5e4434a41b56dcab8794d83cf17c84d42851e9d31ee7a6c4386824e225b1f118
Opcode Fuzzy Hash: fe7a695d54c47184f6869f139371b110fb42ca037c2ef3b0bac4e3626bfa7998
Instruction Fuzzy Hash: 8C90023120188892D5107158C40474A000587D0301FBAC411A452465CDCA9589917161

Function 024029C5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B1BD,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000004,00000004,000F0007,C0000001,?,00000004), ref: 024029CF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 32a9f807de822e85ff040538f7fbc2df4ab8354551751fba201e08b8ecb80970
Instruction ID: eb73a56ec62a6490eeec47b7d36abee0e6eedca61927941d4eca6f1ef06fa251
Opcode Fuzzy Hash: 32a9f807de822e85ff040538f7fbc2df4ab8354551751fba201e08b8ecb80970
Instruction Fuzzy Hash: 0590023921380092D5807158940860A000587D1202FF6D415A011555CCCD1589696361

Function 02402BE5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B19B,00000004,000F0007,C0000001,?,00000004,08000000,00000000,00000065,00000000,00000000,00000058), ref: 02402BEF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4779a73a3e63ccb235c346d7bbb9e1cc29c307b5cf0947d03509edc91a6023ee
Instruction ID: 03b4f8b3da908c51694e4ca40a92fff84c967a19f802b24f1fc847529ea20f25
Opcode Fuzzy Hash: 4779a73a3e63ccb235c346d7bbb9e1cc29c307b5cf0947d03509edc91a6023ee
Instruction Fuzzy Hash: DF900271341804D2D50071588414B060005C7E1301FB6C015E1164558DCA19CD527166

Function 024029E5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B1FF,000000FF,00000000,00000004,000F0007,C0000001,?,00000004,08000000,00000000,00000065,00000000,00000000,00000058), ref: 024029EF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03eec2dd048b8e4f33d0e121f1ee76f423578e65da4fa5125804e2d58986a6b7
Instruction ID: 3045aac6dd4cd7cc4da64803de65df99600675759a62d445acbb8ebda6492752
Opcode Fuzzy Hash: 03eec2dd048b8e4f33d0e121f1ee76f423578e65da4fa5125804e2d58986a6b7
Instruction Fuzzy Hash: DD90023130180093D540715894186064005D7E1301FB6D011E0514558CDD1589566262

Function 024027F5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0241F92D,000000FE,00000005,?,00000004,000000FE,00000000,00000001), ref: 024027FF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89dbe6fee2a7d5bde55e6a9cebc87a549e6907b4d2d9fa4ed4478543ed452b88
Instruction ID: fd162d09187195704d1a5487c24e7ee05acbcbafa838542260557f549b872b82
Opcode Fuzzy Hash: 89dbe6fee2a7d5bde55e6a9cebc87a549e6907b4d2d9fa4ed4478543ed452b88
Instruction Fuzzy Hash: 9490023120180492D50071988404706000587D0201FB6C412E062455CDCA5589517571

Function 02402A85 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02418E58,00000000,76FA4F4C), ref: 02402A8F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3311cdc1437dc7d57fc21bf6541892f70bad979a9ac821505f141b48a28c8ae1
Instruction ID: ba355d8e859d6816615315c8d49fa765a9c66f78f412bfb7516d1d93b4bf5fbd
Opcode Fuzzy Hash: 3311cdc1437dc7d57fc21bf6541892f70bad979a9ac821505f141b48a28c8ae1
Instruction Fuzzy Hash: 10900231242841E25945B1588404507400697E02417F6C012A1514954CC9269956E661

Function 02402795 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0249A13E,00000000,00000000,00000000,00000000,?,0022096C,00000000,00000000,00000004,00000010,?,00000000), ref: 0240279F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6c81ed84ab1970866dfb33400d242b6450455a1d59324ce333c241328bb42825
Instruction ID: d4655b01347a1290ce35513ebc35721995a3efd51dd371ff95b07b64c68107f8
Opcode Fuzzy Hash: 6c81ed84ab1970866dfb33400d242b6450455a1d59324ce333c241328bb42825
Instruction Fuzzy Hash: 50900235612844D20541B1588504947000587D82493B6C011F0155598CDB259965A261

Function 02402895 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02419997,?,?,00000002,00000000,?,?,?,76E25D78,?,?,?,?,?,80000005), ref: 0240289F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e69b0853e0ba7a260a24ea3c5eaf87fd1f83b4988f561c55acdc85df74fd7234
Instruction ID: bafe1a318a29b9fef6596f84c02798d614c7910f3764ff90cfc555ff2a01a69e
Opcode Fuzzy Hash: e69b0853e0ba7a260a24ea3c5eaf87fd1f83b4988f561c55acdc85df74fd7234
Instruction Fuzzy Hash: 6E900231205848D2D54071588404A46001587D0305FB6C011A0164698DDA258E55B6A1

Function 02402C95 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02499FB9,?,00100080,00000018,?,00000000,00000000,00000007,00000001,00000020,00000000,00000000,76EA5A68,00000000,?,?), ref: 02402C9F

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8ac549f2867562ec1500e0e04f390b73ac4eeec54055744d4b505ee26b047c0a
Instruction ID: 52ea3a1bfe49ca4497603a7c7aeba830978ab11dc6f7cd3ffbc77b97a477a51e
Opcode Fuzzy Hash: 8ac549f2867562ec1500e0e04f390b73ac4eeec54055744d4b505ee26b047c0a
Instruction Fuzzy Hash: 93900231211C00D2D60075688C14B07000587D0303FB6C115A0254558CCD1589616561

Function 024034A5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(02450BC8,?,?,?,?), ref: 024034AF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b229049292478d3ae635913977713cc3679d8945ac67d47234f80e5a5c8df1e4
Instruction ID: b1544ed245800e6e1e5c382c5c2fefaeea95f39a98dd5ee044b975a72eed7e04
Opcode Fuzzy Hash: b229049292478d3ae635913977713cc3679d8945ac67d47234f80e5a5c8df1e4
Instruction Fuzzy Hash: 5B90023120180493D540719885046078005A7F0201FB6C012A0515558CD95689556271

Function 02402AA5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244AD10,00000073,?,00000008,00000000,000000FF,00000004), ref: 02402AAF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b07e20b1e1f62226c95c3b95021e95314ccf6a60d1538666fc4c27f6eedf0abb
Instruction ID: e0cfee59f3bd629d696d9df025a24d049228ab1f5450e19fda68cd4384c52875
Opcode Fuzzy Hash: b07e20b1e1f62226c95c3b95021e95314ccf6a60d1538666fc4c27f6eedf0abb
Instruction Fuzzy Hash: 41900231201804A3D51171588504707000987D0241FF6C412A052455CDDA568A52B161

Function 024028A5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0244B012,000000FF,00000000,00000000,0000000C,00001000,00000004,76F8D260,0000001C,0244AD6B), ref: 024028AF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 99d95164daa121e4aa1da014ad54696e11d4a89c828f981c5379f8b395cffda3
Instruction ID: f493f41ee4575846753655f81b4abaab26142dd9efb5aad95f225d96354de1fb
Opcode Fuzzy Hash: 99d95164daa121e4aa1da014ad54696e11d4a89c828f981c5379f8b395cffda3
Instruction Fuzzy Hash: 7290023120180892D5807158840464A000587D1301FF6C015A0125658DCE158B5977E1

Function 024029B5 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(023F6F44,?,?,?,00000008,0000001E), ref: 024029BF

Memory Dump Source

Source File: 00000000.00000002.4458408865.0000000002390000.00000040.00000020.00020000.00000000.sdmp, Offset: 02390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2390000_Wk6IMAhBNF.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 42339184a28783423944fc9ac82ea6ac916fb52e1ea481eb8e768c14776ee7f9
Instruction ID: 67d7d67ac5255d78cda0559fcb6871c985b3fca63008080f8ea36a83b41ef028
Opcode Fuzzy Hash: 42339184a28783423944fc9ac82ea6ac916fb52e1ea481eb8e768c14776ee7f9
Instruction Fuzzy Hash: 5D900231205844D2D50075589408A06000587D0205FB6D011A1164599DCA358951B171

Function 0226F9DF Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7efa3e78e8e3d2378db4a0b53af39530989666be69a648821daeaf1719bf47a
Instruction ID: 317d1d60e3700707c6a44b6a7b76a62342425d9a54777d5ecfe259181db8e187
Opcode Fuzzy Hash: e7efa3e78e8e3d2378db4a0b53af39530989666be69a648821daeaf1719bf47a
Instruction Fuzzy Hash: 5EC1E072D20219ABDF00DFD4EA88BEDBBB6FB08319F244515E412B7684C774A995CF14

Function 0226D06B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4080447c99b4bfb018b9855abd1eb7e7efdbdcb1cb35f0d01b2dc8d657015916
Instruction ID: 8e93edcd5d12c689ba28627672607868ce49681f4fdde1018e30d29e9f974557
Opcode Fuzzy Hash: 4080447c99b4bfb018b9855abd1eb7e7efdbdcb1cb35f0d01b2dc8d657015916
Instruction Fuzzy Hash: 1B513776A102299FDB11CF98D888BAEBBF4FF49714F1442A5E911AB394D3709C41CBA0

Function 0226C87F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4394787213c935cc2ee6b5851fc38c1c6f876b7f7ed576cfd4406f54cbd4534f
Instruction ID: ab2b647fcd5eb4ab6b339e18cb52ec68314a7f5e65014481b1468e4ec2fd2032
Opcode Fuzzy Hash: 4394787213c935cc2ee6b5851fc38c1c6f876b7f7ed576cfd4406f54cbd4534f
Instruction Fuzzy Hash: 0B416CB1E11219AFDB10DFD5C948BEFBBB9EF48354F10405AEA15E7284D770AA40CBA4

Function 0226FD21 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0be92c03cdaef17c838e2f9bbabb6427108cd72bff778f61f7997dbb892111
Instruction ID: dfd8188118abf245d2532e7d93af6c000d81e1cae59ac76f28005a7920c7b44a
Opcode Fuzzy Hash: dc0be92c03cdaef17c838e2f9bbabb6427108cd72bff778f61f7997dbb892111
Instruction Fuzzy Hash: 0211D372C24249DBEF618FE4EA4C7ECBBB5AB0031AF204129F122A5598C7B465D8DF11

Function 0226C7EF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3708fbe2b88b8c939ed4b2c8f61042722b7326e504c06cfe0ef6137487a98a98
Instruction ID: 4bc609204e8fef87c917ccb2dfbd0c94909ea613b73f15684c55a09b3464f909
Opcode Fuzzy Hash: 3708fbe2b88b8c939ed4b2c8f61042722b7326e504c06cfe0ef6137487a98a98
Instruction Fuzzy Hash: D7D06CB744024DBBCF029E85EC05EDA3F2AEB59370F158601BE38451A1C776D9B1ABA1

Function 022A551F Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b634d79532ed85754f9aa903670903a8a00b20c82c2e9a5ae80919a805a00cc9
Instruction ID: cbe3ac6ecafe2399b55931cb87b1af9d6c2ba799a96b4efa2543abb8a940f594
Opcode Fuzzy Hash: b634d79532ed85754f9aa903670903a8a00b20c82c2e9a5ae80919a805a00cc9
Instruction Fuzzy Hash: 4FC01272110208BB8B00EEA48C04CBB779EEBC8210B008404B9188B100C930E860DAA0

Non-executed Functions

Function 0588E740 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 311stringfilesynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588E799
Sleep.KERNEL32(00000001,?,?,?,0588601C), ref: 0588E7A3
GetTickCount.KERNEL32 ref: 0588E7AF
GetTickCount.KERNEL32 ref: 0588E7C2
InterlockedExchange.KERNEL32(058B1F48,00000000), ref: 0588E7CA
OpenClipboard.USER32(00000000), ref: 0588E7D2
GetClipboardData.USER32(0000000D), ref: 0588E7DA
GlobalSize.KERNEL32(00000000), ref: 0588E7EB
GlobalLock.KERNEL32(00000000), ref: 0588E7FC
wsprintfW.USER32 ref: 0588E875
_memset.LIBCMT ref: 0588E893
GlobalUnlock.KERNEL32(00000000), ref: 0588E89C
CloseClipboard.USER32 ref: 0588E8A2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0588E8BA
CreateFileW.KERNEL32(058B0DC0,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0588E8D4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0588E8F2
lstrlenW.KERNEL32(058A5A38,?,00000000), ref: 0588E906
WriteFile.KERNEL32(00000000,058A5A38,00000000), ref: 0588E915
CloseHandle.KERNEL32(00000000), ref: 0588E91C
ReleaseMutex.KERNEL32(?), ref: 0588E928
GetKeyState.USER32(00000014), ref: 0588E9AC
lstrlenW.KERNEL32(058AB4A8), ref: 0588E9FB
wsprintfW.USER32 ref: 0588EA0D
lstrlenW.KERNEL32(058AB4D0), ref: 0588EA2E
lstrlenW.KERNEL32(058AB4D0), ref: 0588EA51
wsprintfW.USER32 ref: 0588EA6F
wsprintfW.USER32 ref: 0588EA85
wsprintfW.USER32 ref: 0588EAAF
lstrlenW.KERNEL32(00000000), ref: 0588EAFB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0588EB11
CreateFileW.KERNEL32(058B0DC0,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0588EB2B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0588EB49
lstrlenW.KERNEL32(00000000,?,00000000), ref: 0588EB59
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0588EB64
CloseHandle.KERNEL32(00000000), ref: 0588EB6B
ReleaseMutex.KERNEL32(?), ref: 0588EB78

Strings

%s%s, xrefs: 0588EA7F
[esc], xrefs: 0588EA3E, 0588EA67, 0588EA7D, 0588EAA7
%s%s, xrefs: 0588EAA9
[, xrefs: 0588E86F
%s%s, xrefs: 0588EA07, 0588EA69

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Filelstrlen$wsprintf$ClipboardCloseGlobal$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWrite_memset$DataExchangeInterlockedLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$[esc]
API String ID: 1637302245-2373594894
Opcode ID: e226080793eea109c4a6cd7efa600fd54333005731b0f642841ef8fb17158c30
Instruction ID: 9d639dc0d7e7e2e23a732b8704ecf4323fa9b9dfb3efb56b1894dd8fd6ec93f7
Opcode Fuzzy Hash: e226080793eea109c4a6cd7efa600fd54333005731b0f642841ef8fb17158c30
Instruction Fuzzy Hash: 5CC1A474650301AFFB34EF64DC4ABAA7BE8FB04705F004559FE5AD6280DBB4A984CB61

Function 058877D0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 058877F4
_memset.LIBCMT ref: 05887840
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 05887854

Part of subcall function 05888710: _vswprintf_s.LIBCMT ref: 05888721

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,75920630,?,75920F00), ref: 05887883
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 058878CA

Part of subcall function 05887730: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,058878EC), ref: 05887746
Part of subcall function 05887730: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,058878EC,?,?,?,?,?,?,75920630), ref: 0588774D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 058878FA
_memset.LIBCMT ref: 05887913
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 0588792B
GetProcAddress.KERNEL32(00000000), ref: 05887934
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 05887946
GetProcAddress.KERNEL32(00000000), ref: 05887949
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 0588795B
GetProcAddress.KERNEL32(00000000), ref: 0588795E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 05887970
GetProcAddress.KERNEL32(00000000), ref: 05887973
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 0588797B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75920630,?,75920F00), ref: 05887982
_memset.LIBCMT ref: 058879A4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,75920630), ref: 058879BA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 058879EF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 05887A0B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 05887A33
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 05887A48
WriteProcessMemory.KERNEL32(00000000,00000000,058876E0,00001000,00000000), ref: 05887A62
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 05887A80
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 05887A91
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,75920630), ref: 05887AAA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 05887AC6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 05887AD8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,75920630), ref: 05887AE1

Strings

WinExec, xrefs: 0588794B
ExitProcess, xrefs: 05887936
OpenProcess, xrefs: 05887921
D, xrefs: 05887830
Windows\SysWOW64\svchost.exe, xrefs: 05887860
%s%s, xrefs: 05887866, 0588789A
WaitForSingleObject, xrefs: 05887960
Kernel32.dll, xrefs: 05887926, 0588793B, 05887950, 05887965
Windows\System32\svchost.exe, xrefs: 05887894

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: 3327b81da3d8cb293d0751bf7f83dc7002996efeb08bb1cdf23d13fc79be9061
Instruction ID: 590a961a72969ad986a5a687f7ca3245a03e52964c950215b4e24930a23be553
Opcode Fuzzy Hash: 3327b81da3d8cb293d0751bf7f83dc7002996efeb08bb1cdf23d13fc79be9061
Instruction Fuzzy Hash: 6381BD756403187BEB31AB659C4AFEB77BCEF45700F000498FA09E6180DAB46F85CB55

Function 05887E40 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 131threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05887E63
_memset.LIBCMT ref: 05887E8F
_memset.LIBCMT ref: 05887EC4
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 05887ED8

Part of subcall function 05888710: _vswprintf_s.LIBCMT ref: 05888721

GetFileAttributesA.KERNEL32(?), ref: 05887F05
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 05887F55
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 05887F82
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 05887F9A
GetThreadContext.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 05887FBC
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00003000,00000040), ref: 05887FDA
ResumeThread.KERNEL32(?,?,00000000,?,00003000,00000040), ref: 05887FEF

Strings

D, xrefs: 05887EA3
Windows\SysWOW64\svchost.exe, xrefs: 05887EDE
%s%s, xrefs: 05887EEA, 05887F1C
Windows\System32\svchost.exe, xrefs: 05887F16

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: 4f59c0d00c834567ea0796dbe10120dbf9aecbb9a4ff56604c429031bed9745d
Instruction ID: 77a5b662fe6dc935e2c9cb920b1bc987c4627ff7ab9c03859f4add9d305d47bc
Opcode Fuzzy Hash: 4f59c0d00c834567ea0796dbe10120dbf9aecbb9a4ff56604c429031bed9745d
Instruction Fuzzy Hash: D341A675A50258ABDB20DB65DC45FED77BDEB44700F0041D8BA0EE6180EAB06F85CF54

Function 0588E3E0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,058B0DC0,7591E010,75922FA0,75920F00,?,05885FF7,?,?), ref: 0588E409
lstrcatW.KERNEL32(058B0DC0,\DisplaySessionContainers.log,?,05885FF7,?,?), ref: 0588E419
CreateMutexW.KERNEL32(00000000,00000000,058B0DC0,?,05885FF7,?,?), ref: 0588E428
WaitForSingleObject.KERNEL32(00000000,000000FF,?,05885FF7,?,?), ref: 0588E436
CreateFileW.KERNEL32(058B0DC0,40000000,00000002,00000000,00000004,00000080,00000000,?,05885FF7,?,?), ref: 0588E453
GetFileSize.KERNEL32(00000000,00000000,?,05885FF7,?,?), ref: 0588E45E
CloseHandle.KERNEL32(00000000,?,05885FF7,?,?), ref: 0588E467
DeleteFileW.KERNEL32(058B0DC0,?,05885FF7,?,?), ref: 0588E47A
ReleaseMutex.KERNEL32(?,?,05885FF7,?,?), ref: 0588E487
DirectInput8Create.DINPUT8(?,00000800,058A4934,058B1260,00000000,?,05885FF7,?,?), ref: 0588E4A2
GetTickCount.KERNEL32 ref: 0588E555
GetKeyState.USER32(00000014), ref: 0588E562

Strings

\DisplaySessionContainers.log, xrefs: 0588E40F
<, xrefs: 0588E527

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: a9d7bf89abd42f7814046bf57c7eaa1db5746d1bfa8950203df6a9551e04af3a
Instruction ID: 3a934da7ce88253f462d66ce122a3215a0539919de58472398b137348be9d380
Opcode Fuzzy Hash: a9d7bf89abd42f7814046bf57c7eaa1db5746d1bfa8950203df6a9551e04af3a
Instruction Fuzzy Hash: DE416E75750305ABEB20EFA8DC5AFAA3BA8EB49714F104144FE06DB3C0CAB4B801CB54

Function 05887610 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,0588DF04), ref: 05887627
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,0588DF04), ref: 0588762E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0588764A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 05887667
CloseHandle.KERNEL32(?), ref: 05887671
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,0588DF04), ref: 05887681
GetProcAddress.KERNEL32(00000000), ref: 05887688
GetCurrentProcessId.KERNEL32 ref: 058876AA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 058876B7

Strings

SeDebugPrivilege, xrefs: 0588763C
NtSetInformationProcess, xrefs: 05887677
NtDll.dll, xrefs: 0588767C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: 70c845843beab6b22642547afbeecd0784665e12b831ecce7cfbf6481194c3db
Instruction ID: 6dcf782f9161a2ea9bbfae1c23dd6d1a9036d70c3ecff9d769b41277791d2602
Opcode Fuzzy Hash: 70c845843beab6b22642547afbeecd0784665e12b831ecce7cfbf6481194c3db
Instruction Fuzzy Hash: BB214875A50309ABEB20EBE4DC0AFBE7B78EB48711F504149FE07D6180DEB46944CBA1

Function 058880E0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,75A773E0,00000AD4,00000000), ref: 05888122
lstrcmpiW.KERNEL32(?,A:\), ref: 05888156
lstrcmpiW.KERNEL32(?,B:\), ref: 05888166
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 05888196
lstrlenW.KERNEL32(?), ref: 058881A7
__wcsnicmp.LIBCMT ref: 058881BE
lstrcpyW.KERNEL32(00000AD4,?), ref: 058881F4
lstrcpyW.KERNEL32(?,?), ref: 05888218
lstrcatW.KERNEL32(?,00000000), ref: 05888223

Strings

A:\, xrefs: 05888150
B:\, xrefs: 05888160

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 7a4fa1034172750778ee404bc4c150e77b947a7d6c53f6cfbe03da10422aaca6
Instruction ID: c66b569ec6dbb0031219f2cc32e4ffa7042e7c639d4c1e6f03251e0ff83c390a
Opcode Fuzzy Hash: 7a4fa1034172750778ee404bc4c150e77b947a7d6c53f6cfbe03da10422aaca6
Instruction Fuzzy Hash: 1A41B475A012189BEB20EF64DD44ABEB7B8FF44210F404599EE0BE3140EB70AE05CF94

Function 0589043B Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 05890464
GetSystemInfo.KERNEL32(?), ref: 0589047C
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0589048C
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0589049C
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004), ref: 058904EE
VirtualProtect.KERNEL32(?,-00000001,00000104,?), ref: 05890503

Strings

SetThreadStackGuarantee, xrefs: 05890496
kernel32.dll, xrefs: 05890485

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: 0d005b0575acbceda72fcfe0b79931b0fdc854ca837cdb876479906aa4e26ae8
Instruction ID: 5ca3e17c456a5bf2749c6497d5b4efa03b34e2d03ffc1896a2bbce1e6089681f
Opcode Fuzzy Hash: 0d005b0575acbceda72fcfe0b79931b0fdc854ca837cdb876479906aa4e26ae8
Instruction Fuzzy Hash: 14318276A44219EBDF24DBA49C89AEEBBB8FB44745B180115ED02E7140EB74AE04CA90

Function 05887B60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 05887B79
OpenProcessToken.ADVAPI32(00000000), ref: 05887B80
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 05887BA6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 05887BBC
GetLastError.KERNEL32 ref: 05887BC2
CloseHandle.KERNEL32(?), ref: 05887BD0
CloseHandle.KERNEL32(?), ref: 05887BEB

Strings

SeShutdownPrivilege, xrefs: 05887B92

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: e7c2b8b593835cb9069c237daed0f05414ee3045a307c8a66df8705a701b8ba4
Instruction ID: ff0ad397f0356211a9eff439cc7e47f941cd6c5c184fe079f50bcc764e673c43
Opcode Fuzzy Hash: e7c2b8b593835cb9069c237daed0f05414ee3045a307c8a66df8705a701b8ba4
Instruction Fuzzy Hash: E9114275A50218ABEB20EBA4D84AFAE7B78EB04700F504559FD07EB180DE75AA01C7A1

Function 0588B39D Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(00000000,058A57AC), ref: 0588B3C7
ClearEventLogW.ADVAPI32(00000000,00000000), ref: 0588B3D2
CloseEventLog.ADVAPI32(00000000), ref: 0588B3D9

Strings

System, xrefs: 0588B3B3
Security, xrefs: 0588B3AB
Application, xrefs: 0588B3A3

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 88927f3b1d59d82d9923b07c58056d865af457e4c6f3cd7daaf655cf79e8d21b
Instruction ID: b1ddca6c29e4f183b3469fd9181ce5e0aea28dc7f12601fb9413ff766abf89b0
Opcode Fuzzy Hash: 88927f3b1d59d82d9923b07c58056d865af457e4c6f3cd7daaf655cf79e8d21b
Instruction Fuzzy Hash: B3E0E53B1043109BE222DF54A8C871AB7E0FBC8716F240619FF46A6100CA319D49CB85

Function 00430EEB Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00431031

Strings

1#INF, xrefs: 0043223E
1#QNAN, xrefs: 00432237
1#SNAN, xrefs: 00432230
1#IND, xrefs: 00432229

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ca0ea58483a9c45e7b28ff0240a4aafa045329082d7a331f95c5b9ff32c0d6ed
Instruction ID: 1ba2279ed8be820772e8d7c3489f61584f4f79732c44bba2f49185e388e9246e
Opcode Fuzzy Hash: ca0ea58483a9c45e7b28ff0240a4aafa045329082d7a331f95c5b9ff32c0d6ed
Instruction Fuzzy Hash: 1DC25971E086288FDB25CE28DD407EAB3B5EB48305F1451EBD84EE7250E778AE818F45

Function 05887730 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,058878EC), ref: 05887746
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,058878EC,?,?,?,?,?,?,75920630), ref: 0588774D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 05887775
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 058877A9

Strings

SeDebugPrivilege, xrefs: 0588776E

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 2e2b382a0204f1284f17e739250c1dd31930334b9886f1b6edb805d5eec7c5fe
Instruction ID: d0620e1ace8561521ddaa0d5c627801d01759dff9a5667418af29bb6ce2cf520
Opcode Fuzzy Hash: 2e2b382a0204f1284f17e739250c1dd31930334b9886f1b6edb805d5eec7c5fe
Instruction Fuzzy Hash: D4115275B50208ABEB10DFE5D84ABBEB7B4EB08700F108158F906EB280EA75A905CB51

Function 0588EEFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0589120C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 05891221
UnhandledExceptionFilter.KERNEL32(058A25B8), ref: 0589122C
GetCurrentProcess.KERNEL32(C0000409), ref: 05891248
TerminateProcess.KERNEL32(00000000), ref: 0589124F

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b358ad21a87bda349357de3d7c6c1550868a714e64d8a5bd3f227e0139a2cb6f
Instruction ID: de6b8e5313f030da07c2e546cb3e8dc4184c4a85285068e0a5cdd58868bc5b0e
Opcode Fuzzy Hash: b358ad21a87bda349357de3d7c6c1550868a714e64d8a5bd3f227e0139a2cb6f
Instruction Fuzzy Hash: 8121CFB89703559BF756EF29F44AA647FA4BB08300F20501AFE1A92240EFB47A80CF55

Function 00423B40 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

X C, xrefs: 00423FA8, 00423D92, 00423C21
X C, xrefs: 00423B5D, 00423D08, 00423F2C, 00423EC6, 00423D56, 00423CE4

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID: X C$X C
API String ID: 0-2718379240
Opcode ID: 0d02399648c13518c4cb0f7601dd32b78b80c50ea76878bed7eb001313bb0661
Instruction ID: 2e5d7492436ed7a20c8ef4e21d884bb0b5665ddccbacf502d6eb511b76857e1d
Opcode Fuzzy Hash: 0d02399648c13518c4cb0f7601dd32b78b80c50ea76878bed7eb001313bb0661
Instruction Fuzzy Hash: 38024E71E002299BDF14CFA9E9806AEFBF1EF48315F65416AE815E7340D739AE41CB84

Function 004127CC Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004127D3
___from_strstr_to_strchr.LIBCMT ref: 004128B4

Part of subcall function 004130DB: __EH_prolog3.LIBCMT ref: 004130E2

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 004128AF

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3$___from_strstr_to_strchr
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_
API String ID: 3394665768-3812731148
Opcode ID: 854dc4d12c4070c0b631fce2034d0d03ba0de500c85bcdd2ce3b69648cb1c1a2
Instruction ID: 4114168b71c07299ec2e7dfe45a941bbc6e8cb5fcabe13bdef151fcce3f4fd3a
Opcode Fuzzy Hash: 854dc4d12c4070c0b631fce2034d0d03ba0de500c85bcdd2ce3b69648cb1c1a2
Instruction Fuzzy Hash: 10D1AD70604646AFDB15CF28C681BEABBE1BF48304F14411AE856CB351C7B8F9B1DB69

Function 0040DAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DAAF

Strings

vmware, xrefs: 0040DB0D, 0040DB12, 0040DB1A, 0040DB1B

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: vmware
API String ID: 2427045233-2453097234
Opcode ID: 262a3f9a3629654a666d745d061db0472794faffc9b407833c5b6dc2ad175e1e
Instruction ID: 3562c0a716808c934ac8d13c11710cfa65038d29e13d6d1630a47638e082bb3c
Opcode Fuzzy Hash: 262a3f9a3629654a666d745d061db0472794faffc9b407833c5b6dc2ad175e1e
Instruction Fuzzy Hash: EB11A332A006188FCB05EBE9C491AEEB7B49F5C320F54013EE452B75C1DB786989CA64

Function 0225C43F Relevance: 2.8, Strings: 2, Instructions: 316COMMON

Download Yara Rule

Strings

@, xrefs: 022718C4
@, xrefs: 02271A59

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: b85d9e46d916949732f18da11686c1293fb79fac9a8fa679e59ef6780a52040c
Instruction ID: f9b08f4b1ef4b169d7e79b09692adbc8e50ab33cf5b190d740fac1c73a6323d6
Opcode Fuzzy Hash: b85d9e46d916949732f18da11686c1293fb79fac9a8fa679e59ef6780a52040c
Instruction Fuzzy Hash: 02D11A75218381DFD721CFA5C584AABBBF9AF88704F00492EF989D3651D730E909CB22

Function 058824B0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 05882537, 0588264A, 058826D0, 0588292C, 058829EF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: ef5a9a17417436e672f07fda0d3ac0e423f9d4c763340ea2ee6e9b790803e058
Instruction ID: 65d6da7d2fef4982c9c82d84a1606c60066850d6d4bfe3cfa213f4deed145d8b
Opcode Fuzzy Hash: ef5a9a17417436e672f07fda0d3ac0e423f9d4c763340ea2ee6e9b790803e058
Instruction Fuzzy Hash: 322226B8A00B059FDB24DF69C584AAABBF2FF48304F148A6DD89AD7755D730E841CB50

Function 0588B41F Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 05887B60: GetCurrentProcess.KERNEL32(00000028,?), ref: 05887B79
Part of subcall function 05887B60: OpenProcessToken.ADVAPI32(00000000), ref: 05887B80
Part of subcall function 05887B60: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 05887BA6
Part of subcall function 05887B60: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 05887BBC
Part of subcall function 05887B60: GetLastError.KERNEL32 ref: 05887BC2
Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BD0

ExitWindowsEx.USER32(00000006,00000000), ref: 0588B42D

Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BEB

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 613a9f19f3b569c7ebce9a220ae9298fc4db48b835120cab0e938f0130ec8b79
Instruction ID: 16536aeefd2ef56e96979692e6ba8317bb837a0ca7385a75918f9faab91f9ba3
Opcode Fuzzy Hash: 613a9f19f3b569c7ebce9a220ae9298fc4db48b835120cab0e938f0130ec8b79
Instruction Fuzzy Hash: 19C08C3674020802F22472AAB82AF7AB352DB84722F20002BAF0AC81C10C53A86041AB

Function 0588B443 Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 05887B60: GetCurrentProcess.KERNEL32(00000028,?), ref: 05887B79
Part of subcall function 05887B60: OpenProcessToken.ADVAPI32(00000000), ref: 05887B80
Part of subcall function 05887B60: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 05887BA6
Part of subcall function 05887B60: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 05887BBC
Part of subcall function 05887B60: GetLastError.KERNEL32 ref: 05887BC2
Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BD0

ExitWindowsEx.USER32(00000005,00000000), ref: 0588B451

Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BEB

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: eebba360a0aa1312bd4395cb672a434746db998e304c3daab1cbe9fda3d8a772
Instruction ID: afe113f89b0628cbdc194e182637018d7c75098d081c25cf69fe0dd86e15135c
Opcode Fuzzy Hash: eebba360a0aa1312bd4395cb672a434746db998e304c3daab1cbe9fda3d8a772
Instruction Fuzzy Hash: 2EC08C3674020802F22472AAB82AF7AB351DB84722F20002BAF1AC81C10C53A85001AB

Function 0588B3FB Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 05887B60: GetCurrentProcess.KERNEL32(00000028,?), ref: 05887B79
Part of subcall function 05887B60: OpenProcessToken.ADVAPI32(00000000), ref: 05887B80
Part of subcall function 05887B60: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 05887BA6
Part of subcall function 05887B60: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 05887BBC
Part of subcall function 05887B60: GetLastError.KERNEL32 ref: 05887BC2
Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BD0

ExitWindowsEx.USER32(00000004,00000000), ref: 0588B409

Part of subcall function 05887B60: CloseHandle.KERNEL32(?), ref: 05887BEB

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: dc403a160a2fd511c792cb4ef5d8f93e7287413a80976c625df8a599cdcb9666
Instruction ID: 5950af5d105754fbc4361421813bf546588d4da0ce7a59eb01f1483dff31f43d
Opcode Fuzzy Hash: dc403a160a2fd511c792cb4ef5d8f93e7287413a80976c625df8a599cdcb9666
Instruction Fuzzy Hash: E7C08C3674020806F22473AAB82AF79B351DB84722F20002BAF0AC81C10C63A85001AF

Function 0226B716 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

qrks, xrefs: 0227AA81

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: qrks
API String ID: 0-3937875505
Opcode ID: 57a642f6c229e5c535e38d64937fc43c72021c38463b5cca4f6e2843ee79803d
Instruction ID: 9ecfd14366f6d088ffaad6bcf9f1a5ed6f7cac1f5b49c520730241b4c2bb48a0
Opcode Fuzzy Hash: 57a642f6c229e5c535e38d64937fc43c72021c38463b5cca4f6e2843ee79803d
Instruction Fuzzy Hash: 7681BE72218341ABD720CF95C984A6FBBE9EB88768F14492EFA48D3254D730D940CB92

Function 0041F443 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0041F5B3

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 99d376bb96c326aaebeea3571a661e0eb4847d85884e0649f9d370338a0999fb
Instruction ID: 02c0a4244e35deec81d91413a76c13fca448e812d584d98964a824e83c8fe653
Opcode Fuzzy Hash: 99d376bb96c326aaebeea3571a661e0eb4847d85884e0649f9d370338a0999fb
Instruction Fuzzy Hash: A3512471600A0466DB388D7D85557FF2796AB26308F58093BE8468B793C60DEDCF825E

Function 0041F672 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0041F7E2

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4120c7c201e1aae3e6d74086ad28fb4559a06e3d86e3daaf1359f0f4076d8628
Instruction ID: 907e6acf196ad7f5bb32f45c96db215acfec8f90c604e3bb111b1bac785a2998
Opcode Fuzzy Hash: 4120c7c201e1aae3e6d74086ad28fb4559a06e3d86e3daaf1359f0f4076d8628
Instruction Fuzzy Hash: 7A5199722106455ADB38996885567FF27C99B42308F58083BE892CB3E2D61EDDCF835E

Function 022A90AF Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

@, xrefs: 022A9256

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c7561d097c12d317b36081542386e631b2d0634a52866dae06d7b026f7ad4a9e
Instruction ID: 1e26a200a810c4a752718c8f73ae747f24c754c12181164cbc42a829515c2a87
Opcode Fuzzy Hash: c7561d097c12d317b36081542386e631b2d0634a52866dae06d7b026f7ad4a9e
Instruction Fuzzy Hash: B7819C72951229EFCB219F95DD8CBA9BBB8FF48700F1000EAE509A65A0D7749BC1CF50

Function 0229C575 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

(D#$, xrefs: 0229C6B8

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: (D#$
API String ID: 0-2986077793
Opcode ID: 7647ad8f0bd829f2b17a0d14d5e5a3b607031fd2c438767243e47b97203bcf90
Instruction ID: c3769a8ff4a2a2f0913c8f1943f133846b0f549150ffc58964089dd5f51d5066
Opcode Fuzzy Hash: 7647ad8f0bd829f2b17a0d14d5e5a3b607031fd2c438767243e47b97203bcf90
Instruction Fuzzy Hash: 856159B7E503199BCB18DAB4CD8CAD9BBAAABC9300F20457BD405EB154DB709A41CF90

Function 022BF338 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

@, xrefs: 022BF3ED

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 862e08d8d64e744cc47c13e798763f3a759917b7b3a03219bf9799cfd2386458
Instruction ID: 70fdf806ff7666eec497d03b5f35940ed14bf465aa548ea2d68c4c03acc6250e
Opcode Fuzzy Hash: 862e08d8d64e744cc47c13e798763f3a759917b7b3a03219bf9799cfd2386458
Instruction Fuzzy Hash: C9714871A20219AFDB32CF64DD88BAAB7B9EF45354F1044A9F51AE7614DB30DA84CF10

Function 022BB495 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

zdbf, xrefs: 022BB5BD

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: zdbf
API String ID: 0-2567057744
Opcode ID: 046a7d9e54495da309052f60e6c67f51d04b1c379253d54143c164cce17528d6
Instruction ID: d9b44005989019f905c25bb2bf469722db9a123c655ddf21a943dce230ac3528
Opcode Fuzzy Hash: 046a7d9e54495da309052f60e6c67f51d04b1c379253d54143c164cce17528d6
Instruction Fuzzy Hash: B1410A71BA0301BBF7275AE58C41FEA766D9F507CCF144114BD41AB1D8D7A0AE018BA2

Function 022BE737 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

zdbf, xrefs: 022BE79C

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: zdbf
API String ID: 0-2567057744
Opcode ID: 5cbcaf253742308443275936c7f8166a56b001b1704efd10bff21da4e39597f2
Instruction ID: 8be978429df1158b1127400ee7895cd7662240a0dafe0f05c92eb2d621b86403
Opcode Fuzzy Hash: 5cbcaf253742308443275936c7f8166a56b001b1704efd10bff21da4e39597f2
Instruction Fuzzy Hash: E3412932B20301EFEB129FD5C984FED7BB4AF80758F924165EA11BB695C7B09900CB91

Function 022907D6 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

@, xrefs: 0229089B

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ce8be1afc00a9959cfe332b19a5803a05035d49366153e4f44881da82bbe5e70
Instruction ID: daf98a2fce697328d93386c32bd6769032cfde3218fe08bad2e7d01d346525d9
Opcode Fuzzy Hash: ce8be1afc00a9959cfe332b19a5803a05035d49366153e4f44881da82bbe5e70
Instruction Fuzzy Hash: 50412C72D01229AFEB309B94DC48FDABA79AB44754F1045E6E90DE7240DB709E848FA0

Function 022BE609 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

#, xrefs: 022BE6C0

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 03093f0fe357a286dc27a2bf7162e72be52dbf02bd2b991bca6e3d79cc72f15d
Instruction ID: 2c9c86276a9298a267f28669cf02ff7de38418f383201e9fdbe1f808a00a798e
Opcode Fuzzy Hash: 03093f0fe357a286dc27a2bf7162e72be52dbf02bd2b991bca6e3d79cc72f15d
Instruction Fuzzy Hash: F441F376E20205EFCB18DFE8CC41AFEB7B5EF84340F514429EA05AB245E770AA01CB90

Function 0229C059 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

(, xrefs: 0229C0F2

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 02f5e22cad23bcf07b7d0a9aa12e5a0f7f1e7ee0db637b1c424ab50fda3a3d27
Instruction ID: cde3290f6b799405032802b7b6fd0721fa7e588f453e7913ef9d83338aad84ee
Opcode Fuzzy Hash: 02f5e22cad23bcf07b7d0a9aa12e5a0f7f1e7ee0db637b1c424ab50fda3a3d27
Instruction Fuzzy Hash: 0A41CCB1D102099FDF20CFDAD888B9EBBF4BB08354F60852AE459AB294D3749945CF64

Function 022977D0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3529df317ed5255799b7db25904c2f42fe6c05ffd3732993d5c7905e331e9fab
Instruction ID: 599e55c2077d9fb3670c052b3d0a70f2961585c8654c3798d9a31018b3fe075d
Opcode Fuzzy Hash: 3529df317ed5255799b7db25904c2f42fe6c05ffd3732993d5c7905e331e9fab
Instruction Fuzzy Hash: F4822CB4E202068FDF28CF99C490ABAB7F2FF88304F18856DD94597648E775EA51CB50

Function 00474B12 Relevance: .6, Instructions: 641COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e280eb3d370ae67ade181f49e25fca8c975c6bba6192fc65036a3ef21be17bb
Instruction ID: 8c0315d0299a5bc2396010effb170a95a42d5226f205b6f4970e21d627b98f78
Opcode Fuzzy Hash: 3e280eb3d370ae67ade181f49e25fca8c975c6bba6192fc65036a3ef21be17bb
Instruction Fuzzy Hash: 4B321AB7F507299BCB14CED5DCC05CDB3B2BF98214B1E9165C914F7306E6B8AA068B90

Function 0042BAB9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5f8f3954fae5afff5fbcd55f0afed162239bf7f7a9cef1e12d6104c68de0c8
Instruction ID: a3dc61098e4a602e7fd85f391760a5b31dd480b710b24ca4e95ed93bea0538d9
Opcode Fuzzy Hash: aa5f8f3954fae5afff5fbcd55f0afed162239bf7f7a9cef1e12d6104c68de0c8
Instruction Fuzzy Hash: 38322525E28F514DD7239634EC7233AA248AFB73C4F55D737E81AB5AA6EF28D4834104

Function 00474B28 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f933a730031b89d025ea583653a8a3e0c86aae27f30676c2f9e3e185c12f5a78
Instruction ID: 83bf5f387bc5a8af9e1bcfa9b32cb766921cf783b9cf001f77986e91e9a92805
Opcode Fuzzy Hash: f933a730031b89d025ea583653a8a3e0c86aae27f30676c2f9e3e185c12f5a78
Instruction Fuzzy Hash: 68321AB7F507299BCB14CED5DCC05CDB3B2BB98214B1E9165C914F7306E6B8AE068B90

Function 00474B4C Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd93fc5de68bc5a207da332796e7894f3e78f288a864ca2d723b33996c89695
Instruction ID: 09c34d351c6364289e2b38e119607028f155935569b9dac664183becf782e57a
Opcode Fuzzy Hash: 0fd93fc5de68bc5a207da332796e7894f3e78f288a864ca2d723b33996c89695
Instruction Fuzzy Hash: 75321AB7F507299FCB14CED5DCC05CDB3B2BB98214B1E9165C914F7306E6B8AA068B90

Function 058888F0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de34ec9fda15d8b33ad715ce4cc2a5e0d48e4865fa5bbc03b41a52fb609f80d
Instruction ID: 91f6de57689744248833a8cdc14d4f17009033d24d97607c33cf5f65305dd7ff
Opcode Fuzzy Hash: 0de34ec9fda15d8b33ad715ce4cc2a5e0d48e4865fa5bbc03b41a52fb609f80d
Instruction Fuzzy Hash: DA225277E5151A8BDB08CA99CC515D9B3E3BBC8314B1F9129C819E3305EE79BA478BC0

Function 022AB4E7 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea324f6567ebc8026bd82ad39bcdc46a436b72a23d3686b6a218df958b3268d4
Instruction ID: cd5540e7b5c30db7c005b1e1b0d90867f89b2650ec295a96768b9a60dc4d0912
Opcode Fuzzy Hash: ea324f6567ebc8026bd82ad39bcdc46a436b72a23d3686b6a218df958b3268d4
Instruction Fuzzy Hash: 5302B132E102169FCB21DFE4CC64BAEB7B9EF54708F154569EA02EB618DB349D05CB50

Function 00473E86 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae3e4a251c3bde6055d4efdc263bb3bb2500922ce25f6367c7fbff57ddeebb2
Instruction ID: 2423609f72499d1b0fba43594f5e86935366f2f64d2dae569907490906d47a15
Opcode Fuzzy Hash: fae3e4a251c3bde6055d4efdc263bb3bb2500922ce25f6367c7fbff57ddeebb2
Instruction Fuzzy Hash: 7702A737D106618FDB40CFADDC8414AB7A2AF99201B6EC6B9CA4867316C630FE16C7D4

Function 00473EE2 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a01516143f0c8ebd1aec0a8eea070a511b7d56e9bdc7f00ba61e77b8706f5e
Instruction ID: 632e1591b3a63b9037bc199762dab50237b794ee1803eef00e2a3a899220cf5d
Opcode Fuzzy Hash: b7a01516143f0c8ebd1aec0a8eea070a511b7d56e9bdc7f00ba61e77b8706f5e
Instruction Fuzzy Hash: 95F19633D10A618BDB40CFADDC84549B7A6BF99201B6EC2B5CA4867316C630FE56C7E4

Function 00473EEF Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53427924ad177fac11ea59575be53a7c49b9e32924fb5bb0862538933f992cff
Instruction ID: 1cd008c9eba433c83685eb3f1f5792664c17ad0274dfd328c600bc36a8826d90
Opcode Fuzzy Hash: 53427924ad177fac11ea59575be53a7c49b9e32924fb5bb0862538933f992cff
Instruction Fuzzy Hash: D4F19633D10A618BDB40CFADDC80549B7A6AF89201B6EC2B5CA4867316C630FE56CBD4

Function 00473EFD Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aade63ed24d42035ad63bcf9ea19e7485abc3783a744a6dada0b56957000d99f
Instruction ID: 9b5a724d8892a7f47028d12a84e492cd12a24cb0be2888d6715f81049c7659d3
Opcode Fuzzy Hash: aade63ed24d42035ad63bcf9ea19e7485abc3783a744a6dada0b56957000d99f
Instruction Fuzzy Hash: 04F19533D10A618BDB40CFADDC84549B7A2BF99201B6EC2B5CA4867316C630FE56CBD4

Function 022A2771 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d03e9b99d0dc6f6e31d1dd635d4f5f23e9c69ccf3da5e177c1b4f28a7e20576
Instruction ID: 70aaacc530ddb117f344a5e0cc9cb93a150ead045dc1d70fc8cef11c7f06b689
Opcode Fuzzy Hash: 6d03e9b99d0dc6f6e31d1dd635d4f5f23e9c69ccf3da5e177c1b4f28a7e20576
Instruction Fuzzy Hash: 48E137B1D2162ACFDB28CF99D8906ADBBB1FF48700F15825AEC05AB709D3749841CF94

Function 0041C9D3 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: bfba0a5441aed94af7dac59f40aff5ba4e9ee9f8f9afaf612e1993249f304e04
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 4EC198322450A30ADB5D463989B41BFBBE15E917B131A07AFD4B3CB2C4FE18D5A8D528

Function 0041CE08 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: de16a12a486f2118c9cbd1cbfc846da3162c8d19807b39e84e397826ce870f87
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: A7C10A722451A30ADF6D4639C97017FBBE25A927B131A079FD4B3CB2C4FE18D5A8C528

Function 0041C59E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 10f74dd4704439bb90d9f9a713546d39eaefaa697b2f891d5f124c22fdfd8b9a
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 3EC1C8322451630ADF5D46398DB41BFBBE15EA17B131A079FD4B2CB2C0FE18D5A8D628

Function 0041C186 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c97b6d5c82451b633948e46dba8c5df9d0402a5f97bad7db6287073dce9db566
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 8BC1CA322851630ADF6D4639C9B41BFBBE15A917B131A079FD4B3CB2C4FE28D5A8C524

Function 022B24A4 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b47afef41298447906048b67300f2f0ec74bb9691d39088929b4ed65596c59
Instruction ID: 94105cc19c11ce371473bf7de93381e8e79eafcd032c7381ca7076acce5dd639
Opcode Fuzzy Hash: 01b47afef41298447906048b67300f2f0ec74bb9691d39088929b4ed65596c59
Instruction Fuzzy Hash: 98A18C72928352DBC321DF64C884A9BBBE9AF88794F114A2DFD94A7354D770DC04CB92

Function 004294C2 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c917e57ed030578cd7a1b77a4366148b9eaf0899cc1085d6cd8b2473a5544e8f
Instruction ID: 768a920e9d7e8fd07f8bcc844dd577ebb4d77bb15d979ba192a71138864f8639
Opcode Fuzzy Hash: c917e57ed030578cd7a1b77a4366148b9eaf0899cc1085d6cd8b2473a5544e8f
Instruction Fuzzy Hash: 72B18C32220618DFD719CF28D48AB657BE0FF45364F698659E899CF2A1C339DD82CB44

Function 0228F4CF Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f46978247d9adcac699208e9905aa961fcf73298a2c94a6897231f903b1fed6
Instruction ID: c4e5d103a27f085af8c33eaddf1a7b3472dfbe191ac0a3129e582d1db2da7225
Opcode Fuzzy Hash: 6f46978247d9adcac699208e9905aa961fcf73298a2c94a6897231f903b1fed6
Instruction Fuzzy Hash: 3691A63191121A9BDF21EF94DE88FEA77B9EF44714F5001A9E819935A4DB30DE81CF50

Function 022BE1CE Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d3802dc5f6050e51e6408200d343b399cf251e139224c8cca2ddb6ae646417
Instruction ID: 58bac6026083cc343af621a8a37133c64aba5725322b0bb826dc493bff3e181a
Opcode Fuzzy Hash: b1d3802dc5f6050e51e6408200d343b399cf251e139224c8cca2ddb6ae646417
Instruction Fuzzy Hash: 9E71E371A20305AEEB16AAD4CC45FFE7779AF48744F814165FD01EF288E770AA41C751

Function 022AA728 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196ebf6781e0f74c87b8deda6e7e85fc626370453615e591f92526e88ebc37d0
Instruction ID: 6f87a288df769381c7d1ea56bcedc8f38b0d9736ad169c1d2117b73189137cd9
Opcode Fuzzy Hash: 196ebf6781e0f74c87b8deda6e7e85fc626370453615e591f92526e88ebc37d0
Instruction Fuzzy Hash: 5691B371A107068FDB24CFA9C868BA6B7F5FF48304F1085A9E44A97A55DB70E981CF50

Function 0228C66F Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f4ff5b70e6a80c91a2defd0196956126a12cd39a6851b3bc32253beffbddc0
Instruction ID: fbc147795ce7f34de660e5b0e6701508e38fe6e6cc1785e58f516a24c860704b
Opcode Fuzzy Hash: f7f4ff5b70e6a80c91a2defd0196956126a12cd39a6851b3bc32253beffbddc0
Instruction Fuzzy Hash: 8C61C571A66302DBD739EF94D884BAB73E9AF88754F04492EF945972C4D770D800CBA2

Function 022BD3CF Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a475ee063dbde626e5ffc176d1c3060cf5d5c3c3077ed866ce00537f5da2d70
Instruction ID: 0273cd6afb16e2a9c5d76ac2da7c465c3232f173cdd8de0b091f4dd4da858625
Opcode Fuzzy Hash: 7a475ee063dbde626e5ffc176d1c3060cf5d5c3c3077ed866ce00537f5da2d70
Instruction Fuzzy Hash: B661A2706183019FD719DFA4C880BEAB7E6AFC8788F04492DF99997294DB70D905CF92

Function 0228B5B6 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087820a5acb7b835954214386905632c9a9a341cf7519a7727dae5575129ead0
Instruction ID: ced094d0886dc5619fee98700ce8f9140fa2ef6861cbc13b1cf9aa1c3ec0a64a
Opcode Fuzzy Hash: 087820a5acb7b835954214386905632c9a9a341cf7519a7727dae5575129ead0
Instruction Fuzzy Hash: 5C513B36A11212DBCB25FF98C8406BAB3B6FF8570CB19856DD802DB698E731F952C750

Function 022B6653 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9987cd5d478fa0632211cc876655512a5c5347b105626eeb42cf4429e761381f
Instruction ID: 35a5d2f2b2fadbcb94507282c3559dcff10233b883b8b476d9f8510f3139965b
Opcode Fuzzy Hash: 9987cd5d478fa0632211cc876655512a5c5347b105626eeb42cf4429e761381f
Instruction Fuzzy Hash: F751F771E60315ABEB229AD4CC44FFE7AACEF44794F440125F905AB285D760EC058BA1

Function 022AB22E Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a31eb55702faf0babc0482721ecbd77552fe7dba4ac65ded4f4fa3ab0d7552
Instruction ID: a3f57a276014efe9d3447e20543f7133c19bdbe1c60cdfc695d4927295892d7d
Opcode Fuzzy Hash: 54a31eb55702faf0babc0482721ecbd77552fe7dba4ac65ded4f4fa3ab0d7552
Instruction Fuzzy Hash: 7151A2B1A102199FDB208FA4DC98B9A77BCEB55708F0040F9A708E2145EB719E84CF25

Function 0229E78F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8102ffba6620f3d05ee683c1f68ddb6f7afb391b27629e07e1e710b3b354f0
Instruction ID: 3885dd0bc7f06559235f1506dff24c4a16e5849391a8cd1008bf1e0cb476a7cd
Opcode Fuzzy Hash: 3d8102ffba6620f3d05ee683c1f68ddb6f7afb391b27629e07e1e710b3b354f0
Instruction Fuzzy Hash: 79518B32A20206EFEF24DFE8D984BAE77A8FF05704F52046AE901E7258D7709E10DB50

Function 0228F2FF Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e163f70c640ef50be3c7ca8aac462640ee482594af5c854eb4bb1a0c0a1e885
Instruction ID: 0e90f0c5a86b31c726a290241eae37686cd16f1b55d34b1d2c397aa647f96efc
Opcode Fuzzy Hash: 9e163f70c640ef50be3c7ca8aac462640ee482594af5c854eb4bb1a0c0a1e885
Instruction Fuzzy Hash: A551C132A2225A9BDF25AED0CE84BAB37B5FB44300F504569EE05DA584DB74D9908F90

Function 0228F07F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bec6633f354452050b71d4758241678f18fbfcbca50cbf4bbd5fd6f9ff94fea
Instruction ID: a988b5990fb69c5db0e02b8afbb4feb9387808ade0b79a5a85b07d8f0ca5de40
Opcode Fuzzy Hash: 9bec6633f354452050b71d4758241678f18fbfcbca50cbf4bbd5fd6f9ff94fea
Instruction Fuzzy Hash: 39512676A5121AABCB21AFD0DE48FAA7779EF04744F540060F905E35A8DBB0DE51CF90

Function 022B964D Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dfcd25373fbe48fcb67dd6a6333b2422532f85c6eff56ad0d9fd50a6e63fd5
Instruction ID: f5dfc72073a10ea744ca7905a1dc0cc7c4e4db48d3fde1696e669ce3d86be50c
Opcode Fuzzy Hash: 70dfcd25373fbe48fcb67dd6a6333b2422532f85c6eff56ad0d9fd50a6e63fd5
Instruction Fuzzy Hash: 50414EB5A202159BD7119FE4C880BFDB7F5EF85754F114829FA45DB688E770A980CB10

Function 0228A777 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963b965448a7b7d4e17c489dc0e60618229a6113bb16489ebe398dbe8f7b6b31
Instruction ID: b1cafe0fd8c7e4526e67cfcd245ee7bb87b5fd92fc84e18f36b65d083aa92484
Opcode Fuzzy Hash: 963b965448a7b7d4e17c489dc0e60618229a6113bb16489ebe398dbe8f7b6b31
Instruction Fuzzy Hash: E1512731911602DFC721EFA8D844B6AB7F4FF48710B15456AE946DB3A4D730ED12DBA0

Function 0228C43F Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a4e6a00cdd249f5116b710f6dd6c2088cfaa07171c3f099afed1a74a41d72e
Instruction ID: c50ff6313981b1a4b1ee62ff5f013e4cdc30b22e585c6e14cf0877fb60eb04e3
Opcode Fuzzy Hash: c3a4e6a00cdd249f5116b710f6dd6c2088cfaa07171c3f099afed1a74a41d72e
Instruction Fuzzy Hash: 5E41E532A62605ABCB25BFE4DC04F7F77BAEF84744F104426E40296298DB74D991CFA0

Function 022BF0CC Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deac3a7aa5db223708d1eadeadb2405594cc214f0fda2ad23f5d8abc9dc1067e
Instruction ID: 427f1371114338dad5e274b21947de7ce9138e60733a09aba20094da0f0e875a
Opcode Fuzzy Hash: deac3a7aa5db223708d1eadeadb2405594cc214f0fda2ad23f5d8abc9dc1067e
Instruction Fuzzy Hash: D4414A369202028BC7379FE4DE99BBB7765EF81794B09083CFD0587A19D760CC05C691

Function 022A663F Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb4fc6293664cc79c2bcc6dd51300d3cac13dd791027c0f3e0523e548fb8d1d
Instruction ID: d51d9fb0c23b9899628a2ad49b415e9a733dc0083773fdb8c182ae4e9e001d1f
Opcode Fuzzy Hash: 7fb4fc6293664cc79c2bcc6dd51300d3cac13dd791027c0f3e0523e548fb8d1d
Instruction Fuzzy Hash: C8517B71A283029FCB10CFA9D884A6AB7E9FF88744F08493EF588D3654E734D904CB95

Function 0229D16C Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda8c44647c7736df40ad64d6cbc144f2353cd61760eabaa220dbb4315865868
Instruction ID: cdf41528b0aa463d74de33706ac2d155486af6aaaec6b3c440446276640bad69
Opcode Fuzzy Hash: eda8c44647c7736df40ad64d6cbc144f2353cd61760eabaa220dbb4315865868
Instruction Fuzzy Hash: B751C071A2021ACBDF24EF95C884BA6B7B8FF55304F1441AAD815CB269D770DD80DFA0

Function 0228D374 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f8c609156f1e8e4c293fbf3c2195ba934371703a58fb947dc69676208f7862
Instruction ID: 770a2fb18d8ef08ee7ab27ceae055f5642bb554386fad1f284ed7358c0ef1b3f
Opcode Fuzzy Hash: 69f8c609156f1e8e4c293fbf3c2195ba934371703a58fb947dc69676208f7862
Instruction Fuzzy Hash: 8A41F632A22216DBDF19EEE9C480BAE77B1EF44354F154064E906A72D9C770FD49CB90

Function 0228F7FF Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e25e9740fedc8f462874a3066d16dbad7d4e5a205b3339e12afe4eb9dbfad79
Instruction ID: 97dac938a1d35f706f186d27b4689603615b2cbfb2847ffe4181962426fd2d14
Opcode Fuzzy Hash: 2e25e9740fedc8f462874a3066d16dbad7d4e5a205b3339e12afe4eb9dbfad79
Instruction Fuzzy Hash: B4419F3295121AAFCB31AF94DE88FAA7779EF48740F6001A4F519A7590DB30DE90CF50

Function 0227D13F Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fda73d4e7ad2fbeb13dbe4fcd9606809b57420475522caa32e0906feec4a2db
Instruction ID: db9e438b4e5b51751e18e10f85e7d7bdd2bd360457bfbfb69c04bfa50e1c9477
Opcode Fuzzy Hash: 4fda73d4e7ad2fbeb13dbe4fcd9606809b57420475522caa32e0906feec4a2db
Instruction Fuzzy Hash: A7419D7295410AAFDB129FE8ED48FBA7BB9EF08398F100464F905A7215D770DE11CBA0

Function 022A7720 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85217f68118fbbe87232c9a55fe66d5e2a598df6d56db49f229fca550b1bfdfa
Instruction ID: bf4b12ba8888d9d463787ff11b05c5ae60c090f8a76f51a2d65c34410b7ff06e
Opcode Fuzzy Hash: 85217f68118fbbe87232c9a55fe66d5e2a598df6d56db49f229fca550b1bfdfa
Instruction Fuzzy Hash: 4841D032A50204ABDB209FA8EC49FBEB7B9EF48710F108429F502E76D0DB749954CB64

Function 02298273 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794eb77bff6e7dec0d31ab9a4303f3c9b84eaa28ad7808e3fc4ba212f3be0c7b
Instruction ID: 42445b2faadf9d26d2437d91d3d2f9fca7a0dcdffd547f4d7800802429e83f88
Opcode Fuzzy Hash: 794eb77bff6e7dec0d31ab9a4303f3c9b84eaa28ad7808e3fc4ba212f3be0c7b
Instruction Fuzzy Hash: E2417731A10616EFCF10DFA9C584BADB7B5BF46310F184569E906EB688DB70F911CB82

Function 022631DF Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abded4771b6031ee57294abb508489df74ca318cc17edde8521ee8e6e9c18d79
Instruction ID: fd0706bf9980d8501b224ab4b0348d1e3a74d6d69bdd76b52eb5f797a914a8b8
Opcode Fuzzy Hash: abded4771b6031ee57294abb508489df74ca318cc17edde8521ee8e6e9c18d79
Instruction Fuzzy Hash: 51411B33B35A028BD764DAEAC885BBA73DBAB80354F15413CE55AC7188DFB4D841CA50

Function 022B52E7 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6156543293a82763002026542bf55d9ed819705df047e12cbcb225bfb5db716
Instruction ID: 06f9214e38d95f725d0870e31833e81266b31de9247d8dc70a9eb5c83f08b069
Opcode Fuzzy Hash: d6156543293a82763002026542bf55d9ed819705df047e12cbcb225bfb5db716
Instruction Fuzzy Hash: F3410335A10602EFCB16DFA8C5849ADF7B1FF48741B908668E942AB354D770EE61CB90

Function 022BB728 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2662be0e8cc344bc132d417fcf367fadfa9133dc486eb0013a0d838198c8dc9
Instruction ID: 643f56d8d291fd78b4d41b761dec41efbabd9e455281839ad2eb44406516e517
Opcode Fuzzy Hash: f2662be0e8cc344bc132d417fcf367fadfa9133dc486eb0013a0d838198c8dc9
Instruction Fuzzy Hash: 59316D77E502026FDB266AA88C41BFB77A4DF80788F944565ED42DB288F770D941C690

Function 022BA327 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d406993f55c7ef08342ffd042e25dec69980d85511349b179d8cbba93a9ad87a
Instruction ID: 8b6f1435957e718142c01dc9b9c906d75bc993e779e47e4e23eeb98cc5186778
Opcode Fuzzy Hash: d406993f55c7ef08342ffd042e25dec69980d85511349b179d8cbba93a9ad87a
Instruction Fuzzy Hash: B731C171A60301AFEB16AFD0DD89FEA3A75EF55744F000169ED069F285EB70A940CB61

Function 0225C2ED Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d7025fef4849f8ff415a35af87926eae07488910a6973fbba29a021f713cbd
Instruction ID: 3ddd7a06e2e561231da488139c7645bb1d0a66024f786618e9e87b351ca142f7
Opcode Fuzzy Hash: b4d7025fef4849f8ff415a35af87926eae07488910a6973fbba29a021f713cbd
Instruction Fuzzy Hash: E341A271A0060AFFDB14CFA4DC45ABABBB8FF88324F148226E550A6590E770F954CF94

Function 022A335F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f786d53b96cf543c0da45b04409b81f7d9723b14727ed4b66d27499145069a6
Instruction ID: 3e900a4c3a926d6d8ab06bb00c36b77b1d0586c599bb856feb9f67f9fe6873c3
Opcode Fuzzy Hash: 9f786d53b96cf543c0da45b04409b81f7d9723b14727ed4b66d27499145069a6
Instruction Fuzzy Hash: 7A315935A6026A9FDB12DFA4CC58BEABBB5EF44300F1041EAE415DB301D634DA41DF90

Function 022B1636 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1df39e2bebeee3c5990b18d9ea2743062983eb8510dfe3053bdb42453713e5
Instruction ID: e97fe1f44b37deede2211c35d94213a8b16cac77f868056170a84d9d09d28e64
Opcode Fuzzy Hash: df1df39e2bebeee3c5990b18d9ea2743062983eb8510dfe3053bdb42453713e5
Instruction Fuzzy Hash: 70312637A20215ABCB264BE98890BFEB3B99F44780F094066F909DB298E374CD52D750

Function 022A320F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a5efa3060b4b53363ed3a5ec149a45cdc6ff27475a0e26eeafcd2225f2c22a
Instruction ID: 5d4a7662256fec618dd7698b215012c0fa5b037b648f2be48ea92237d7ddd72b
Opcode Fuzzy Hash: 50a5efa3060b4b53363ed3a5ec149a45cdc6ff27475a0e26eeafcd2225f2c22a
Instruction Fuzzy Hash: 6D316B319142999FDB16CFA4CC25BEABBB5EF59700F1440E9E5459B301C674DE81CFA0

Function 022862CD Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8aabd9824af911f0f6843beb94f92ee6712232089d8eeabb3d43353f5ddebb
Instruction ID: f8ed06bc3e02555045deda2f055974af9807dbc2cc80b202ca6159ba6dd66333
Opcode Fuzzy Hash: 1d8aabd9824af911f0f6843beb94f92ee6712232089d8eeabb3d43353f5ddebb
Instruction Fuzzy Hash: D331D2329512899FDB219FD4D848BBDBBB9EB45B01F110024FA11AF298DB71DD05CB50

Function 0228D65F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99e1fea245ecce04fc90c6792965e0789fbd7a187ff16b7a58cf956950c3ed5
Instruction ID: a9a79185205b97848300777b89cc4a7f01e0132bd5a76b2a428613eee766c736
Opcode Fuzzy Hash: e99e1fea245ecce04fc90c6792965e0789fbd7a187ff16b7a58cf956950c3ed5
Instruction Fuzzy Hash: 7031D1327327068BD724AAF9C4D5BFA7396AB80318F14453CE95A872D8DB70E849CA00

Function 0227C6EF Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbdbd8233d625329cd7b7c133334437a7edbe0e4c3d46418f8a2e95544afdc82
Instruction ID: 80bfaca5ca26508dd3d4f41093ec7e869ade8df2c3470e501cefeeb1d7c4ca80
Opcode Fuzzy Hash: fbdbd8233d625329cd7b7c133334437a7edbe0e4c3d46418f8a2e95544afdc82
Instruction Fuzzy Hash: D6214B366545019FCB256FF4EC48ABB372DEB85704F144479ED038A688DB719A12CB90

Function 0229C234 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2bf9dc7f1c4bf9877c3c1921bdd70162001c3bd7e526d856a6a63f21ad7cbd
Instruction ID: fe7d7f696090bc757868ac8849bb355bb41ccf26966305a90ee4ae1c224c68f6
Opcode Fuzzy Hash: 0b2bf9dc7f1c4bf9877c3c1921bdd70162001c3bd7e526d856a6a63f21ad7cbd
Instruction Fuzzy Hash: 56317F72E10209BBDF15DFD4C984AEEB779FF48744F14406AE905AB280D7B0AE01CB94

Function 0229E251 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc24746e330c1ee392ffac7cec778b076be563c8e5b99073746c94348b4c3142
Instruction ID: 06f1954b7a38fea13756390da1e26201e1e3d4d85f124a3da123fcf46abf7709
Opcode Fuzzy Hash: dc24746e330c1ee392ffac7cec778b076be563c8e5b99073746c94348b4c3142
Instruction Fuzzy Hash: 5B217C31A10119EFDB11DBD8D884EBE77BAEF89744F15446AE801D7214D7709E018B90

Function 0229D3EF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8535681259abb8165d096f7b6948bf6d76ed7dcd137faa35c9405c31d82c169c
Instruction ID: db449c1c90e5b72e868471929a8afe98859738279ef11f773ac740824455f292
Opcode Fuzzy Hash: 8535681259abb8165d096f7b6948bf6d76ed7dcd137faa35c9405c31d82c169c
Instruction Fuzzy Hash: E031D67191020AEFDB159FD4D888BA9BFB4EF06358F248069E905A7354C371AD51DBA0

Function 0229C320 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64eacf76a5c4eeb8673f6f6ca776395137716c17c900156a4b20c8a7e358f4c
Instruction ID: cfbfa39b8baae990fa84921ad573707d32171f8b29bacab2aa1970b9ae541f19
Opcode Fuzzy Hash: d64eacf76a5c4eeb8673f6f6ca776395137716c17c900156a4b20c8a7e358f4c
Instruction Fuzzy Hash: E3218E76A10209EFDF119F9ADD44EAEBBB9EF8C740B10406AF901D7250D770AD10DB64

Function 022B57A2 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44a11b4da4f1cbca184a9f82ad5db3012a76f5283d0e1e854b6adf08bca2fa9
Instruction ID: fa090517a3ea533a0778a9260886862a3c3cb6d2af8a679121ae712e130bb1bb
Opcode Fuzzy Hash: d44a11b4da4f1cbca184a9f82ad5db3012a76f5283d0e1e854b6adf08bca2fa9
Instruction Fuzzy Hash: A02137736506A1BED7224B958C00F72BBA9AF89B51F054141FAACDE181D758E921C7B0

Function 022BF262 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b84055f01c1a4be046f2f039573f8100b8500cbd126683d821706295a8a6e2
Instruction ID: bc3d79f802d1a4b12dca1019315ba4586091d72cbb80fe4dbf4afd021b6c9ed1
Opcode Fuzzy Hash: 79b84055f01c1a4be046f2f039573f8100b8500cbd126683d821706295a8a6e2
Instruction Fuzzy Hash: BE213B36F20241ABD75F9AE88F589BA76B9EFC8384B658064F901D7B18D760CD01C790

Function 0229E173 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ce733b8f8b2b728b565313e004e8b6c284edbab3c67ca465076b0bdcc65dc8
Instruction ID: b969cab774fa85c341d9d73675a0d0548d503fbbdd80b2050026b2c5ee3a4d51
Opcode Fuzzy Hash: b4ce733b8f8b2b728b565313e004e8b6c284edbab3c67ca465076b0bdcc65dc8
Instruction Fuzzy Hash: F6210836A10502AFDF2DDBD8EC88A7B77B8EB84214755417EE80683258DBB1AD05CB90

Function 0041AD20 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 82f9cf29eb5eb6055701d1debb7c2db5643375262d7fc3bd9dde121dc2856cc8
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2B117B77203D4143D618863DF4B45F7A397EAC632372C436BD0424BF18C22A98E5960A

Function 02283030 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f74744f57767e2dca1a7f6e41b95584ddd8c11fc6858ec6658088a0ac4349c6
Instruction ID: e5ed5ba495d01b58ca0cb7d98925e53d367218443ecd655c7bad7f4878ba47e2
Opcode Fuzzy Hash: 7f74744f57767e2dca1a7f6e41b95584ddd8c11fc6858ec6658088a0ac4349c6
Instruction Fuzzy Hash: 43313671D52129DBCF35EFA4D94CBA9B7B9BB04B05F4904E4E109A21A0CB38DE94CF50

Function 022BF5B5 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6665dd743d6be52f3570f84665562bdba873f4a65df0fbb96cc0d52ab4935c
Instruction ID: 071880a0581716d4d96614661fa2d1ab6fb1342683def45b1c6ab0b15bb3eeea
Opcode Fuzzy Hash: ee6665dd743d6be52f3570f84665562bdba873f4a65df0fbb96cc0d52ab4935c
Instruction Fuzzy Hash: 82219A32980550FFC7229FE9EE0CE9A7F79EF89B80F210465F60592560C7318A11DBA0

Function 0228B42C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e7735e38a6694586937aa1881eaf6e9265350ef1fbf3b33003c08c0875e173
Instruction ID: 0cc181be1f4d44864ec32f186e289121880da55364404a32e3da7cce1ee80c2a
Opcode Fuzzy Hash: 25e7735e38a6694586937aa1881eaf6e9265350ef1fbf3b33003c08c0875e173
Instruction Fuzzy Hash: F6212672E51140ABDB21ABE8DD55F6E7B79DF84788F140028F901E7284C730DD01CB90

Function 0229E6DF Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a032f5bd014b594f9eaf88cee926615108a92047c3cb65526b15193387ca67df
Instruction ID: be8a7cca4fd536c8eccb56160c7e984afee0f5adcccf582b17448b5fddec6964
Opcode Fuzzy Hash: a032f5bd014b594f9eaf88cee926615108a92047c3cb65526b15193387ca67df
Instruction Fuzzy Hash: 5111E2722A1656AFDF22CFD4EC88FF73B6DEB45790B120426F60586118DB729C11CBA1

Function 022B507B Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d65664916980eb35c1b6f174ca989ff7502381948554e83a245f6486c5ec7e
Instruction ID: dfa930b9e851fc960fedfc879309fc38e63338707ae0acb888589c5c7c05a745
Opcode Fuzzy Hash: 27d65664916980eb35c1b6f174ca989ff7502381948554e83a245f6486c5ec7e
Instruction Fuzzy Hash: CB216D32620701AFDB268F95D984FA6B7FAFF48789F500C28E1428B594CB71E865CB54

Function 022BB646 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20070737f167fc5e532d44df6a3c99ecb5fa9d53bed73cb3f33027543783428d
Instruction ID: 883f4b90ca6fe29ed0800718e227f8184c1e582ec0c919b9737ecdc522151a8e
Opcode Fuzzy Hash: 20070737f167fc5e532d44df6a3c99ecb5fa9d53bed73cb3f33027543783428d
Instruction Fuzzy Hash: 99112431F647009BE7266BF88809BEAB361DF9078CF20011DAC2A4A2D5EBA02C01CB51

Function 0227E03F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bf570dc3b1d1c2f5fb0af71025142e9967fe7954fc691a27012901e769fd65
Instruction ID: 313456895d12d26f1032e3f27f717e9960280334fda582313a78d6f12a456fcf
Opcode Fuzzy Hash: f0bf570dc3b1d1c2f5fb0af71025142e9967fe7954fc691a27012901e769fd65
Instruction Fuzzy Hash: B121A272A40615EFD721DFA5D88CFAEBBB4EF84701F254065FA05AA180CB749944CBA2

Function 0229E0EE Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c9d7e7adadec1c3f9b2b19cb870b69412828e1a52948ed821137b4339ad3bc
Instruction ID: b8e16b07c84f9c9532791a95fdd2be9455fcfcfba1a6f7ec8ed1896153470c20
Opcode Fuzzy Hash: 34c9d7e7adadec1c3f9b2b19cb870b69412828e1a52948ed821137b4339ad3bc
Instruction Fuzzy Hash: E71104B2664202BFEF189AE4DC49F76776DEF88B95F21046AF502D61A4D7618D01CF20

Function 022900CF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62bcd8e73b9c65d2469fe48bfdd6b61660e2bc5205e77bda4f5de5724eff634
Instruction ID: ee90e05eb50709e920a8c54251eb9cd16864190869f2c85d35865cca2c8e8c0b
Opcode Fuzzy Hash: f62bcd8e73b9c65d2469fe48bfdd6b61660e2bc5205e77bda4f5de5724eff634
Instruction Fuzzy Hash: 7211B132A20118ABCF219FA4CD44BEE77B6EF55350F104265E919972D4DB70EE80CF80

Function 0228379E Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef9900e0043eaf59c24047fdceebf177b75497a1961093eea5687205b8afcd69
Instruction ID: 3cc004c80a655a9c3b1b31e5d1a775f99e7d451adfc2d4bea96f2dd51c7fb0f6
Opcode Fuzzy Hash: ef9900e0043eaf59c24047fdceebf177b75497a1961093eea5687205b8afcd69
Instruction Fuzzy Hash: 8A11A175A41601BFE7259BC4EC89F6A7BB9FB49B10F200468FA0693290CB74ED10DB90

Function 022AC27F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ed51088ead3d8372123c4b93aea57394cdc4d1ceee6db8165121af6990fe02
Instruction ID: a316d2bf1469e54c7d95f087244a8d595deaeee49a0d7baf4cb35c05d6276fc8
Opcode Fuzzy Hash: 97ed51088ead3d8372123c4b93aea57394cdc4d1ceee6db8165121af6990fe02
Instruction Fuzzy Hash: F61104726A4301AFD704EFA4DC56FBB77A8EB48750F00481AF956CBAC0E6B0E910C795

Function 022906CF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35146fc1b10a769fbc1c7149b72356a064a265cabec5b47c639ee394c727e31d
Instruction ID: cb62dcc16bad9ddb40c832383e29ad2ab7e14380f178b54589d823cf23d76985
Opcode Fuzzy Hash: 35146fc1b10a769fbc1c7149b72356a064a265cabec5b47c639ee394c727e31d
Instruction Fuzzy Hash: E3118E76D00109AFCB109FD8A848BDEBBBCEB45724F204475E915E7244E3728E04CF90

Function 0229001F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9f4531c69757ef0b1d82b06e3e62435b0e826b113ef1d5e54847302053ec81
Instruction ID: d4b5b05b7c4f54772d1925b189b0e478fe1908198e6e91605805a37756880272
Opcode Fuzzy Hash: ae9f4531c69757ef0b1d82b06e3e62435b0e826b113ef1d5e54847302053ec81
Instruction Fuzzy Hash: 6911C432A10218ABCF25EFA4DD44AEE77B6EF58350F1001A9E90597290EF70DE80CF90

Function 022BB243 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0ea9a00f8eb1d302029dc4c37c3a9b262ae31da226cb2b28d8e79167f3be0f
Instruction ID: f6d4bfa0ed6575e8cf21784d418c0cf1de9b3084f0ae979221cfbd10613be29c
Opcode Fuzzy Hash: ac0ea9a00f8eb1d302029dc4c37c3a9b262ae31da226cb2b28d8e79167f3be0f
Instruction Fuzzy Hash: CC116D31910A41DFDB369F96DA08FA7BBF9FF81B89F04482DE85682664C770A940CF50

Function 022AC3BF Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d46adfaaff9327a75d1fd925098b41f3b34dcd26e7abb5d07b665c4f611bd4
Instruction ID: adc761a5b5fe596b0034442987b58dd67049d15f89820db3fa0d9f12b194a5fb
Opcode Fuzzy Hash: 25d46adfaaff9327a75d1fd925098b41f3b34dcd26e7abb5d07b665c4f611bd4
Instruction Fuzzy Hash: 7101C432654346AFC710DFA4DD49FABB7A8AB94740F00485AB955CB2C1D670E904CB55

Function 022A83FF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd0b9c5944565130570a723d7421a4186c9a489530cd22930ee15224936c538
Instruction ID: 5a35f4f06899d04712f51b027c0f55724c31036e30fe3faefdacdbe3480957b9
Opcode Fuzzy Hash: 1dd0b9c5944565130570a723d7421a4186c9a489530cd22930ee15224936c538
Instruction Fuzzy Hash: 0E01D23591031AEBCB10EBA0C5247B9BBB4FF04705F0480A5E8829A888E374DB45EBA5

Function 0226A2DA Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4892d1e160d21b452b93a9739d53f264522e544c87cfac4d34e7ad9bd8f9246a
Instruction ID: de1cf7a0533a0e94fe1e15761585561cd0408d026ea64084bd6f8375b8673e8e
Opcode Fuzzy Hash: 4892d1e160d21b452b93a9739d53f264522e544c87cfac4d34e7ad9bd8f9246a
Instruction Fuzzy Hash: CEF0E273710A006BC716AADE48449ABB2AFAFD8710F488464B905BB340DAB59D5186A0

Function 0226B1FC Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b566ea08acb99e810c30c2329d20291030beb95771ac666a47cfa843bc93e7
Instruction ID: 733c7defca86689f2cf2c6cec7f80b2e0d0bdf5264353a69a5658243e4db2114
Opcode Fuzzy Hash: c9b566ea08acb99e810c30c2329d20291030beb95771ac666a47cfa843bc93e7
Instruction Fuzzy Hash: 0201A2732612408FD310AFE4CDDCE3A77AAEB8074CF148565EA0597619CB75D884C960

Function 0228171F Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a859210293ed90d15fce2e709d99a2120e748018810e9686c6d4ba806c2ea11
Instruction ID: 14f1b53ee7cad7f862819bb01bef8ca4b5a7d6f5439d35ecaa8a13fb5b3589b4
Opcode Fuzzy Hash: 6a859210293ed90d15fce2e709d99a2120e748018810e9686c6d4ba806c2ea11
Instruction Fuzzy Hash: D1F02232151281EBDB21AFD5EC08FAB37B8EF85700F00442AF50A876A0D334D426CBA0

Function 022AC04F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4e564ca8d40244b256ca599c685f07d73043c788197ef2ffba0e4f7403d1d9
Instruction ID: 826899b0958a3acb69a229b660f9ee869b8eba451eb019b5a8b5f08a85df94db
Opcode Fuzzy Hash: 8f4e564ca8d40244b256ca599c685f07d73043c788197ef2ffba0e4f7403d1d9
Instruction Fuzzy Hash: 94018175A20308AFC708DF64D891E9AB7F9FB4C300F108569B406EB281EB70E900CB54

Function 022B7370 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2b2081f8a02f0623d079e1b087fe6749f6a793ef3737e2b3075ce75dc28974
Instruction ID: ff3f8dd0e08d9e662f848f3962ad0a81236879173db0805c10a3e16662c1c5cf
Opcode Fuzzy Hash: 7d2b2081f8a02f0623d079e1b087fe6749f6a793ef3737e2b3075ce75dc28974
Instruction Fuzzy Hash: D9F0E933494743EAD7334689EC49BE6FBB4DFC179CF240429ED54165A5C77698C0C590

Function 022A72FF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f4fe29a6ed8acc666750766eaa4c187cdc0a5ab82ae7c7a86fa77201ed39a6
Instruction ID: 78d3f0d7ea395170a0ddf7bb6f2ffa7d39755b8a1ea9078c90d4bf0fee611a3b
Opcode Fuzzy Hash: f1f4fe29a6ed8acc666750766eaa4c187cdc0a5ab82ae7c7a86fa77201ed39a6
Instruction Fuzzy Hash: 50E023366D151097C7315AD8EC1CB9ABB25DBC17A5F260134FD145B584C7718C11C7E4

Function 004882F3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ac22e05a8f276b30255be532e6954f615311fc94750cbb7d5be2aa40435a25
Instruction ID: c802cf6c04fd249671eb60f3597b2d1ace81b266a90833c3c3c6c9b209906770
Opcode Fuzzy Hash: 46ac22e05a8f276b30255be532e6954f615311fc94750cbb7d5be2aa40435a25
Instruction Fuzzy Hash: 3FE0653010C29ACFCB02BB04D5204EDF7E2AF66B00F9A0D4DC5C213240DA791551DB8B

Function 022A83BF Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027bd08fc00f2a19e79c0817cec5c103b002b86706294bd2a107f5e965a18168
Instruction ID: d117f76758985e15bba0c1d0de5c7e28cc976bf4b2da38fc9baa8d1c8ae31bae
Opcode Fuzzy Hash: 027bd08fc00f2a19e79c0817cec5c103b002b86706294bd2a107f5e965a18168
Instruction Fuzzy Hash: 99E04F76610215ABDB18DB81D919EFA7779EB80748F140158E90656580EAB1EE02DBA0

Function 0229C01F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd01efbafce56f6e3d6af4757e9415f0ba2d38a882a8429ac65b8de0dde329c8
Instruction ID: db2ad0eaf05c6aab53a0ad152de88511b2a470f36823fd56284e5e49fb2f5774
Opcode Fuzzy Hash: fd01efbafce56f6e3d6af4757e9415f0ba2d38a882a8429ac65b8de0dde329c8
Instruction Fuzzy Hash: 40E01237650154ABC7215F45D808F5ABB79EB88B61F158025F90597250C630ED11CBE0

Function 022B5129 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c20e6e4e53decef1996bd2ab8372aa0e39c600cabafc48d085c0d13906a37db
Instruction ID: 377dbda159f49faa8dd5b582eb7575ac46b3b97cc624f58297fc5ca1bca120bf
Opcode Fuzzy Hash: 9c20e6e4e53decef1996bd2ab8372aa0e39c600cabafc48d085c0d13906a37db
Instruction Fuzzy Hash: CBE06D36811A01DFC7324F46E908953BBF5FFC0B61319C92EE46A46A24C730D812CF50

Function 022A848F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f2078bbc8381385b386fbc6463990bda084c6bb1efa06929cc51e011a776b1
Instruction ID: 4018cadeabec09c7d2c49608e872f22a97946c1c5738dcc97b8f743c09548b0f
Opcode Fuzzy Hash: d0f2078bbc8381385b386fbc6463990bda084c6bb1efa06929cc51e011a776b1
Instruction Fuzzy Hash: A6E0DF72610209ABCB18DB81CD19EAAB779EB80758F100058E40656580EAB1AE02DBA0

Function 022BC571 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aae3a910afc1bd553cfac3e28f2475d05d658f0dc5cb5787adcaaff13f84bc6
Instruction ID: 44730831d7b615353c93ad51762455ddd35388a1f9d052253edf12e954c182e5
Opcode Fuzzy Hash: 9aae3a910afc1bd553cfac3e28f2475d05d658f0dc5cb5787adcaaff13f84bc6
Instruction Fuzzy Hash: 1CF0F871912102CFD715DF08D644B91FBB1FF89348F2981AAE5589F211D371EC82CB80

Function 0042073A Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9013bc2dc5da30abb62f1fc6261816ca78e32bb2a49c5c3f12029533e9db291
Instruction ID: cb5bb9cb53a10829c100f62cd8b2219444f1998ff8a9aff4de934b1ae18b4447
Opcode Fuzzy Hash: e9013bc2dc5da30abb62f1fc6261816ca78e32bb2a49c5c3f12029533e9db291
Instruction Fuzzy Hash: 3BE04F31100318AFCF417F10ED48A4A7BA9EB40745F404029F80556532CF39ED52CF58

Function 022AC6FB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf163cb4427abcb7cf1e28c2c535b2182b2ccb3bfc9805e171924cbf72d3aba
Instruction ID: c2a3ae4d671b07e61de5e50444f0d9b98c0c8205541f12abf455fbea2c114eb9
Opcode Fuzzy Hash: bcf163cb4427abcb7cf1e28c2c535b2182b2ccb3bfc9805e171924cbf72d3aba
Instruction Fuzzy Hash: 99D012331111247BC7259E8ADC44DD3BFADFF897A0B014055B51C875108530D810C7E0

Function 0229D4EF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdc058ce6f6884bde2799515048fbb555572899b6e21c9d0c7a00aa6b37b209
Instruction ID: 6e383217ca800bb9f62331e42236664fa0bb5207a89fdc2443e0312348d5b73a
Opcode Fuzzy Hash: 4fdc058ce6f6884bde2799515048fbb555572899b6e21c9d0c7a00aa6b37b209
Instruction Fuzzy Hash: 17E04F32451610AFCB315B85E808F93BBA8EB01765F148425E50956460C775A910DF90

Function 022942FF Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc24893aace988a35ecd73e246208930ec6445dd99927539e494dc6e981f5bc
Instruction ID: cebb28a1d65a83e083f05adbebdde07a25a32051c6a47f8fdaea75893e1d3351
Opcode Fuzzy Hash: 5dc24893aace988a35ecd73e246208930ec6445dd99927539e494dc6e981f5bc
Instruction Fuzzy Hash: FBD02E32280298A7CB342E88B808F82BFA8DB00790F240025FA0487250CAB0A800C3D8

Function 0229D52F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c954125d07a6c40e8a07cd747802c0c19018b7384788b34aeae02da9c1f8ea1
Instruction ID: d26982dae26a18a38907349bd0fd4d7e171fecec801ce7d8fa22cff12f4b4bbc
Opcode Fuzzy Hash: 6c954125d07a6c40e8a07cd747802c0c19018b7384788b34aeae02da9c1f8ea1
Instruction Fuzzy Hash: DCD0A73123028A9BCF22EA9DC444F6177D8A74466CF0C8020F85E87104C334F840EB10

Function 0226B399 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ffbbf828355356ec812804d5d7b2285c9a68d8aa31d6f31d95f5308b5c41d53
Instruction ID: 0866291b27594e35fcde5c7c9a51ab8ab4515e476a97ba91bc0f71b48c70950d
Opcode Fuzzy Hash: 9ffbbf828355356ec812804d5d7b2285c9a68d8aa31d6f31d95f5308b5c41d53
Instruction Fuzzy Hash: 55C01232761980CADF116F60C90C72133E4E71064AF084474A001D506CDB24C4E1E600

Function 022650BF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3696ecc806c3e3492e4c484b1b8272d99a7f0668c5875144a6339bb6c492ad9
Instruction ID: 33df3621f03aa92469ab77afaf885f6d1b311973975121a4496c8fcc854d21f2
Opcode Fuzzy Hash: d3696ecc806c3e3492e4c484b1b8272d99a7f0668c5875144a6339bb6c492ad9
Instruction Fuzzy Hash: 2DD01232080648EBC7265F84DA0CFA57B7AE754754F644020F608069B0C775D9B0DAD4

Function 0229C195 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accb1398fa82048500a73bef355ca69f696f10a3652e08853513937dfc3a3bca
Instruction ID: 78844dd991f5fbe98812123dfceb7bb4607e2c54b55449aeba399ea5317e0a24
Opcode Fuzzy Hash: accb1398fa82048500a73bef355ca69f696f10a3652e08853513937dfc3a3bca
Instruction Fuzzy Hash: D8D0C931C51516DBCF219BD9C648B6AB675AB18745F40402AE4056113883384540CEA4

Function 022A9395 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4458151098.000000000225B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0225B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_225b000_Wk6IMAhBNF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b75edf13c842dce617d8efc78d166287f646fa710b9c812e04274ea1a54e40c
Instruction ID: 31d0f837eaac6acf62bbb5977ec469666e220166c6520c7b34f2feffbaa9c8ee
Opcode Fuzzy Hash: 7b75edf13c842dce617d8efc78d166287f646fa710b9c812e04274ea1a54e40c
Instruction Fuzzy Hash: 78C01232891440ABCF22AF86EE4CE167A3AEB85B89F1404A8A001825318B3189A2DA10

Function 0588B527 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 161registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002,?), ref: 0588B557
RegDeleteValueW.ADVAPI32(?,IpDate), ref: 0588B567
RegSetValueExW.ADVAPI32(?,IpDate,00000000,00000003,00000002,?), ref: 0588B584
_memset.LIBCMT ref: 0588B5A5
RegCloseKey.ADVAPI32(?), ref: 0588B5EC
_memset.LIBCMT ref: 0588B60D
RegCloseKey.ADVAPI32(?), ref: 0588B6FD
Sleep.KERNEL32(000007D0), ref: 0588B708

Part of subcall function 0588F5F7: std::exception::exception.LIBCMT ref: 0588F646
Part of subcall function 0588F5F7: std::exception::exception.LIBCMT ref: 0588F660
Part of subcall function 0588F5F7: __CxxThrowException@8.LIBCMT ref: 0588F671

Strings

t1:, xrefs: 0588B678
t2:, xrefs: 0588B6B1
p1:, xrefs: 0588B654
103.199.100.97, xrefs: 0588B64F
8282, xrefs: 0588B6D0
o1:, xrefs: 0588B666
103.199.100.130, xrefs: 0588B685
8080, xrefs: 0588B661
IpDate, xrefs: 0588B561, 0588B57E
t3:, xrefs: 0588B6EA
Console, xrefs: 0588B54D
o3:, xrefs: 0588B6D5
8181, xrefs: 0588B69A
p3:, xrefs: 0588B6C3
p2:, xrefs: 0588B68A
o2:, xrefs: 0588B69F
199.100.130, xrefs: 0588B6BE

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseValue_memsetstd::exception::exception$DeleteException@8OpenSleepThrow_malloc
String ID: 103.199.100.130$103.199.100.97$199.100.130$8080$8181$8282$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1186799303-2765218603
Opcode ID: 500b9f21a55a849ec96fe06a718f397c9035eb14ba294970725d7c0b1ea7eb32
Instruction ID: c0bce099eb75c3d7cf1cc895fe50a80aa87f668a3f747aad2c8f90eeab9edaca
Opcode Fuzzy Hash: 500b9f21a55a849ec96fe06a718f397c9035eb14ba294970725d7c0b1ea7eb32
Instruction Fuzzy Hash: C941B876780300BBF610B6149C8BF6B7394DF54B10F144424FE05FA382EAB9BD5596A7

Function 05893F02 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893F0A
__mtterm.LIBCMT ref: 05893F16

Part of subcall function 05893BE1: DecodePointer.KERNEL32(0000000C,05890F74,05890F5A,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893BF2
Part of subcall function 05893BE1: TlsFree.KERNEL32(00000021,05890F74,05890F5A,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893C0C
Part of subcall function 05893BE1: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,05890F74,05890F5A,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05898C38
Part of subcall function 05893BE1: _free.LIBCMT ref: 05898C3B
Part of subcall function 05893BE1: DeleteCriticalSection.KERNEL32(00000021,?,?,05890F74,05890F5A,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05898C62

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 05893F2C
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 05893F39
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 05893F46
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 05893F53
TlsAlloc.KERNEL32(?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893FA3
TlsSetValue.KERNEL32(00000000,?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893FBE
__init_pointers.LIBCMT ref: 05893FC8
EncodePointer.KERNEL32(?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893FD9
EncodePointer.KERNEL32(?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893FE6
EncodePointer.KERNEL32(?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05893FF3
EncodePointer.KERNEL32(?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05894000
DecodePointer.KERNEL32(Function_00013D65,?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05894021
__calloc_crt.LIBCMT ref: 05894036
DecodePointer.KERNEL32(00000000,?,?,05890EB1,058A6168,00000008,05891045,?,?,?,058A6188,0000000C,05891100,?), ref: 05894050
GetCurrentThreadId.KERNEL32 ref: 05894062

Strings

FlsGetValue, xrefs: 05893F2E
FlsSetValue, xrefs: 05893F3B
FlsFree, xrefs: 05893F48
KERNEL32.DLL, xrefs: 05893F05
FlsAlloc, xrefs: 05893F26

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 2b8a0ffd8104d604c426dbaebca02f6dd650fc81444960e88834ec395b607eb2
Instruction ID: 12854ef60e4500acfd1835d2e28cb10351f8794b3997a8efe4e660f1968a787e
Opcode Fuzzy Hash: 2b8a0ffd8104d604c426dbaebca02f6dd650fc81444960e88834ec395b607eb2
Instruction Fuzzy Hash: 79316C31929700DEFF64AF79AC0EA167FA8FB44260B18051AFC11E2690EF34BA45CF51

Function 0588C300 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588C322
_wcsrchr.LIBCMT ref: 0588C32A
_memset.LIBCMT ref: 0588C361
_wcsrchr.LIBCMT ref: 0588C369
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0588C376
_memset.LIBCMT ref: 0588C3E4
wsprintfW.USER32 ref: 0588C3FC
_memset.LIBCMT ref: 0588C410
_memset.LIBCMT ref: 0588C42B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 0588C461
lstrcatW.KERNEL32(?,058A524C), ref: 0588C4A9
lstrcatW.KERNEL32(?,?), ref: 0588C4B3
_memset.LIBCMT ref: 0588C4CA

Strings

WinSta0\Default, xrefs: 0588C4E2
%s\shell\open\command, xrefs: 0588C3F6
"%1, xrefs: 0588C46D
D, xrefs: 0588C4D6

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 3a2b62c7a28aa0122245211e0ba7e50370d5af8eec3c41ce688c0b47261c1fd2
Instruction ID: 19f9d181840a916521f2067266a65f82762804b61374c5fe5afe72dedf9936b2
Opcode Fuzzy Hash: 3a2b62c7a28aa0122245211e0ba7e50370d5af8eec3c41ce688c0b47261c1fd2
Instruction Fuzzy Hash: 0F51CB71A4031D66DB34FB649D49FFE7778EF54700F004095BE0AD9184EA74AE85CB62

Function 05887C70 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 05887CB3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 05887CC7
FreeLibrary.KERNEL32(00000000), ref: 05887CE7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 05887D06
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 05887D43
_memset.LIBCMT ref: 05887D6E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 05887D7C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 05887DCB
CloseHandle.KERNEL32(?), ref: 05887DE9
Sleep.KERNEL32(00000001), ref: 05887DF1
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 05887DFD
FreeLibrary.KERNEL32(00000000), ref: 05887E18

Strings

InternetOpenW, xrefs: 05887CC1
InternetReadFile, xrefs: 05887D76
wininet.dll, xrefs: 05887C96
InternetOpenUrlW, xrefs: 05887D00
InternetCloseHandle, xrefs: 05887DF7
MSIE 6.0, xrefs: 05887CD1

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 935e6d09028838c8df65ec9f1c9ad5f59307a011fa2c0b40d68245c2282767f3
Instruction ID: 26821639ff0d5289f40faa3db8bbdb82543d1a3d0b31a2869175efd62fd4cbdf
Opcode Fuzzy Hash: 935e6d09028838c8df65ec9f1c9ad5f59307a011fa2c0b40d68245c2282767f3
Instruction Fuzzy Hash: 06417475A40218AAEB30AB648C41FEAB7F9FF44700F10C1A5FA49E6180DE746E858F95

Function 05884530 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0588455A
timeGetTime.WINMM ref: 0588457B
GetCurrentThreadId.KERNEL32 ref: 0588459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 058845BD
SwitchToThread.KERNEL32 ref: 058845D7
SetEvent.KERNEL32(?), ref: 05884620
CloseHandle.KERNEL32(?), ref: 05884644
send.WS2_32(?,058A49C0,00000010,00000000), ref: 05884668
SetEvent.KERNEL32(?), ref: 05884686
InterlockedExchange.KERNEL32(?,00000000), ref: 05884691
WSACloseEvent.WS2_32(?), ref: 0588469F
shutdown.WS2_32(?,00000001), ref: 058846B3
closesocket.WS2_32(?), ref: 058846BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 058846F6
SetLastError.KERNEL32(000005B4), ref: 0588470A
GetCurrentThreadId.KERNEL32 ref: 0588472B
InterlockedExchange.KERNEL32(?,00000001), ref: 05884743

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: 23bc4f3d45f3f7eeae67516ba84b6a4f4c7ba656ac66e9cc851164cf5eb7fc7c
Instruction ID: 264590c315ab9735bc0815715cc06d2c115069d6fd83e082ed24d2ffc7e74e01
Opcode Fuzzy Hash: 23bc4f3d45f3f7eeae67516ba84b6a4f4c7ba656ac66e9cc851164cf5eb7fc7c
Instruction Fuzzy Hash: BD91BF76600B16ABDB24EF24D888B7ABBA5FF44709F108119ED16C7A60DB71FC51CB90

Function 0588A6E0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588A738
_memset.LIBCMT ref: 0588A778
_memset.LIBCMT ref: 0588A7FE
swprintf.LIBCMT ref: 0588A81D

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

_memset.LIBCMT ref: 0588A8F5
swprintf.LIBCMT ref: 0588A914
_memset.LIBCMT ref: 0588A976
swprintf.LIBCMT ref: 0588A995

Strings

onlyloadinmyself, xrefs: 0588A70C
vghaisfu, xrefs: 0588A74B
%s %s, xrefs: 0588A80C, 0588A880, 0588A903, 0588A984

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$vghaisfu
API String ID: 1873853019-2470852376
Opcode ID: 03ae2f575a9785b68a8663eec066c023e57f5708cca866e9d86c494a579ee2ed
Instruction ID: ea52656c0da991983d3aff5d397f00ae905b13870d63c0990dd25d4918d75c89
Opcode Fuzzy Hash: 03ae2f575a9785b68a8663eec066c023e57f5708cca866e9d86c494a579ee2ed
Instruction Fuzzy Hash: 2981A0B6A40300ABEB14BF18DC8AF7B77A4EF45710F184164ED199F386E671ED50C6A2

Function 05885C90 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 05885CA3

Strings

Sniff, xrefs: 05885E19
TaskExplorer, xrefs: 05885D2F
TCPEye, xrefs: 05885D19
Wireshark, xrefs: 05885D87
Metascan, xrefs: 05885D71
CurrPorts, xrefs: 05885D45
Process, xrefs: 05885E3D
Port, xrefs: 05885D5B
Capsa, xrefs: 05885E07, 05885E2B
Malwarebytes, xrefs: 05885D03
ApateDNS, xrefs: 05885CED
Fiddler, xrefs: 05885DDF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: f4017baa5e3563853ab833be729ed3d9d3b5a79dd3f2dec14db4bb7860ba1311
Instruction ID: 256c9997fa4a83b5a1b1a42f5c497ffa806335d882b6500507bb7c7a82944aff
Opcode Fuzzy Hash: f4017baa5e3563853ab833be729ed3d9d3b5a79dd3f2dec14db4bb7860ba1311
Instruction Fuzzy Hash: 18414973F5172272EE713D752D06E7F218EED2288AF444024ED44E4304FAE9EE5694A7

Function 0040D868 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D872

Part of subcall function 0040EF6C: char_traits.LIBCPMT ref: 0040EF85

Part of subcall function 004112D6: __EH_prolog3_catch.LIBCMT ref: 004112DD

Strings

cmdvrt32.dll, xrefs: 0040D948
dir_watch.dll, xrefs: 0040D8ED
pstorec.dll, xrefs: 0040D901
wpespy.dll, xrefs: 0040D926
avghooka.dll, xrefs: 0040D891
api_log.dll, xrefs: 0040D8D9
dbghelp.dll, xrefs: 0040D8C5
cmdvrt64.dll, xrefs: 0040D937
vmcheck.dll, xrefs: 0040D915
avghookx.dll, xrefs: 0040D877
snxhk.dll, xrefs: 0040D8A4
sbiedll.dll, xrefs: 0040D8B1

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_H_prolog3_catchchar_traits
String ID: api_log.dll$avghooka.dll$avghookx.dll$cmdvrt32.dll$cmdvrt64.dll$dbghelp.dll$dir_watch.dll$pstorec.dll$sbiedll.dll$snxhk.dll$vmcheck.dll$wpespy.dll
API String ID: 3519943210-1599972391
Opcode ID: 87d95891234aec1c450919338791a7ebca6054b5fd8461353f5962cfad72156a
Instruction ID: c65811b8fbe313e87d221b774cad1bdaa4a197a702579701ec1d69c0e0ecbe6d
Opcode Fuzzy Hash: 87d95891234aec1c450919338791a7ebca6054b5fd8461353f5962cfad72156a
Instruction Fuzzy Hash: 11413D70904398EBDF11EBA5C955BDDBB70AF19704F5044EEA08A731C2DBB81B48CB69

Function 00421DC1 Relevance: 21.3, APIs: 14, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00421E31
_free.LIBCMT ref: 00421E47
_free.LIBCMT ref: 00421E58
_free.LIBCMT ref: 00421E69
_free.LIBCMT ref: 00421E80

Part of subcall function 00429C02: _free.LIBCMT ref: 00429C6D

_free.LIBCMT ref: 00422074
_free.LIBCMT ref: 00422087
_free.LIBCMT ref: 00422095
_free.LIBCMT ref: 004220A0
_free.LIBCMT ref: 004220E2
_free.LIBCMT ref: 004220EA
_free.LIBCMT ref: 004220F2
_free.LIBCMT ref: 004220FA
_free.LIBCMT ref: 00422108

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 519965a2360e167d39b1a4d15452e994910e42678d7a62e64eef679e6030d87c
Instruction ID: 85a9c9966b4c535f1b878223c3f7d77a8cc78eb428a97881d296d05b4db25939
Opcode Fuzzy Hash: 519965a2360e167d39b1a4d15452e994910e42678d7a62e64eef679e6030d87c
Instruction Fuzzy Hash: 6CB1CFB0A00255AEDB10DF69D881BEEB7F4FF08304F94402EF595A7252DBB99D81CB64

Function 0588D970 Relevance: 21.3, APIs: 14, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,0588A8B1,?,?), ref: 0588D983
SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,0588A8B1,?,?), ref: 0588D9A2

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f0ea86b865a8df4a11bcc1133bff41a7392d8dbd6de8bebccaa880d7b04194b6
Instruction ID: fec933dce19632b77a37e92cc6f3845e283923ab1b5cf73f6ade4a4c8375a84f
Opcode Fuzzy Hash: f0ea86b865a8df4a11bcc1133bff41a7392d8dbd6de8bebccaa880d7b04194b6
Instruction Fuzzy Hash: E381D3757066019BE720EF69DC85BB6B7E4FB44325F144169ED0AC7A80EB71EC008BD0

Function 0588C540 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588C59D
_memset.LIBCMT ref: 0588C5AC
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 0588C5CF

Part of subcall function 0588C77E: RegCloseKey.ADVAPI32(80000000,0588C75A), ref: 0588C78B
Part of subcall function 0588C77E: RegCloseKey.ADVAPI32(00000000), ref: 0588C794

Strings

%08X, xrefs: 0588C735

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: 07ddea25c29a6dec98eb8481e4e1092f0976e0c6f424f4cf94528d31d75c85e3
Instruction ID: 05c01bd2a8e87c70ab1f66775c94e1867afc965b35a75fe2c6897d45e5fd5102
Opcode Fuzzy Hash: 07ddea25c29a6dec98eb8481e4e1092f0976e0c6f424f4cf94528d31d75c85e3
Instruction Fuzzy Hash: 3D5155B5A40218ABEB24EF94CC85FEAB778EB44714F404199FB06EA180E7746F44CF64

Function 058836F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 05883710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 05883749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 05883766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 05883779
WSACreateEvent.WS2_32 ref: 0588377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,058B1F4C), ref: 0588378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,058B1F4C), ref: 05883799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,058B1F4C), ref: 058837B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,058B1F4C), ref: 058837C4
gethostbyname.WS2_32(00000000), ref: 058837D2
htons.WS2_32(?), ref: 058837F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 05883816
connect.WS2_32(?,?,00000010), ref: 0588382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,058B1F4C), ref: 0588383A

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 419403193ca9d9b15d8a6af91cf48282084edbd66c54e494007975077ddc6b23
Instruction ID: 5249fafc0b4a962a299949e0794a7380fb2257320936a95fc04f712c616bf214
Opcode Fuzzy Hash: 419403193ca9d9b15d8a6af91cf48282084edbd66c54e494007975077ddc6b23
Instruction Fuzzy Hash: A3414075A40305ABE724EBA4DC4AF7FBB78FB49B10F104519FA16D62D0CA74A904CB61

Function 0042EE3D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042EE76
___free_lconv_mon.LIBCMT ref: 0042EE81

Part of subcall function 0042E196: _free.LIBCMT ref: 0042E1B3
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E1C5
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E1D7
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E1E9
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E1FB
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E20D
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E21F
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E231
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E243
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E255
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E267
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E279
Part of subcall function 0042E196: _free.LIBCMT ref: 0042E28B

_free.LIBCMT ref: 0042EE98
_free.LIBCMT ref: 0042EEAD
_free.LIBCMT ref: 0042EEB8
_free.LIBCMT ref: 0042EEDA
_free.LIBCMT ref: 0042EEED
_free.LIBCMT ref: 0042EEFB
_free.LIBCMT ref: 0042EF06
_free.LIBCMT ref: 0042EF3E
_free.LIBCMT ref: 0042EF45
_free.LIBCMT ref: 0042EF62
_free.LIBCMT ref: 0042EF7A

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 8f371fca843b0bf36adb099c4784a828dbd236780fcd241ea61f3abb2b7ae775
Instruction ID: cb8f79120a6ede87015045d5a425552af29a58626d35bd12cd34f511ec8a07e3
Opcode Fuzzy Hash: 8f371fca843b0bf36adb099c4784a828dbd236780fcd241ea61f3abb2b7ae775
Instruction Fuzzy Hash: 4C3141B1700350AFEB20AE2AE845B57B3E5AB01315F95841FE49897261DB7CED80CA18

Function 0588AA00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 187sleeptimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,A97BC7BB), ref: 0588AA48
wsprintfW.USER32 ref: 0588AA7F
_memset.LIBCMT ref: 0588AA97
_memset.LIBCMT ref: 0588AAAA

Part of subcall function 05888010: lstrlenW.KERNEL32(?), ref: 05888028
Part of subcall function 05888010: _memset.LIBCMT ref: 05888032
Part of subcall function 05888010: lstrlenW.KERNEL32(?), ref: 0588803B
Part of subcall function 05888010: lstrlenW.KERNEL32(?), ref: 05888046

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0588ABAE
Sleep.KERNEL32(000003E8,?,?,?,00000208,?), ref: 0588AC4E
CloseHandle.KERNEL32(?), ref: 0588AC8A

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

Part of subcall function 05889720: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,A97BC7BB,?,?,?,?,?,058A114B,000000FF), ref: 05889763
Part of subcall function 05889720: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 05889802
Part of subcall function 05889720: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 05889840

Strings

t1:, xrefs: 0588AAE3
p1:, xrefs: 0588AABE
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0588AA79
o1:, xrefs: 0588AAD2

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateEvent_memsetlstrlen$CloseCountCriticalHandleInitializeLocalSectionSleepSpinTime_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 1254190970-1225219777
Opcode ID: 3972bb87f3c093d83821aee1310634904e5fb0879b676effce32662d028c69f9
Instruction ID: 98b9178786b9402f0bf66d14b927f08a18c2b37e516f380c77e522c2e00e9097
Opcode Fuzzy Hash: 3972bb87f3c093d83821aee1310634904e5fb0879b676effce32662d028c69f9
Instruction Fuzzy Hash: 406197B16483409BD764EF58D884E7BB7E9FB84624F144A1DF985D3280EB349D44CBA3

Function 0042E294 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E2DC
_free.LIBCMT ref: 0042E300
_free.LIBCMT ref: 0042E30D
_free.LIBCMT ref: 0042E332
_free.LIBCMT ref: 0042E33F
_free.LIBCMT ref: 0042E348
_free.LIBCMT ref: 0042E626
_free.LIBCMT ref: 0042E62E

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dac70c105ff36dc783e8eb05b6b3df954bdbdb6bca337183bbca689b2de2930b
Instruction ID: 0090a4e704ed15db785539d2103784ec2229ca23dff625ba350247f3575c270b
Opcode Fuzzy Hash: dac70c105ff36dc783e8eb05b6b3df954bdbdb6bca337183bbca689b2de2930b
Instruction Fuzzy Hash: 4BC167B1E40214BBDB20DFA9DC43FEEB7F8AB08704F544156FA44EB286D6789D418B58

Function 05884CB0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,A97BC7BB,?,?,?,?,00000000,000000FF,00000000), ref: 05884CE6
EnterCriticalSection.KERNEL32(?,A97BC7BB,?,?,?,?,00000000,000000FF,00000000), ref: 05884D0D
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 05884D21
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 05884D28

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 8e230c43b62d860ea71be8e87971f519f471ad2f8f8c9f4b955285f3442cb855
Instruction ID: b608d545623fc8b2a5ddfbd27b2561773b5876741297d438d98f21bbbddc2245
Opcode Fuzzy Hash: 8e230c43b62d860ea71be8e87971f519f471ad2f8f8c9f4b955285f3442cb855
Instruction Fuzzy Hash: 75517076A047059FD724EF68E885A7AFBF5FB48714F00456AED1AC3740EB75A800CB51

Function 0040D4B8 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0040D4C2

Strings

TEQUILABOOMBOOM, xrefs: 0040D581
JOHN-PC, xrefs: 0040D537
7SILVIA, xrefs: 0040D50F
HANSPETER-PC, xrefs: 0040D523
WIN7 - TRAPS, xrefs: 0040D55F
FORTINET, xrefs: 0040D570
SANDBOX, xrefs: 0040D4FF
MUELLER-PC, xrefs: 0040D54B

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: 7SILVIA$FORTINET$HANSPETER-PC$JOHN-PC$MUELLER-PC$SANDBOX$TEQUILABOOMBOOM$WIN7 - TRAPS
API String ID: 2427045233-2697073198
Opcode ID: 725bbe342772eaf87ee426c4a3c78ed60597651c9dea9c8898a7b826662b1395
Instruction ID: f60bb209392c5bf1e69ba4c2b352cb79f307e000ff5ad9428393b5fdc34ee7b8
Opcode Fuzzy Hash: 725bbe342772eaf87ee426c4a3c78ed60597651c9dea9c8898a7b826662b1395
Instruction Fuzzy Hash: 83411D70D00269EADF21EBA5CD81BDDB734AB24304F5040BEA549772C2DAB81F8DDB59

Function 0588E620 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588E641
GetForegroundWindow.USER32(?,759223A0,00000000), ref: 0588E649
GetWindowTextW.USER32(00000000,058B1730,00000800), ref: 0588E65F
_memset.LIBCMT ref: 0588E67D
lstrlenW.KERNEL32(058B1730,?,?,?,?,759223A0,00000000), ref: 0588E69C
GetLocalTime.KERNEL32(?,?,?,?,?,759223A0,00000000), ref: 0588E6AD
wsprintfW.USER32 ref: 0588E6F4

Part of subcall function 0588E5A0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,0588E705,?,?,?,?,759223A0,00000000), ref: 0588E5AD
Part of subcall function 0588E5A0: CreateFileW.KERNEL32(058B0DC0,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0588E705,?,?,?,?,759223A0,00000000), ref: 0588E5C7
Part of subcall function 0588E5A0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0588E5E2
Part of subcall function 0588E5A0: lstrlenW.KERNEL32(?,00000000,00000000), ref: 0588E5EF
Part of subcall function 0588E5A0: WriteFile.KERNEL32(00000000,?,00000000), ref: 0588E5FA
Part of subcall function 0588E5A0: CloseHandle.KERNEL32(00000000), ref: 0588E601
Part of subcall function 0588E5A0: ReleaseMutex.KERNEL32(?), ref: 0588E60E

_memset.LIBCMT ref: 0588E710

Strings

[, xrefs: 0588E6EE

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: 4bc28d35950484581dddfdc03751d1cbd816813d7781901b8f0bb07fa2301bab
Instruction ID: d5c9296e56e1e9312907e05f5f46a78d66278dcda39c52bd8ad54fe20d965972
Opcode Fuzzy Hash: 4bc28d35950484581dddfdc03751d1cbd816813d7781901b8f0bb07fa2301bab
Instruction Fuzzy Hash: F721D635A50228A6EB649B55AC0AABA77FCFF04700F00C0A5FD85D6244EE746D85CBE4

Function 0588C7C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 54registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 0588C7DA
RegDeleteValueW.ADVAPI32(?), ref: 0588C7E5
RegCloseKey.ADVAPI32(?), ref: 0588C7F5
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 0588C805
lstrlenW.KERNEL32(?), ref: 0588C810
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0588C823
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0588C831
RegCloseKey.ADVAPI32(?), ref: 0588C83D

Strings

AppEvents, xrefs: 0588C7D0, 0588C7FB

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents
API String ID: 3935456190-2318512526
Opcode ID: a8bad435642dcdd184d2993ca9f381d6583af68a5f3db0e2a3b6222e23d49016
Instruction ID: d99fb6578675a04965906805675b9b129557266c2972305030c8748f1673b581
Opcode Fuzzy Hash: a8bad435642dcdd184d2993ca9f381d6583af68a5f3db0e2a3b6222e23d49016
Instruction Fuzzy Hash: 8C01167E240208BBF724DF61EC85FAA3B6CEB88755F108015FF06DA140D975E940D6B0

Function 00415F80 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00415F87
std::_Lockit::_Lockit.LIBCPMT ref: 00415F91
int.LIBCPMT ref: 00415FA8

Part of subcall function 00409F91: std::_Lockit::_Lockit.LIBCPMT ref: 00409FA2
Part of subcall function 00409F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00409FBC

std::locale::_Getfacet.LIBCPMT ref: 00415FB1
codecvt.LIBCPMT ref: 00415FCB
__CxxThrowException@8.LIBVCRUNTIME ref: 00415FE8
std::_Facet_Register.LIBCPMT ref: 00416007
std::_Lockit::~_Lockit.LIBCPMT ref: 00416010

Strings

HD, xrefs: 00415F9C

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID: HD
API String ID: 1243920060-3462748586
Opcode ID: 895c1df924cb8d203cf8e16657d913a4ab57163a8dab723c667b364d3dcf79ef
Instruction ID: 30aecd94fbda12706c240dcf222d8b9d8810c402beabbd326e2a9f87a0632e5a
Opcode Fuzzy Hash: 895c1df924cb8d203cf8e16657d913a4ab57163a8dab723c667b364d3dcf79ef
Instruction Fuzzy Hash: A601AD369012159BCF01EBA1C8429EEB725AF94328F15442FF5016B3D2DF3C9D8687A9

Function 05883DE0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0588398D,?,00000000,000000FF,00000000), ref: 05883E05
LeaveCriticalSection.KERNEL32(?,?,?,0588398D,?,00000000,000000FF,00000000), ref: 05883E50
send.WS2_32(?,000000FF,00000000,00000000), ref: 05883E6E
EnterCriticalSection.KERNEL32(?), ref: 05883E81
LeaveCriticalSection.KERNEL32(?), ref: 05883E94
HeapFree.KERNEL32(00000000,00000000,?,?,?,0588398D,?,00000000,000000FF,00000000), ref: 05883EBC
WSAGetLastError.WS2_32(?,?,0588398D,?,00000000,000000FF,00000000), ref: 05883EC7
EnterCriticalSection.KERNEL32(?,?,?,0588398D,?,00000000,000000FF,00000000), ref: 05883EDB
LeaveCriticalSection.KERNEL32(?), ref: 05883F14
HeapFree.KERNEL32(00000000,00000000,?), ref: 05883F51

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: d5ebe11751830feecfa464cf5d14372ba9da5acbc34a46d55774fcea151ee078
Instruction ID: 4dff1fb15760cc0cb519cce8d22a9cf316acf7800c016e165c0d762fa9d67397
Opcode Fuzzy Hash: d5ebe11751830feecfa464cf5d14372ba9da5acbc34a46d55774fcea151ee078
Instruction Fuzzy Hash: 4C4116711146059FD725EF78D988AB7BBF9FB49704F04896DECABCB640EB31A8018B50

Function 05884F30 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 05884F63
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 05884F78
WSASetLastError.WS2_32(00002746), ref: 05884F8A
LeaveCriticalSection.KERNEL32(000002FF), ref: 05884F91
timeGetTime.WINMM ref: 05884FBF
timeGetTime.WINMM ref: 05884FE7
SetEvent.KERNEL32(?), ref: 05885025
InterlockedExchange.KERNEL32(?,00000001), ref: 05885031
LeaveCriticalSection.KERNEL32(000002FF), ref: 05885038
LeaveCriticalSection.KERNEL32(000002FF), ref: 0588504B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 2ce299feddd2f13131cf01df8e3d1d37130ef65f4ed18ae5a41213dbcabe9163
Instruction ID: e31f2c4dc9777964b9bf5a7c487ff4c401168a1342f2cd7798bc122fee59fc52
Opcode Fuzzy Hash: 2ce299feddd2f13131cf01df8e3d1d37130ef65f4ed18ae5a41213dbcabe9163
Instruction Fuzzy Hash: 76419F366003019BDB30EF69D589A7ABBEAFB48318F044559FC4AC7661E776F8408B41

Function 00426BA0 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426BB4
_free.LIBCMT ref: 00426BC0
_free.LIBCMT ref: 00426BCB
_free.LIBCMT ref: 00426BD6
_free.LIBCMT ref: 00426BE1
_free.LIBCMT ref: 00426BEC
_free.LIBCMT ref: 00426BF7
_free.LIBCMT ref: 00426C02
_free.LIBCMT ref: 00426C0D
_free.LIBCMT ref: 00426C1B

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fcce47e6c2633b22a26bdfd258381b2dec84be11aa8873df8edacff61b6cef23
Instruction ID: 2955eaffdebe4c06cf4c4278f6dc04da52b49691b7deee40e3442a6d672c9279
Opcode Fuzzy Hash: fcce47e6c2633b22a26bdfd258381b2dec84be11aa8873df8edacff61b6cef23
Instruction Fuzzy Hash: 041137B6250098BFCB01EF55E842CC87B75FF05345B8180AAB9888F232D679EB819F44

Function 0588C1D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0588C20E
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0588C22C
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0588C269
CloseHandle.KERNEL32(00000000), ref: 0588C274
lstrlenW.KERNEL32(?), ref: 0588C281
wsprintfW.USER32 ref: 0588C2A5

Strings

%s %s, xrefs: 0588C29F

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: 491f8d1e8fcae46e6a881818a60ec97e97774d41b03b64c6e7a58568d840e87f
Instruction ID: 6cd110d9c4d032872f43f36a981e36e4559dac5f72b984ef11f2e494f44667a6
Opcode Fuzzy Hash: 491f8d1e8fcae46e6a881818a60ec97e97774d41b03b64c6e7a58568d840e87f
Instruction Fuzzy Hash: 49317676650218ABDB24EAA4DC45FFF7768FB44311F400199BE06EB1C0EB746E44CBA1

Function 0588C8C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0588C8CD
_wcsrchr.LIBCMT ref: 0588C907

Part of subcall function 05887C70: LoadLibraryW.KERNEL32(wininet.dll), ref: 05887CB3
Part of subcall function 05887C70: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 05887CC7
Part of subcall function 05887C70: FreeLibrary.KERNEL32(00000000), ref: 05887CE7

GetFileAttributesW.KERNEL32(-00000002), ref: 0588C926
GetLastError.KERNEL32 ref: 0588C931
_memset.LIBCMT ref: 0588C944
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0588C971

Strings

WinSta0\Default, xrefs: 0588C96A
D, xrefs: 0588C963

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 174883095-1101385590
Opcode ID: c34276700380d6da9562b6dac649f5438da2b1448a5d8d8c1e9eb9eabf2ab4fe
Instruction ID: 60c49869e539bf0a918276120851342dd367b466a882dc31f7ac6843950b5ab2
Opcode Fuzzy Hash: c34276700380d6da9562b6dac649f5438da2b1448a5d8d8c1e9eb9eabf2ab4fe
Instruction Fuzzy Hash: 7A112BB7A0020867D734B6B9AC4AFBFB76DEB41210F040125FE17DA184EA659D05C6B3

Function 05888149 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,A:\), ref: 05888156
lstrcmpiW.KERNEL32(?,B:\), ref: 05888166
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 05888196
lstrlenW.KERNEL32(?), ref: 058881A7
__wcsnicmp.LIBCMT ref: 058881BE
lstrcpyW.KERNEL32(00000AD4,?), ref: 058881F4
lstrcpyW.KERNEL32(?,?), ref: 05888218
lstrcatW.KERNEL32(?,00000000), ref: 05888223

Strings

A:\, xrefs: 05888150
B:\, xrefs: 05888160

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceQuery__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 4249875308-1009255891
Opcode ID: 89923b5c522cc538b3ec23344b72fb45b410911d7e15b36c3be5204eef08f871
Instruction ID: ed94c57f03f05fe1bc4744398c08097880009fa1c209479e459bb7ccacc6da46
Opcode Fuzzy Hash: 89923b5c522cc538b3ec23344b72fb45b410911d7e15b36c3be5204eef08f871
Instruction Fuzzy Hash: F6118176A112149BEB20AF90DD45BFE77B8FF44210F004498EE0AE3240EB74AE05CF95

Function 00411539 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00411540
std::_Lockit::_Lockit.LIBCPMT ref: 0041154B
int.LIBCPMT ref: 00411561

Part of subcall function 00409F91: std::_Lockit::_Lockit.LIBCPMT ref: 00409FA2
Part of subcall function 00409F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00409FBC

std::locale::_Getfacet.LIBCPMT ref: 0041156A
__CxxThrowException@8.LIBVCRUNTIME ref: 004115AA
std::_Facet_Register.LIBCPMT ref: 004115C0
std::_Lockit::~_Lockit.LIBCPMT ref: 004115C9

Strings

PD, xrefs: 00411553

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID: PD
API String ID: 4117319562-2666890729
Opcode ID: 240954931e8c36f415d957216b93595e0f6b470668068cfae6af462cfcd576df
Instruction ID: df62828fbb429f39836a6794fa8ce971b0747cfb1cd423ed48cfa1bc72d7b6fd
Opcode Fuzzy Hash: 240954931e8c36f415d957216b93595e0f6b470668068cfae6af462cfcd576df
Instruction Fuzzy Hash: 13118E72D002199BCB01EFA5C8419EE77A5BF48314B10452FF511A73A1DB7C9A448B9D

Function 00410723 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0041072A
std::_Lockit::_Lockit.LIBCPMT ref: 00410735
int.LIBCPMT ref: 0041074B

Part of subcall function 00409F91: std::_Lockit::_Lockit.LIBCPMT ref: 00409FA2
Part of subcall function 00409F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00409FBC

std::locale::_Getfacet.LIBCPMT ref: 00410754
__CxxThrowException@8.LIBVCRUNTIME ref: 00410794
std::_Facet_Register.LIBCPMT ref: 004107AA
std::_Lockit::~_Lockit.LIBCPMT ref: 004107B3

Strings

TD, xrefs: 0041073D

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID: TD
API String ID: 4117319562-1802838825
Opcode ID: 8cf9db64d6f4e9fbc5e78ba9d8bee6e9b9eec8aa38a68843baf7ca7834e52910
Instruction ID: 6bd4a988e6b3405ff7bc35336011987ca5bb8b0170667c911e43f7e53bb70c08
Opcode Fuzzy Hash: 8cf9db64d6f4e9fbc5e78ba9d8bee6e9b9eec8aa38a68843baf7ca7834e52910
Instruction Fuzzy Hash: F0115E759003199BCB01EFA5C8819EEB774BF44318B10452FF511AB291DB7CA9858B9D

Function 05889720 Relevance: 13.7, APIs: 9, Instructions: 195timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,A97BC7BB,?,?,?,?,?,058A114B,000000FF), ref: 05889763
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 05889802
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 05889840
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 05889865
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0588988A

Part of subcall function 05881280: __CxxThrowException@8.LIBCMT ref: 05881290
Part of subcall function 05881280: DeleteCriticalSection.KERNEL32(00000000,0588D326,058A6514,?,?,0588D326,?,?,?,?,058A5930,00000000), ref: 058812A1

Part of subcall function 0588CD50: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,A97BC7BB,?,75922F60,00000000,?,?,058A0FFB,000000FF,?,0588993A,?), ref: 0588CDA7
Part of subcall function 0588CD50: InitializeCriticalSectionAndSpinCount.KERNEL32(FFFFFFFF,00000000,?,?,058A0FFB,000000FF,?,0588993A,?), ref: 0588CDC3

InterlockedExchange.KERNEL32(?,00000000), ref: 05889990
timeGetTime.WINMM ref: 05889996
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 058899A4
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 058899AD

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: c146e9596380b072383f2e074ad4344b9a3b86ecd925837c505dff559a748a27
Instruction ID: 1ca2ee1d0ccac596f1b06841cda753adb28f46a5b0d47ace78272ddf86ba4258
Opcode Fuzzy Hash: c146e9596380b072383f2e074ad4344b9a3b86ecd925837c505dff559a748a27
Instruction Fuzzy Hash: 9B81F9B0A01A46BFE354DF79C888796FBA8FB08314F50422EE52DC7640D775A964CF91

Function 05883500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 05883660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 05883667
Part of subcall function 05883660: _free.LIBCMT ref: 0588369C
Part of subcall function 05883660: _malloc.LIBCMT ref: 058836D7
Part of subcall function 05883660: _memset.LIBCMT ref: 058836E5

InterlockedIncrement.KERNEL32(058B1F4C), ref: 05883565
InterlockedIncrement.KERNEL32(058B1F4C), ref: 05883573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0588359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 058835B3
ResetEvent.KERNEL32(?,?,?,058B1F4C), ref: 058835EE
SetLastError.KERNEL32(00000000), ref: 05883621
GetLastError.KERNEL32 ref: 05883639

Part of subcall function 05883F60: GetCurrentThreadId.KERNEL32 ref: 05883F65
Part of subcall function 05883F60: send.WS2_32(?,058A49C0,00000010,00000000), ref: 05883FC6
Part of subcall function 05883F60: SetEvent.KERNEL32(?), ref: 05883FE9
Part of subcall function 05883F60: InterlockedExchange.KERNEL32(?,00000000), ref: 05883FF5
Part of subcall function 05883F60: WSACloseEvent.WS2_32(?), ref: 05884003
Part of subcall function 05883F60: shutdown.WS2_32(?,00000001), ref: 0588401B
Part of subcall function 05883F60: closesocket.WS2_32(?), ref: 05884025

SetLastError.KERNEL32(00000000), ref: 05883649

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: d6283e34e3d009432f678fd75ec066a5ae23e0296c0f5e9bfc215243b738f8c9
Instruction ID: 4752a5cf662786fa52a420be9ae8b1b0dbf54393ac0b58e7615fde538bb0a307
Opcode Fuzzy Hash: d6283e34e3d009432f678fd75ec066a5ae23e0296c0f5e9bfc215243b738f8c9
Instruction Fuzzy Hash: D2418DB5600704AFD360EF69DC81B6ABBE8FF48711F10092EEA46D7740DBB4B9048B50

Function 05884430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 05884443
ResetEvent.KERNEL32(?), ref: 0588444C
timeGetTime.WINMM ref: 0588444E
InterlockedExchange.KERNEL32(?,00000000), ref: 0588445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 058844AB
ResetEvent.KERNEL32(?), ref: 058844C8

Part of subcall function 05883F60: GetCurrentThreadId.KERNEL32 ref: 05883F65
Part of subcall function 05883F60: send.WS2_32(?,058A49C0,00000010,00000000), ref: 05883FC6
Part of subcall function 05883F60: SetEvent.KERNEL32(?), ref: 05883FE9
Part of subcall function 05883F60: InterlockedExchange.KERNEL32(?,00000000), ref: 05883FF5
Part of subcall function 05883F60: WSACloseEvent.WS2_32(?), ref: 05884003
Part of subcall function 05883F60: shutdown.WS2_32(?,00000001), ref: 0588401B
Part of subcall function 05883F60: closesocket.WS2_32(?), ref: 05884025

ResetEvent.KERNEL32(?), ref: 058844DC

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 1a0ea3706187c95ce546dd5b9b1d0c8004ea2a56465bb30715f8205556fb568f
Instruction ID: b5fa4fdcd1bb5b3cfdc1c97a70a87596384edef5caaae89f83eaacce6aeeff75
Opcode Fuzzy Hash: 1a0ea3706187c95ce546dd5b9b1d0c8004ea2a56465bb30715f8205556fb568f
Instruction Fuzzy Hash: ED2182762147045BD630EF79DC85BA7B7E8FF89710F100A1EF94AC3650EA71B8048BA1

Function 05884E80 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 05884E99
TryEnterCriticalSection.KERNEL32(?,?), ref: 05884EB8
TryEnterCriticalSection.KERNEL32(?), ref: 05884EC2
SetLastError.KERNEL32(0000139F), ref: 05884ED9
LeaveCriticalSection.KERNEL32(?), ref: 05884EE2
LeaveCriticalSection.KERNEL32(?), ref: 05884EE9

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 17a6736e2f260397401e6c66e763856a515c69b165be813cfe6d51468b31fc4d
Instruction ID: f033d7afdd0036135e09ea07df9fc55c22ba39f1e4d34164eb63c372924931c8
Opcode Fuzzy Hash: 17a6736e2f260397401e6c66e763856a515c69b165be813cfe6d51468b31fc4d
Instruction Fuzzy Hash: 58115E367143058BD730EA69AC8597AF7E8FB88325B00096EEE47C2550EA61EC04C6A5

Function 0042628C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00426C94: _free.LIBCMT ref: 00426CCB
Part of subcall function 00426C94: _abort.LIBCMT ref: 00426D12

_memcmp.LIBVCRUNTIME ref: 00426536
_free.LIBCMT ref: 004265A7
_free.LIBCMT ref: 004265C0
_free.LIBCMT ref: 004265F2
_free.LIBCMT ref: 004265FB
_free.LIBCMT ref: 00426607

Strings

C, xrefs: 004263F4

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free$_abort_memcmp
String ID: C
API String ID: 137591632-1037565863
Opcode ID: 02177950ef4cbb7b5e7d75defd5681ab0e89a2a84e828912c61c8f635c6afb52
Instruction ID: 8d35496f2f27db50f7c5ffb127d95a8784faad9c84f8800e00c7ceac8d6c3bf5
Opcode Fuzzy Hash: 02177950ef4cbb7b5e7d75defd5681ab0e89a2a84e828912c61c8f635c6afb52
Instruction Fuzzy Hash: EAB13D75A01229DFDB24DF18E884AADB7B4FB08304F9141EEE949A7354D735AE90CF48

Function 0588DC50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 0588DC72
SetLastError.KERNEL32(0000007F), ref: 0588DD75

Strings

Main, xrefs: 0588DC5F, 0588DC9C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 215ecbbf9dbae248f24bb4f16ded8b7cf9811901c4d7a047a5f2693f2a548adc
Instruction ID: 916016b6e5816e6b19be307f70f5d768748ede8ceaa1aab458449775f4728218
Opcode Fuzzy Hash: 215ecbbf9dbae248f24bb4f16ded8b7cf9811901c4d7a047a5f2693f2a548adc
Instruction Fuzzy Hash: 08419E71A052059BE720EF58D881BBAB7E5FF84314F0486A9EC06CB781E775ED41CB90

Function 0040A8E7 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

std::system_error::system_error.LIBCPMT ref: 0040A924

Part of subcall function 0040A83F: __EH_prolog3_GS.LIBCMT ref: 0040A846

std::system_error::system_error.LIBCPMT ref: 0040A953

Part of subcall function 004107C0: __Init_thread_footer.LIBCMT ref: 0041080A

std::system_error::system_error.LIBCPMT ref: 0040A97C
__CxxThrowException@8.LIBVCRUNTIME ref: 0040A99E

Strings

ios_base::eofbit set, xrefs: 0040A970
ios_base::badbit set, xrefs: 0040A918
ios_base::failbit set, xrefs: 0040A947

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::system_error::system_error$Exception@8H_prolog3_Init_thread_footerThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1655831007-1866435925
Opcode ID: 511f13fbb9e4ebbb1886e9922c4f66d423fecec15ac26f4dc348fdd62ef75f1a
Instruction ID: fa1219887b7f32737682137bfa165a9407a848542708bd4db1697170cd2d746d
Opcode Fuzzy Hash: 511f13fbb9e4ebbb1886e9922c4f66d423fecec15ac26f4dc348fdd62ef75f1a
Instruction Fuzzy Hash: 07112C726443007BE711FA14C853FAA7394AB40B04F50C81FB9956A1C1EBBCA855D79F

Function 0042DAE0 Relevance: 12.2, APIs: 8, Instructions: 210COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0042DB07
_free.LIBCMT ref: 0042DB73
_free.LIBCMT ref: 0042DB99
_free.LIBCMT ref: 0042DBC2
_free.LIBCMT ref: 0042DBF7
_free.LIBCMT ref: 0042DC28
_free.LIBCMT ref: 0042DC69
_free.LIBCMT ref: 0042DD07

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free$_wcschr
String ID:
API String ID: 565560161-0
Opcode ID: 2d990241f16ac3012c408bbc7474bb55ba02d0b759fa483369b146f7c56b06ab
Instruction ID: c44d2d3b177bb4c968aeb01cc264f12d2e252c27716455c33e821b1e7030556b
Opcode Fuzzy Hash: 2d990241f16ac3012c408bbc7474bb55ba02d0b759fa483369b146f7c56b06ab
Instruction Fuzzy Hash: 246159B1F003206BDB24AF65F851A6B7BE49F01324F95417FE8459B381E67DA9408B5C

Function 05883F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 05883F65
SetLastError.KERNEL32(0000139F,?,7591DFA0,05883648), ref: 05884054

Part of subcall function 05882BC0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 05882BD6
Part of subcall function 05882BC0: SwitchToThread.KERNEL32 ref: 05882BEA

send.WS2_32(?,058A49C0,00000010,00000000), ref: 05883FC6
SetEvent.KERNEL32(?), ref: 05883FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 05883FF5
WSACloseEvent.WS2_32(?), ref: 05884003
shutdown.WS2_32(?,00000001), ref: 0588401B
closesocket.WS2_32(?), ref: 05884025

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 75d25e70d66e1f8c5eef34b5821653a73816d9ed580523fefb6a746534e0f48b
Instruction ID: 6174ff8f3bf1be0af173835570e680fdc54c0fec7d8b38bd1db36326d33302ca
Opcode Fuzzy Hash: 75d25e70d66e1f8c5eef34b5821653a73816d9ed580523fefb6a746534e0f48b
Instruction Fuzzy Hash: AA21F5752107019BE730AB68D889B6BBBB5FB44B14F140D1CFA93C6A90DBB5F8418B50

Function 05884060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884074
ResetEvent.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884087
ResetEvent.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884090
ResetEvent.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884099

Part of subcall function 05881350: HeapFree.KERNEL32(?,00000000,?,?,?,058840A6,?,00000000,05884039,?,7591DFA0,05883648), ref: 05881390

Part of subcall function 05881420: HeapFree.KERNEL32(?,00000000,?,?,?,058840B1,?,00000000,05884039,?,7591DFA0,05883648), ref: 0588143D
Part of subcall function 05881420: _free.LIBCMT ref: 05881459

HeapDestroy.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 058840B9
HeapCreate.KERNEL32(?,?,?,?,00000000,05884039,?,7591DFA0,05883648), ref: 058840D4
SetEvent.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884150
LeaveCriticalSection.KERNEL32(?,?,00000000,05884039,?,7591DFA0,05883648), ref: 05884157

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 0d550124100f534e0a397bc4fc7e33116c10c1156836a2a2622e92bba17d1841
Instruction ID: cbe1b7dc6bb8f3ace79e18fbc670878f82c280c9fd6a277925512bb2bb561593
Opcode Fuzzy Hash: 0d550124100f534e0a397bc4fc7e33116c10c1156836a2a2622e92bba17d1841
Instruction Fuzzy Hash: ED312A75210602AFD745EB78D858BA6F7A8FF48314F148259E82AC7260DB35B951CFD0

Function 00414E99 Relevance: 12.1, APIs: 8, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00414EA0
std::_Lockit::_Lockit.LIBCPMT ref: 00414EAA
int.LIBCPMT ref: 00414EC1

Part of subcall function 00409F91: std::_Lockit::_Lockit.LIBCPMT ref: 00409FA2
Part of subcall function 00409F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00409FBC

std::locale::_Getfacet.LIBCPMT ref: 00414ECA
codecvt.LIBCPMT ref: 00414EE4
__CxxThrowException@8.LIBVCRUNTIME ref: 00414F01
std::_Facet_Register.LIBCPMT ref: 00414F20
std::_Lockit::~_Lockit.LIBCPMT ref: 00414F29

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID:
API String ID: 1243920060-0
Opcode ID: 9a37c4ca32d4f72e2577b2f97e864c81b1d01fadd4be8cf112c8562fdee9deb0
Instruction ID: 345db9bcee593613158df028d78eab87863716f07e80e62ebecf6e8e7bc719ca
Opcode Fuzzy Hash: 9a37c4ca32d4f72e2577b2f97e864c81b1d01fadd4be8cf112c8562fdee9deb0
Instruction Fuzzy Hash: 8B01A1719001169BCF01EBA1C8429EE7325BF94328F14051FF4116B3D2DF3C9D468799

Function 05882140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 05881610: __vswprintf.LIBCMT ref: 05881646

_malloc.LIBCMT ref: 05882330

Part of subcall function 0588F563: __FF_MSGBANNER.LIBCMT ref: 0588F57C
Part of subcall function 0588F563: __NMSG_WRITE.LIBCMT ref: 0588F583
Part of subcall function 0588F563: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F5A8

Strings

input probe, xrefs: 058823A1
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 058822AC
input psh: sn=%lu ts=%lu, xrefs: 058822DF
[RI] %d bytes, xrefs: 0588216F
input wins: %lu, xrefs: 058823CF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: cc86d02b55c46a9ecddee2ad3a8adad7bc64d780c5689db09821804ae670a0f4
Instruction ID: da82da17bf61a331d39a718e9e9a284fbc78a78efeb8bccfcd97bfe1191b8e35
Opcode Fuzzy Hash: cc86d02b55c46a9ecddee2ad3a8adad7bc64d780c5689db09821804ae670a0f4
Instruction Fuzzy Hash: E9B1A279A042058BCF18EF68D894ABAB7A1FF44310F08456EDD4ADB346D731ED41CB91

Function 0042E6B9 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E728
_free.LIBCMT ref: 0042E736
_free.LIBCMT ref: 0042E864
_free.LIBCMT ref: 0042E86F

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5c4ca65f2282142b8e6d1775854e7d6824a520d0d30fe3e397f315a510141f05
Instruction ID: c48e34c806fc93d00e6808c21d6ee457566fa3dbffcd52f3768e30c90bb6c12c
Opcode Fuzzy Hash: 5c4ca65f2282142b8e6d1775854e7d6824a520d0d30fe3e397f315a510141f05
Instruction Fuzzy Hash: FA61F771E00225AFDB20DF66E841BAABBF4FF45310F9441ABE984EB341D7789D418B58

Function 004139F0 Relevance: 10.7, APIs: 7, Instructions: 166COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00413A50
new.LIBCMT ref: 00413A75
new.LIBCMT ref: 00413A8B
new.LIBCMT ref: 00413AA1
new.LIBCMT ref: 00413AC6
new.LIBCMT ref: 00413B48
new.LIBCMT ref: 00413B70

Part of subcall function 0041304B: new.LIBCMT ref: 00413064

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7fe906b7f9ddf05f75b2de11bb7e3c3a2cea166a25cf8d3a130629215e81eb
Instruction ID: c185e459d5539be06f88054b5743a15cb486ae588158876233ead096b3345e9b
Opcode Fuzzy Hash: fc7fe906b7f9ddf05f75b2de11bb7e3c3a2cea166a25cf8d3a130629215e81eb
Instruction Fuzzy Hash: 4B71C4B49007059FDB18DF29D485A95BBE0FF08710B20C56FE8698B752D7B4EA90CF94

Function 05881830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 05881878
_free.LIBCMT ref: 058818B6
_free.LIBCMT ref: 058818F5
_free.LIBCMT ref: 05881935
_free.LIBCMT ref: 0588195D
_free.LIBCMT ref: 05881981
_free.LIBCMT ref: 058819B9

Part of subcall function 0588F529: RtlFreeHeap.NTDLL(00000000,00000000,?,05893D3C,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F53F
Part of subcall function 0588F529: GetLastError.KERNEL32(00000000,?,05893D3C,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000), ref: 0588F551

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98afb7ff4db5643a870946c7d347e85cdb3ed9801407c5c9bd83f51a36d578b6
Instruction ID: f79428d4832f8b52915b2d751c761fbe70c26b613ce97e33be29e00348f6c080
Opcode Fuzzy Hash: 98afb7ff4db5643a870946c7d347e85cdb3ed9801407c5c9bd83f51a36d578b6
Instruction Fuzzy Hash: DA513BB2A002159FC714EF59D4C9875BBA6FF88314B1981ADD91AAF311CB32BD42CB91

Function 05883870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 05883883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 058838C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 05883931
GetCurrentThreadId.KERNEL32 ref: 0588395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 058839F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 05883A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 05883A39

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 5ad698a64ef987e4465725f92f2ca7762a22fe0a0748ecf861b7df627467a3ef
Instruction ID: 6c0dd3e2602b9481b013b27adab0e603c0ba6b65f37269c65e7ca93a06b967bb
Opcode Fuzzy Hash: 5ad698a64ef987e4465725f92f2ca7762a22fe0a0748ecf861b7df627467a3ef
Instruction Fuzzy Hash: 9A5159706047019BDB20BB28CD89BBABBA5FF46B14F104919ED6AD7680EF74FD408B51

Function 0042EB8E Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042E8D5: _free.LIBCMT ref: 0042E8FE

_free.LIBCMT ref: 0042EBDC
_free.LIBCMT ref: 0042EBE7
_free.LIBCMT ref: 0042EBF2
_free.LIBCMT ref: 0042EC46
_free.LIBCMT ref: 0042EC51
_free.LIBCMT ref: 0042EC5C
_free.LIBCMT ref: 0042EC67

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6dd356d4879980d832855e29057831adf0ab8e09fcd3e774d0a7f8609a170f3b
Instruction ID: 351df5904e51b4d293894b82aa9459465cbd7e2b4bf20acada74d019c2f7d038
Opcode Fuzzy Hash: 6dd356d4879980d832855e29057831adf0ab8e09fcd3e774d0a7f8609a170f3b
Instruction Fuzzy Hash: 7A111DB1641768FAE520BBB2EC06FCBB7E85F01714FC0482BB2D9A6062D66DE5444754

Function 00410D3B Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00410D42
std::_Lockit::_Lockit.LIBCPMT ref: 00410D4D
int.LIBCPMT ref: 00410D63

Part of subcall function 00409F91: std::_Lockit::_Lockit.LIBCPMT ref: 00409FA2
Part of subcall function 00409F91: std::_Lockit::~_Lockit.LIBCPMT ref: 00409FBC

std::locale::_Getfacet.LIBCPMT ref: 00410D6C
__CxxThrowException@8.LIBVCRUNTIME ref: 00410DAC
std::_Facet_Register.LIBCPMT ref: 00410DC2
std::_Lockit::~_Lockit.LIBCPMT ref: 00410DCB

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::locale::_
String ID:
API String ID: 4117319562-0
Opcode ID: fba0c2326c1434d078090c71260acb8fb395d3cf23103ac22208d4f800f413bf
Instruction ID: 3e26b6b3d551c7a40d525d11b9e8ef738dc00214e4b62061d29b6b6ac4c15d42
Opcode Fuzzy Hash: fba0c2326c1434d078090c71260acb8fb395d3cf23103ac22208d4f800f413bf
Instruction Fuzzy Hash: C311A1729002199BCF01EFE5D8829EE7774BF48328B10451FF411A7291DB7C99858B9D

Function 0588E5A0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?,0588E705,?,?,?,?,759223A0,00000000), ref: 0588E5AD
CreateFileW.KERNEL32(058B0DC0,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0588E705,?,?,?,?,759223A0,00000000), ref: 0588E5C7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0588E5E2
lstrlenW.KERNEL32(?,00000000,00000000), ref: 0588E5EF
WriteFile.KERNEL32(00000000,?,00000000), ref: 0588E5FA
CloseHandle.KERNEL32(00000000), ref: 0588E601
ReleaseMutex.KERNEL32(?), ref: 0588E60E

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: a779da957ae72cc285aa8845d1ac992b4bbd317db1a7c594f9c3c52a9f385890
Instruction ID: 5cf912018224c2928bc7b8d4afda70f4971aa44c0b7cd5e3cbd0b6977c2e41dc
Opcode Fuzzy Hash: a779da957ae72cc285aa8845d1ac992b4bbd317db1a7c594f9c3c52a9f385890
Instruction Fuzzy Hash: 72013675255210BBF234A794AC0FFAA3E6CEB05725F104204FF16E61C0DEB07900C7A5

Function 05893C1E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,058A6208,00000008,05893D26,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C), ref: 05893C2F
__lock.LIBCMT ref: 05893C63

Part of subcall function 05898D4B: __mtinitlocknum.LIBCMT ref: 05898D61
Part of subcall function 05898D4B: __amsg_exit.LIBCMT ref: 05898D6D
Part of subcall function 05898D4B: EnterCriticalSection.KERNEL32(00000000,00000000,?,05893DF6,0000000D,058A6230,00000008,05893EED,00000000,?,05890FE0,00000000,058A6168,00000008,05891045,?), ref: 05898D75

InterlockedIncrement.KERNEL32(?), ref: 05893C70
__lock.LIBCMT ref: 05893C84
___addlocaleref.LIBCMT ref: 05893CA2

Strings

KERNEL32.DLL, xrefs: 05893C2A

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: adc6ecc6f3e30806985b65a23ac2cd5577f21ba5d948bc31bee98fbeda7070bb
Instruction ID: f02b896d784ffc9b74ede4abee312701c89a1405272bc07a11b277795ed4da0f
Opcode Fuzzy Hash: adc6ecc6f3e30806985b65a23ac2cd5577f21ba5d948bc31bee98fbeda7070bb
Instruction Fuzzy Hash: 9E015E71540B009AEB24AF69D409749FBE0BF51314F14490DEC9AD63A0CF74AE45CB52

Function 058A01EC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 058A020D

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

__getptd.LIBCMT ref: 058A021E
__getptd.LIBCMT ref: 058A022C

Strings

csm, xrefs: 058A0206
MOC, xrefs: 058A01FF
RCC, xrefs: 058A01F8

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction ID: aef24aadf01b7ff3698453496f351b9a92d9f00e7801a3c7da4d3be22f89d532
Opcode Fuzzy Hash: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction Fuzzy Hash: B3E01231204308CFEF259768C09DB7832D5BB85615F1904A5DC4DCB261DB28FC908A53

Function 0042307A Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 004230A6
__cftoe.LIBCMT ref: 004230D8

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 9e7c393f7913040c7c2fac54b8562294a6cc16eba612aa0d52204cfc202d269d
Instruction ID: 9724f99bbef3ba2ae2681cf2a2be8895b7bffa32eb9f01a1a5dc954d3494b116
Opcode Fuzzy Hash: 9e7c393f7913040c7c2fac54b8562294a6cc16eba612aa0d52204cfc202d269d
Instruction Fuzzy Hash: 0A512E71B00224BBDB209F59EC41EBB77B8DF49325F94421FF81596281DB3CDA50866C

Function 05889C20 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05889C2F

Part of subcall function 0588F563: __FF_MSGBANNER.LIBCMT ref: 0588F57C
Part of subcall function 0588F563: __NMSG_WRITE.LIBCMT ref: 0588F583
Part of subcall function 0588F563: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F5A8

_free.LIBCMT ref: 05889C53
_memset.LIBCMT ref: 05889CAB

Part of subcall function 0588A600: GetObjectW.GDI32(?,00000054,?), ref: 0588A61E

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 05889CC3
_free.LIBCMT ref: 05889CD4
_free.LIBCMT ref: 05889D13

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: d20cae4b994269b7b2de440a2c9ee0123b5e9d67542188d57c81d535cd8aa531
Instruction ID: 48054bb7be2b6a1ceec6cbcd940520668bdd2f802df5d33924b401a4762be7f1
Opcode Fuzzy Hash: d20cae4b994269b7b2de440a2c9ee0123b5e9d67542188d57c81d535cd8aa531
Instruction Fuzzy Hash: FF3190B26003066BE710EF6AD980B76B7D9FB54314F00853AEE0AC7641E7B1E954C795

Function 05885080 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 058850CA
WSASetLastError.WS2_32(0000139F), ref: 058850E2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 058850EC

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 8e07597c2fb162b6a65fccb697ca907dad91a3800fb4e7e7410a9904535ddab6
Instruction ID: 6e68d0217ed1dc878c7fa434690bb456d665d2dd6c7f382e5a64a9cc7eaeb147
Opcode Fuzzy Hash: 8e07597c2fb162b6a65fccb697ca907dad91a3800fb4e7e7410a9904535ddab6
Instruction Fuzzy Hash: 46319A7AA44304ABE720EF58D886F7AB7A8FB48710F00455AFD16C3680EB36B810CB51

Function 00427468 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004274F3
__alldvrm.LIBCMT ref: 004276F4
__alldvrm.LIBCMT ref: 00427716

Strings

wA, xrefs: 00427484

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID: wA
API String ID: 1036877536-2642313842
Opcode ID: 81a7f3e143f0c3902e971790fd065bb8be4de18eb659e71127858b440c70fc8e
Instruction ID: 4b44f96e34cf7c20bef16c9bbc2aea76bfff12a845b3ea55e709f6a113a867cf
Opcode Fuzzy Hash: 81a7f3e143f0c3902e971790fd065bb8be4de18eb659e71127858b440c70fc8e
Instruction Fuzzy Hash: AFA15671B087A69FDB218F28D881BAFBBE1EF55350F9441AFE4859B341C23C9981C758

Function 058A049E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 058A04C6

Part of subcall function 0589FFA7: __getptd.LIBCMT ref: 0589FFB5
Part of subcall function 0589FFA7: __getptd.LIBCMT ref: 0589FFC3

__getptd.LIBCMT ref: 058A04D0

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

__getptd.LIBCMT ref: 058A04DE
__getptd.LIBCMT ref: 058A04EC
__getptd.LIBCMT ref: 058A04F7
_CallCatchBlock2.LIBCMT ref: 058A051D

Part of subcall function 058A004C: __CallSettingFrame@12.LIBCMT ref: 058A0098

Part of subcall function 058A05C4: __getptd.LIBCMT ref: 058A05D3
Part of subcall function 058A05C4: __getptd.LIBCMT ref: 058A05E1

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 08a57af2580cfcbd1530751a9dc6dcc3e137957f18e7e99ce621ec8fd56cac22
Instruction ID: a50c4bab77f7ba6221fa70036f2e4f61fb739df897f86415ba6e2dc071cbeb30
Opcode Fuzzy Hash: 08a57af2580cfcbd1530751a9dc6dcc3e137957f18e7e99ce621ec8fd56cac22
Instruction Fuzzy Hash: 2A11F671E00309DFDF44EFA8C488AADBBB0FF18314F148469E854EB250DB789A119F51

Function 05894775 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 05894781

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

__amsg_exit.LIBCMT ref: 058947A1
__lock.LIBCMT ref: 058947B1
InterlockedDecrement.KERNEL32(?), ref: 058947CE
_free.LIBCMT ref: 058947E1
InterlockedIncrement.KERNEL32(05A71668), ref: 058947F9

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 15f895ac8c983d855cb3191e097c5fef456c76519a2c4ada060a0cbcf1eb3962
Instruction ID: 2161b70f6bc78e8e2d48a29fb40102c0451704446269893099f2b219618b4839
Opcode Fuzzy Hash: 15f895ac8c983d855cb3191e097c5fef456c76519a2c4ada060a0cbcf1eb3962
Instruction Fuzzy Hash: 6E01C439A19719BBEF29AF68944976EBB60BF46710F0C0105EC05E76A0DB346D43CBD2

Function 05889B90 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 05889BC2
EnterCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889BD3
EnterCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889BE8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,05889B6B), ref: 05889BF4
LeaveCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889C05
LeaveCriticalSection.KERNEL32(058AFBA4,?,?,?,05889B6B), ref: 05889C0C

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 95db3bb029a2a19abb9b4bfdb5c384d681ff83e5d15330b0bb8a2fe8a269ddc5
Instruction ID: 1f38e8aee6b878a1f3d4d8a33e037f4727793803bcc71cb93bcb5c68a25414fe
Opcode Fuzzy Hash: 95db3bb029a2a19abb9b4bfdb5c384d681ff83e5d15330b0bb8a2fe8a269ddc5
Instruction Fuzzy Hash: C0011EBA511200AFA724AF6AD891455BFB4FE4831437481AEEA09CA211C776D803CF91

Function 058848D0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 058848E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 058848EC
Sleep.KERNEL32(00000258), ref: 058848F9
CloseHandle.KERNEL32(?), ref: 05884914
CloseHandle.KERNEL32(?), ref: 0588491D
Sleep.KERNEL32(0000012C), ref: 0588492E

Part of subcall function 05883F60: GetCurrentThreadId.KERNEL32 ref: 05883F65
Part of subcall function 05883F60: send.WS2_32(?,058A49C0,00000010,00000000), ref: 05883FC6
Part of subcall function 05883F60: SetEvent.KERNEL32(?), ref: 05883FE9
Part of subcall function 05883F60: InterlockedExchange.KERNEL32(?,00000000), ref: 05883FF5
Part of subcall function 05883F60: WSACloseEvent.WS2_32(?), ref: 05884003
Part of subcall function 05883F60: shutdown.WS2_32(?,00000001), ref: 0588401B
Part of subcall function 05883F60: closesocket.WS2_32(?), ref: 05884025

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: c9f3319a0d73ae341057c17f8c353a3eb615f6860eed096ea4d32e55e4f06399
Instruction ID: a9d09b153938e8af569d5fc4360c9321b9e362f4b964b8d4005a44b92f8c718f
Opcode Fuzzy Hash: c9f3319a0d73ae341057c17f8c353a3eb615f6860eed096ea4d32e55e4f06399
Instruction Fuzzy Hash: 75F03A762047055BD624EBADDC84D5AF3E9EFC9720B254B09F66A83294CE71FC01CBA0

Function 05883300 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 05883311
Sleep.KERNEL32(00000258), ref: 0588331E
InterlockedExchange.KERNEL32(?,00000000), ref: 05883326
WaitForSingleObject.KERNEL32(?,000000FF), ref: 05883332
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0588333A
Sleep.KERNEL32(0000012C), ref: 0588334B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 53d4a2bbce45df0f0cf91e2503bfc6b8c084f7338561c0df2a80c5ffe5f016f9
Instruction ID: 0322932d3840ce8ea57a96ed858eeb3a2cead0751f4ec6a683afce2510031ab3
Opcode Fuzzy Hash: 53d4a2bbce45df0f0cf91e2503bfc6b8c084f7338561c0df2a80c5ffe5f016f9
Instruction Fuzzy Hash: 45F082762043146BD620EBA9DC84D46F7E8AF89334B204709F622832D0CEB0F801CB60

Function 058A084B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 058A085E

Part of subcall function 058A07B9: ___BuildCatchObjectHelper.LIBCMT ref: 058A07EF

_UnwindNestedFrames.LIBCMT ref: 058A0875
___FrameUnwindToState.LIBCMT ref: 058A0883

Strings

csm, xrefs: 058A085A, 058A086F, 058A0882, 058A08A0, 058A08B0
csm, xrefs: 058A084D

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: a54c3226fb4e37041f71358c16847cc1a0fecb7fd68bfed26b5180a5046c6354
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: 8F012432501209FBEF126F55CC49EAA3E6AFF08354F048020FD19A4120D732D9B1DBA6

Function 00409E21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00409E28
std::_Lockit::_Lockit.LIBCPMT ref: 00409E35
__CxxThrowException@8.LIBVCRUNTIME ref: 00409E8B

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00409E94

Strings

bad locale name, xrefs: 00409E6E

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$DispatcherExceptionException@8H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_ThrowUser
String ID: bad locale name
API String ID: 1777175881-1405518554
Opcode ID: 4c3a0f8ec2c3b43e9b1622e9d0a7fb89ca61f0daff3e45d9e1ae790c5f287f22
Instruction ID: cfe6bd4e532655e878cb0836463bed52bd20e80a7a65bbd5992059e6844203c4
Opcode Fuzzy Hash: 4c3a0f8ec2c3b43e9b1622e9d0a7fb89ca61f0daff3e45d9e1ae790c5f287f22
Instruction Fuzzy Hash: B2015270805B44DEC720DF6A848158FFBF0BF28304B90896FE09AD3642D778A644CB9D

Function 00432FE4 Relevance: 7.8, APIs: 5, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d53f7e32576e54633436ab6eeedae57057275b2ea6181c95bf9cc80636d15c4
Instruction ID: 1f8f9782ed87a95c96184f7aad462c1dd6ff963d09757823ca4ae9369b69b995
Opcode Fuzzy Hash: 3d53f7e32576e54633436ab6eeedae57057275b2ea6181c95bf9cc80636d15c4
Instruction Fuzzy Hash: 0BC11874E04355AFDB11CFA9D841BAEBBF0BF0E311F14519AE840A7392C7789A41CB69

Function 00428D1B Relevance: 7.7, APIs: 5, Instructions: 216COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00428DAD
__alloca_probe_16.LIBCMT ref: 00428E92
__freea.LIBCMT ref: 00428F02
__freea.LIBCMT ref: 00428F0B
__freea.LIBCMT ref: 00428F30

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID:
API String ID: 3509577899-0
Opcode ID: d0dd8fbe2648c77ef7f48df0b1fb282a909e615fb878a9b12c65857eb686fbec
Instruction ID: 7038e7a57921961d2bdd141ff5ef0515588d8eed05a9a9c2da12446ee4e61558
Opcode Fuzzy Hash: d0dd8fbe2648c77ef7f48df0b1fb282a909e615fb878a9b12c65857eb686fbec
Instruction Fuzzy Hash: 2A510072711226AFEB258F65ED41EAF77AAEB40710F56022EFD04D6280DF38DC80C658

Function 00425E0E Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00425F19
_free.LIBCMT ref: 00425F30
_free.LIBCMT ref: 00425F4F
_free.LIBCMT ref: 00425F6A
_free.LIBCMT ref: 00425F81

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3c1cb713d673844b544b3dba7a79ca6b67edd168104f8e9a2033e051dc06e7ea
Instruction ID: 0010de04d6ea9ada81e678e3f09ba0067e35f14b19d86f3add10b6b496701751
Opcode Fuzzy Hash: 3c1cb713d673844b544b3dba7a79ca6b67edd168104f8e9a2033e051dc06e7ea
Instruction Fuzzy Hash: 3751E271B01A14AFDB20DF29ED41B6AB7F4EF18724F95416EE809DB250E7399A018B48

Function 00424F8D Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00424FFF
_free.LIBCMT ref: 0042501F

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f9caa18d7d6590dbb990782714064f7ff0d7bfa22d9277ebfea798ba4fa04c8f
Instruction ID: 9a994b52d9d8ed19c6a3bbd8f1ae60250289c68a0f4bd3580780396e8ce9ed52
Opcode Fuzzy Hash: f9caa18d7d6590dbb990782714064f7ff0d7bfa22d9277ebfea798ba4fa04c8f
Instruction Fuzzy Hash: 5741D172F006109FCB24DF78D880A5EB3B5EF85314F5546AEE505EB391DA35AD02CB84

Function 0588B8F0 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,A97BC7BB), ref: 0588B93A
_memset.LIBCMT ref: 0588B95B
_memset.LIBCMT ref: 0588B9AB
Process32FirstW.KERNEL32(00000000,?), ref: 0588B9C5
Process32NextW.KERNEL32(00000000,0000022C), ref: 0588BA17

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: b6e7e152db22d2f245606a39c9b459826cded906894871374e2dd8b41bbe3ee0
Instruction ID: f6b638640e9b8886a1331519a13edbcd9f0d544181e0b979e2af902090c3ec56
Opcode Fuzzy Hash: b6e7e152db22d2f245606a39c9b459826cded906894871374e2dd8b41bbe3ee0
Instruction Fuzzy Hash: 6A410471A40249DAEB20EF64CC89FBAB3A9FF44715F0042A4ED15DB280E775AE40CB91

Function 05883CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 05883CBF
SetLastError.KERNEL32(00000000,?,?,0588399F,?,?,00000000,000000FF,00000000), ref: 05883CFA
GetLastError.KERNEL32(00000000), ref: 05883D45
WSAGetLastError.WS2_32(?,?,0588399F,?,?,00000000,000000FF,00000000), ref: 05883D7B
WSASetLastError.WS2_32(0000000D,?,?,0588399F,?,?,00000000,000000FF,00000000), ref: 05883DA2

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 03bd0d94a1bd8c1697f1d1891b0947e43812c05e272e75d2a5751e5fe1aaf70f
Instruction ID: 3e843818939ceab30e274ce372480b693467ac8e0b17bbd265ebbd1007d54219
Opcode Fuzzy Hash: 03bd0d94a1bd8c1697f1d1891b0947e43812c05e272e75d2a5751e5fe1aaf70f
Instruction Fuzzy Hash: 9631D5726142009FFB64EF68DCC8B753B6AFB45724F100926ED06DB295DB71EC408A51

Function 05890DDB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05890DE9

Part of subcall function 0588F563: __FF_MSGBANNER.LIBCMT ref: 0588F57C
Part of subcall function 0588F563: __NMSG_WRITE.LIBCMT ref: 0588F583
Part of subcall function 0588F563: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F5A8

_free.LIBCMT ref: 05890DFC

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: fd2ac78fa1722de966b5a6e197749b3e810ae4e4caf5cf92ffdd6ee3046e30cf
Instruction ID: 597bbd3074ef0ca801da9caf4db8821e3140a0ef087a2c12b2c556e342c4ac15
Opcode Fuzzy Hash: fd2ac78fa1722de966b5a6e197749b3e810ae4e4caf5cf92ffdd6ee3046e30cf
Instruction Fuzzy Hash: FB11AB36514715DFDF297F78A80CA7E3BA6EF406A0B14452DFD8AD6140DF349D408A91

Function 0041D938 Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0041D954
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0041D96D

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 0c7becb860c4ceb1ba37a92dc874555c8470353414b1d7ed09414db1a019cb8f
Instruction ID: 9f1d0ef141483d4474d6a2c887d1df3b345939b67702fb139500f35742550c41
Opcode Fuzzy Hash: 0c7becb860c4ceb1ba37a92dc874555c8470353414b1d7ed09414db1a019cb8f
Instruction Fuzzy Hash: AD0124F3F287116EA7242B76BC869A727A6DB42338720023FF910852E1EF194C80555C

Function 05882C10 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 05882C3F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 05882C55
TranslateMessage.USER32(?), ref: 05882C64
DispatchMessageW.USER32(?), ref: 05882C6A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 05882C78

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: a38b874eb4c84b6e4435e4ed58900769e929182186f513e913fcf89ef9df12c7
Instruction ID: 204eed7e951908e29fc8a7965aada3b0d01fc73428e3ba8783fa8738010b7efc
Opcode Fuzzy Hash: a38b874eb4c84b6e4435e4ed58900769e929182186f513e913fcf89ef9df12c7
Instruction Fuzzy Hash: 41018B7665031E76E620E7949C82FFA77ADEB44710F504515FF06EA0C4EAA4BC0187A5

Function 05884B70 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 05884B83
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 05884B8D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 05884BA0
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 05884BA3

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4dff95aab73e0daa900c9fe57af2f58a44858f4c23caf676aedf385d1394e26d
Instruction ID: aeadc65a61d89dea3067f9ae3bb99bf2e3e11eadcb5fe27701789ea766c46497
Opcode Fuzzy Hash: 4dff95aab73e0daa900c9fe57af2f58a44858f4c23caf676aedf385d1394e26d
Instruction Fuzzy Hash: 54018F762102108BE720EB69FCC4B6BB7E8EB88318F050829E906C3200DB75FC46CB60

Function 0042E650 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E668
_free.LIBCMT ref: 0042E67A
_free.LIBCMT ref: 0042E68C
_free.LIBCMT ref: 0042E69E
_free.LIBCMT ref: 0042E6B0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1246edc347e60225d4aaa016120baa679a374c5ba24d5788d3149f9dbbfbefda
Instruction ID: b43925895765d2f009bd14c59b52728ecd4078afb275fdc814e9387682b56302
Opcode Fuzzy Hash: 1246edc347e60225d4aaa016120baa679a374c5ba24d5788d3149f9dbbfbefda
Instruction Fuzzy Hash: 12F044B2A11260678620DF5AF485C0AB3E9BA013107D44C0AF044D7650CB7CFC808A5C

Function 05894EF6 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 05894F02

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

__getptd.LIBCMT ref: 05894F19
__amsg_exit.LIBCMT ref: 05894F27
__lock.LIBCMT ref: 05894F37
__updatetlocinfoEx_nolock.LIBCMT ref: 05894F4B

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: cd37e0ad243a1ff59c266ecd70eb613ac128bf2d1453a4df09f9495bf9e886b9
Instruction ID: 4fff686403c626f3ddfc04a65de983783a701025ab360b52546efc67ba3eb207
Opcode Fuzzy Hash: cd37e0ad243a1ff59c266ecd70eb613ac128bf2d1453a4df09f9495bf9e886b9
Instruction Fuzzy Hash: F6F0F032A087019AEF6DBBAC6409B6D37A0BF80A20F0C0108EC45EB1E0CF245C438A57

Function 058875A0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 058875C2
GetCommandLineW.KERNEL32 ref: 058875C8
GetStartupInfoW.KERNEL32(?), ref: 058875D7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 058875FF
ExitProcess.KERNEL32 ref: 05887607

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 5e5d6a3d0bb5ec0900785c5d7041053e8d67a7514e2dd2731f2e8dfe4c88aa3a
Instruction ID: 2e4af7ebf4a032faa37a7351209de09721d08503ad6dbff698065920f0fc1f04
Opcode Fuzzy Hash: 5e5d6a3d0bb5ec0900785c5d7041053e8d67a7514e2dd2731f2e8dfe4c88aa3a
Instruction Fuzzy Hash: D2F03075694319BBF730ABA4DC4EFD97B78FB04B10F200294BA1BA60C0EA707A44CB54

Function 0588C850 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 0588C872
GetCommandLineW.KERNEL32 ref: 0588C878
GetStartupInfoW.KERNEL32(?), ref: 0588C887
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0588C8AF
ExitProcess.KERNEL32 ref: 0588C8B7

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 91601382ff5d83d8695c82c61649a18808741a84245775ed3f00336884e878d2
Instruction ID: 07f72209f626507d87be4eb000e5b4ac96ebe4e206716eb9e766068713a27b8a
Opcode Fuzzy Hash: 91601382ff5d83d8695c82c61649a18808741a84245775ed3f00336884e878d2
Instruction Fuzzy Hash: 7DF0B275594319BBE7349BA4DC4EFDA7B78FB04711F100294BA16A60D0DE707A44CB54

Function 004251DC Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004251FA
_free.LIBCMT ref: 0042520C
_free.LIBCMT ref: 0042521F
_free.LIBCMT ref: 00425230
_free.LIBCMT ref: 00425241

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 771dc786f6658a9024399fe430c2f8de96f5a30e7c847e001a4952b0482f1834
Instruction ID: 6709fa6e4bdbb06f3ebb60afa057886f26c0b5fe9bfe4956f2568c2b130e8363
Opcode Fuzzy Hash: 771dc786f6658a9024399fe430c2f8de96f5a30e7c847e001a4952b0482f1834
Instruction Fuzzy Hash: C1F0F4FDD62AF09B9602AF25FC214057B60EB1B725381413BF450922B1CB7C2A85CF8D

Function 0588F8A8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 05891BC0: _doexit.LIBCMT ref: 05891BCC

___set_flsgetvalue.LIBCMT ref: 0588F8BA

Part of subcall function 05893B90: TlsGetValue.KERNEL32(00000000,05893CE9,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000), ref: 05893B99
Part of subcall function 05893B90: DecodePointer.KERNEL32(?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6,0000000D), ref: 05893BAB
Part of subcall function 05893B90: TlsSetValue.KERNEL32(00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000,00000000,?,05893DF6), ref: 05893BBA

___fls_getvalue@4.LIBCMT ref: 0588F8C5

Part of subcall function 05893B70: TlsGetValue.KERNEL32(?,?,0588F8CA,00000000), ref: 05893B7E

___fls_setvalue@8.LIBCMT ref: 0588F8D8

Part of subcall function 05893BC4: DecodePointer.KERNEL32(?,?,?,0588F8DD,00000000,?,00000000), ref: 05893BD5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0588F8E1
ExitThread.KERNEL32 ref: 0588F8E8
GetCurrentThreadId.KERNEL32 ref: 0588F8EE
__freefls@4.LIBCMT ref: 0588F90E

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 19201788671fea6e62c8e1bde4c9af8713e563596902a75fc9d90c6a5b1743cb
Instruction ID: 500b788dd413ea1fa03689627881bee98b3677e69756b5e2148f837a9b0ec4bb
Opcode Fuzzy Hash: 19201788671fea6e62c8e1bde4c9af8713e563596902a75fc9d90c6a5b1743cb
Instruction Fuzzy Hash: 0BE0BF35A003157BEF1937B98D1DD6F7A5DED45251B180810BE11D3400EE259D518AA3

Function 004153CE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004153D5

Strings

, xrefs: 00415524

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: ed88852d9e5b72fa1a2168c25b96882fc1d6d66d9f13d84725e8bcda2c298194
Instruction ID: ab2bdeaa32475ffbe1317f571ddec7eb762e6d7c5f6d142f4f9cf111bbc0b9aa
Opcode Fuzzy Hash: ed88852d9e5b72fa1a2168c25b96882fc1d6d66d9f13d84725e8bcda2c298194
Instruction Fuzzy Hash: 38517031A10609EFCF14CF94D480AEEB7B2BF88314F54441EE406A7380D738A9C5CB69

Function 004168CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004168D3

Strings

, xrefs: 00416A15

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: e7d2c7d8d4cceb7a39c05c754bcd5c88fae731caf0d7c4f9f09bfeb02e9547a1
Instruction ID: 0d92959fdd7041aa1dedf74cd9a06e15f03f2e841f68a839bebb7bffc2c872a2
Opcode Fuzzy Hash: e7d2c7d8d4cceb7a39c05c754bcd5c88fae731caf0d7c4f9f09bfeb02e9547a1
Instruction Fuzzy Hash: 4951AD719102059FDF24DF54C580AEEB7B2BF49364F15842AE842B7280EB38E985CB68

Function 00410AD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00410AD7
char_traits.LIBCPMT ref: 00410AEC

Strings

Failed to get executable path, xrefs: 00410AE5, 00410BC7
XD, xrefs: 00410B33

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchchar_traits
String ID: Failed to get executable path$XD
API String ID: 1964944973-734729076
Opcode ID: 3d920f690cad0d79b8f4c164cfb21b26005b63f36f4fb9cec8e3598886380759
Instruction ID: 994170f763681c9e384b44c0273faa991b16c9c9827b501969fdf731a4adc734
Opcode Fuzzy Hash: 3d920f690cad0d79b8f4c164cfb21b26005b63f36f4fb9cec8e3598886380759
Instruction Fuzzy Hash: 7D51A435A002558FDB20CBA9C5C09AE77F1BF08714F28419AE5159B391C6B8ACC2CB9C

Function 05889420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0588943A

Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EE8B
Part of subcall function 0588EE76: __CxxThrowException@8.LIBCMT ref: 0588EEA0
Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EEB1

std::_Xinvalid_argument.LIBCPMT ref: 05889472

Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE3E
Part of subcall function 0588EE29: __CxxThrowException@8.LIBCMT ref: 0588EE53
Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE64

Strings

string too long, xrefs: 0588946D
invalid string position, xrefs: 05889435

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 7156c2dca320b0891893607cde0e2013dce50977c0cc4a4c3eb1f9e0692e5d44
Instruction ID: 4e9292139044cb59b3160cc1bc16f752cf6330f4752b28fb593eaab30f9f6f51
Opcode Fuzzy Hash: 7156c2dca320b0891893607cde0e2013dce50977c0cc4a4c3eb1f9e0692e5d44
Instruction Fuzzy Hash: 232182333046149BD721FE6CE880E7AF7D9EB91665B200A2FE996CB740D672DC44C7A1

Function 058884A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 058884B9

Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EE8B
Part of subcall function 0588EE76: __CxxThrowException@8.LIBCMT ref: 0588EEA0
Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EEB1

std::_Xinvalid_argument.LIBCPMT ref: 058884D7

Strings

string too long, xrefs: 058884D2
invalid string position, xrefs: 058884B4

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: 20ce08a7ead6481218398797544fc1cbb71b25c3bcd1eecf9dfdddbb0ea04072
Instruction ID: 993dad8663a7d76b05d4c7f002df5e7f38a61ce782b3d5305f2b847173850948
Opcode Fuzzy Hash: 20ce08a7ead6481218398797544fc1cbb71b25c3bcd1eecf9dfdddbb0ea04072
Instruction Fuzzy Hash: 7C218C72304306AB8B14EF68E890C7973AAFF882147504A29ED06CB751EB30ED58CB95

Function 0588B758 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 0588B777
RegCloseKey.ADVAPI32(?), ref: 0588B782

Strings

Console, xrefs: 0588B761
IpDatespecial, xrefs: 0588B771

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CloseDeleteValue
String ID: Console$IpDatespecial
API String ID: 2831762973-1840232981
Opcode ID: 26cf1461c163e3b495c699fdea7647ac94d50b222634989cc956c9431b284399
Instruction ID: c325dab80da3814507cff4add6bd1bc77b1a8b8a4689f6a55c96cac7b2bb299e
Opcode Fuzzy Hash: 26cf1461c163e3b495c699fdea7647ac94d50b222634989cc956c9431b284399
Instruction Fuzzy Hash: 61D0C237340300EFE210EA94EC8AF2AF394EB88711F00840AFF02E214089B0B845DB61

Function 0588D770 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0588D7A8
IsBadReadPtr.KERNEL32(?,00000014), ref: 0588D878
SetLastError.KERNEL32(0000007F), ref: 0588D8A3

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: 9b8ffe8695cdf902ac53edc93f97308f553c81ec88ca0358093c28035a21c0fe
Instruction ID: a010a7ad59e56835256646c35c5f77c5da318861633c357fa925966e1fe3d692
Opcode Fuzzy Hash: 9b8ffe8695cdf902ac53edc93f97308f553c81ec88ca0358093c28035a21c0fe
Instruction Fuzzy Hash: 0D418C75A052059BEB20EF99D881A6AF7FAFF88314F148959EC0AD7780D774F901CB90

Function 0589A4B2 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0589A4E6
__isleadbyte_l.LIBCMT ref: 0589A519
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 0589A54A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 0589A5B8

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9365f7f79dbd02f5da7db392e7a05b1d02002207c7f075c474a6bd2292f93791
Instruction ID: c58ee52d2750bf5682c51dd95cd75c21b1666d76912688c01a0426d0198412b3
Opcode Fuzzy Hash: 9365f7f79dbd02f5da7db392e7a05b1d02002207c7f075c474a6bd2292f93791
Instruction Fuzzy Hash: 5E31A071B04255EFDF2CDFA8C8849BE3BA5BF01211F1885A9E866DB190E730ED40DB51

Function 05888010 Relevance: 6.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 05888028
_memset.LIBCMT ref: 05888032
lstrlenW.KERNEL32(?), ref: 0588803B
lstrlenW.KERNEL32(?), ref: 05888046

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: lstrlen$_memset
String ID:
API String ID: 2425037729-0
Opcode ID: f1c0d9e45d4233e67239433d12de6dc7664b1e1c2b8269df191dec27339f8cdd
Instruction ID: fe8ae1d18af8ec23ea3f80d3d7e6846afea768dd7007e9fd883be4f7125a9f87
Opcode Fuzzy Hash: f1c0d9e45d4233e67239433d12de6dc7664b1e1c2b8269df191dec27339f8cdd
Instruction Fuzzy Hash: 5E21DA76B042185BCF28EE6CDC809BE73AAFBC4710B65846DED09D7201F771AD518BA1

Function 05884380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 058843EC

Part of subcall function 058813A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 058813CB

Part of subcall function 058841E0: EnterCriticalSection.KERNEL32(05884FB5,05884E55,058842BE,00000000,?,?,05884E55,?,?,?,?,00000000,000000FF), ref: 058841E8
Part of subcall function 058841E0: LeaveCriticalSection.KERNEL32(05884FB5,?,?,?,00000000,000000FF), ref: 058841F6

Part of subcall function 05884C70: HeapFree.KERNEL32(?,00000000,?,00000000,05884E55,?,058842C8,05884E55,00000000,?,?,05884E55,?), ref: 05884C97

SetLastError.KERNEL32(00000000,?), ref: 058843D7
SetLastError.KERNEL32(00000057), ref: 05884401
WSAGetLastError.WS2_32(?), ref: 05884410

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: f9f6ccf4d917fd4a514f7b330a65bbed5d39ada1c41db0a7a43a599ad2482d32
Instruction ID: c96b5cdd2b8a866c0f7ff3f30d01ae0f61a9250a2c6a2e2e8434b00e304109cc
Opcode Fuzzy Hash: f9f6ccf4d917fd4a514f7b330a65bbed5d39ada1c41db0a7a43a599ad2482d32
Instruction Fuzzy Hash: 4611A73BB09518979B10FE69F8445EEB7A8FF84636B0401A6EC0ED3600EB359D0147D1

Function 0588DDB0 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0588DDD3
_free.LIBCMT ref: 0588DE15
GetProcessHeap.KERNEL32(00000000,00000000,0588DBD5), ref: 0588DE3C
HeapFree.KERNEL32(00000000), ref: 0588DE43

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 7e49de99261ddfbc71e7f57ada14de5d4209c3d09f2adb8741e52c8f33dd82f4
Instruction ID: ceb2dbbc9f2f56bdda8c1dfe3597135593e0a9638207c6de43143b097034a735
Opcode Fuzzy Hash: 7e49de99261ddfbc71e7f57ada14de5d4209c3d09f2adb8741e52c8f33dd82f4
Instruction Fuzzy Hash: 52112B71601B00ABD630EA69CD49F67B3A9FB84700F14891CE99B87A80DB74F842CB51

Function 05883BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,05883ABB,00000023), ref: 05883C02
WSAGetLastError.WS2_32 ref: 05883C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 05883C58
WSAGetLastError.WS2_32 ref: 05883C63

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: f08f5b09f09483031fe3fae0ee1d342e92b0dfab053209e632a09831c50b2997
Instruction ID: ecc5f0a344262e33402fb4be4691b44cc4fc8870242c01bddde68b541b3b1af4
Opcode Fuzzy Hash: f08f5b09f09483031fe3fae0ee1d342e92b0dfab053209e632a09831c50b2997
Instruction Fuzzy Hash: BF111FB66107009BD730AB79D888A67BAEAFB89B14F110A1DF957C7650DB75F8008B50

Function 00419626 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 00419644
_com_issue_error.COMSUPP ref: 00419681
SysAllocString.OLEAUT32(00000000), ref: 00419687
_com_issue_error.COMSUPP ref: 004196A9

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 501e6b04af8355a67b84f2c383adb1f98b6c0f41ce6aaac3be59f62b7178dda0
Instruction ID: 1d0dd822b0c7db4144dc7e043cacaa93b206406b730ac036a5011f82a45548da
Opcode Fuzzy Hash: 501e6b04af8355a67b84f2c383adb1f98b6c0f41ce6aaac3be59f62b7178dda0
Instruction Fuzzy Hash: 8111C672A00214ABCB255BA19C457DF7765DF48314F01012FF905B6240EA3D9D90C6BD

Function 0589BCDB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0589BD01

Part of subcall function 0589BB2D: __fltout2.LIBCMT ref: 0589BB58

__cftog_l.LIBCMT ref: 0589BD27
__cftoe_l.LIBCMT ref: 0589BD59

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 05cbb4b7c83cb76c5ae9dbb5e21d7d013ba1372be57a3077caa1ca88d3780dd6
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: AE11437600814DBBCF1A5E84EC05CED3F67BB58256B488415FE1999030C33BC971AB81

Function 0041A1A1 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0041A1B8

Part of subcall function 0041A7F0: ___AdjustPointer.LIBCMT ref: 0041A83A

_UnwindNestedFrames.LIBCMT ref: 0041A1CF
___FrameUnwindToState.LIBVCRUNTIME ref: 0041A1E1
CallCatchBlock.LIBVCRUNTIME ref: 0041A205

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 08551ddd603f21dc6f7fc468f76b9c3b003be5c4bc19ae637f83aaf99b94841c
Instruction ID: 2d441d66b1c49fcde367b25591180309cdd9d7be12b29a3599bac2a37da5e321
Opcode Fuzzy Hash: 08551ddd603f21dc6f7fc468f76b9c3b003be5c4bc19ae637f83aaf99b94841c
Instruction Fuzzy Hash: 9D012D32000109BBCF125F55CC01EDA3B75FF48758F05401AF91862121D33AE8F1DB95

Function 058841E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(05884FB5,05884E55,058842BE,00000000,?,?,05884E55,?,?,?,?,00000000,000000FF), ref: 058841E8
LeaveCriticalSection.KERNEL32(05884FB5,?,?,?,00000000,000000FF), ref: 058841F6
LeaveCriticalSection.KERNEL32(05884FB5), ref: 05884257
SetEvent.KERNEL32(8520468B), ref: 05884272

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 6493336fb5f43f55e11cb55aae28acde180de7d84615f89aa8070b62391b759a
Instruction ID: 6533901699862550ef6cf07135fc38c1f4be5b126a6005ee0605e420fef38b9d
Opcode Fuzzy Hash: 6493336fb5f43f55e11cb55aae28acde180de7d84615f89aa8070b62391b759a
Instruction Fuzzy Hash: 0D1106B5605B019FDB24DF74D584AA6BBE5FF48304B15892DE86FC7211EB31E801CB00

Function 00410E05 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00410E0C
new.LIBCMT ref: 00410E26

Part of subcall function 0040A025: __EH_prolog3_GS.LIBCMT ref: 0040A02C

__Getcoll.LIBCPMT ref: 00410E64
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00410E74

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_$GetcollLocinfoLocinfo::~_std::_
String ID:
API String ID: 3170657810-0
Opcode ID: 5d56d57dba86ca919bfc7954abaef7197d91b5eee102eb90a6610f2e7685b1d9
Instruction ID: 9f9e0daaae16aed48b01f14ec148c1de816a6c3cfcc9b435084ebaff503b4ee6
Opcode Fuzzy Hash: 5d56d57dba86ca919bfc7954abaef7197d91b5eee102eb90a6610f2e7685b1d9
Instruction Fuzzy Hash: E0112DB19403099FDB10EFA6C5417DEB7B4AF08315F10842EE4557B281DBB89984CBA9

Function 05884B00 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,05883C4F,?,?,00000001), ref: 05884B15
InterlockedIncrement.KERNEL32(00000001), ref: 05884B24
InterlockedIncrement.KERNEL32(00000001), ref: 05884B31
timeGetTime.WINMM(?,05883C4F,?,?,00000001), ref: 05884B48

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 063dc39dbfda6dde45492ecfe158b3011580f340e5cae162e2ab195fb5604e86
Instruction ID: 2eeaa37e6cae7bcf2f0974c0bacf95e3321ab7afe463d1f895f85e5a7f7b1682
Opcode Fuzzy Hash: 063dc39dbfda6dde45492ecfe158b3011580f340e5cae162e2ab195fb5604e86
Instruction Fuzzy Hash: 3901C8B56007059FCB20EFAED88095AFBE9EF58650700892AE949C7610E675EA448FA0

Function 05883660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 05883667
_free.LIBCMT ref: 0588369C

Part of subcall function 0588F529: RtlFreeHeap.NTDLL(00000000,00000000,?,05893D3C,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66), ref: 0588F53F
Part of subcall function 0588F529: GetLastError.KERNEL32(00000000,?,05893D3C,00000000,?,058943F0,00000000,00000001,00000000,?,05898CD6,00000018,058A6338,0000000C,05898D66,00000000), ref: 0588F551

_malloc.LIBCMT ref: 058836D7
_memset.LIBCMT ref: 058836E5

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 69cc01ecf12743789462bb2c6dd97a148e8c105857e06f2264df907a72fed25f
Instruction ID: c31af23d20c15981d4d11ae337db5a0623fc2c5ec5790918c668226ed52ecb1b
Opcode Fuzzy Hash: 69cc01ecf12743789462bb2c6dd97a148e8c105857e06f2264df907a72fed25f
Instruction Fuzzy Hash: 3201CCB1900B04DFE720DF7A98C5B97BAE8FB45254F104C2EE9AEC3301DA34A8048F20

Function 0588CCC0 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 05881420: HeapFree.KERNEL32(?,00000000,?,?,?,058840B1,?,00000000,05884039,?,7591DFA0,05883648), ref: 0588143D
Part of subcall function 05881420: _free.LIBCMT ref: 05881459

HeapDestroy.KERNEL32(00000000), ref: 0588CCD3
HeapCreate.KERNEL32(?,?,?), ref: 0588CCE5
_free.LIBCMT ref: 0588CCF5
HeapDestroy.KERNEL32 ref: 0588CD22

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: d48401cd17b23a450da6730c30cb3cf44a90b1ab4d37104ef219f99435977fed
Instruction ID: d274e119e02df049343d2f21ed25dc815cafb57435bafce029a3b899df32ff23
Opcode Fuzzy Hash: d48401cd17b23a450da6730c30cb3cf44a90b1ab4d37104ef219f99435977fed
Instruction Fuzzy Hash: 98F03CB92007029BE320AF24E848B63FBB8FF44710F104518EC56C7640DB34F851CBA0

Function 0040A2E4 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A2EB
new.LIBCMT ref: 0040A302

Part of subcall function 00409E21: __EH_prolog3.LIBCMT ref: 00409E28
Part of subcall function 00409E21: std::_Lockit::_Lockit.LIBCPMT ref: 00409E35
Part of subcall function 00409E21: __CxxThrowException@8.LIBVCRUNTIME ref: 00409E8B
Part of subcall function 00409E21: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00409E94

ctype.LIBCPMT ref: 0040A32D

Part of subcall function 0040A36E: __Getctype.LIBCPMT ref: 0040A37D
Part of subcall function 0040A36E: __Getcvt.LIBCPMT ref: 0040A38F

std::_Locinfo::~_Locinfo.LIBCPMT ref: 0040A337

Part of subcall function 00409EA5: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00409ECC
Part of subcall function 00409EA5: std::_Lockit::~_Lockit.LIBCPMT ref: 00409F3D

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$H_prolog3Locinfo::_Lockit$Exception@8GetctypeGetcvtLocinfoLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwctype
String ID:
API String ID: 137054408-0
Opcode ID: 37e2460600290bc7324e6d338c4ff336e261c3139884df18d7a4f63982ae1179
Instruction ID: b1a882ab031b0a6e660c2dd27d4948e8e787ca023142f20653bb959ff04e54dd
Opcode Fuzzy Hash: 37e2460600290bc7324e6d338c4ff336e261c3139884df18d7a4f63982ae1179
Instruction Fuzzy Hash: E5F030B19003069EDB14EFA5C49259EB7A4BF18704F60842FF909BB2C2DF7C5A448799

Function 0040A12F Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040A136
new.LIBCMT ref: 0040A14D

Part of subcall function 00409E21: __EH_prolog3.LIBCMT ref: 00409E28
Part of subcall function 00409E21: std::_Lockit::_Lockit.LIBCPMT ref: 00409E35
Part of subcall function 00409E21: __CxxThrowException@8.LIBVCRUNTIME ref: 00409E8B
Part of subcall function 00409E21: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00409E94

ctype.LIBCPMT ref: 0040A170

Part of subcall function 0040A0FA: __Getctype.LIBCPMT ref: 0040A115

std::_Locinfo::~_Locinfo.LIBCPMT ref: 0040A17A

Part of subcall function 00409EA5: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00409ECC
Part of subcall function 00409EA5: std::_Lockit::~_Lockit.LIBCPMT ref: 00409F3D

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: std::_$H_prolog3Locinfo::_Lockit$Exception@8GetctypeLocinfoLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwctype
String ID:
API String ID: 2334464816-0
Opcode ID: 3ccab37a23aa6f83a4e88f4d10bc8d100948e0d6ed8e5947f3fecc1ca2268b28
Instruction ID: 396627fd31e0b88194369139e07c1f859b2d7b0e060b00cf3b2f78f25742c17a
Opcode Fuzzy Hash: 3ccab37a23aa6f83a4e88f4d10bc8d100948e0d6ed8e5947f3fecc1ca2268b28
Instruction Fuzzy Hash: 8AF05E715003099EDB00EFA5C88699E7374AF54704F60843FB809BB2C2EF7C5E418799

Function 0040C466 Relevance: 6.0, APIs: 4, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C46D
new.LIBCMT ref: 0040C476
SysAllocString.OLEAUT32(?), ref: 0040C497
_com_issue_error.COMSUPP ref: 0040C4AD

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: AllocH_prolog3String_com_issue_error
String ID:
API String ID: 818911185-0
Opcode ID: 9f840b7efd5b874153f4ab90fefe84b951d03f73a419947a7c6dd9b109c86dec
Instruction ID: 735d60f3b89fb8fa2707d030bba645655ec1efb4cce8ddbd16b75693e231a0c3
Opcode Fuzzy Hash: 9f840b7efd5b874153f4ab90fefe84b951d03f73a419947a7c6dd9b109c86dec
Instruction Fuzzy Hash: 12F09671401712DBD7205F64C94576AB660AF00725F21822FF9546A2C1DBBC8940C7A8

Function 0040C40C Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040C413
new.LIBCMT ref: 0040C41C
_com_util::ConvertStringToBSTR.COMSUPP ref: 0040C43D
_com_issue_error.COMSUPP ref: 0040C457

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: ConvertH_prolog3String_com_issue_error_com_util::
String ID:
API String ID: 1487652900-0
Opcode ID: 875acc07987b29fb107b9825acf1b7cce1e49a21829fc6d177c4c4e1cfa1b28f
Instruction ID: 8c7e6a351b7f4733df93f66e31383111bb1fc1088f32a56a3e266ec526b497d9
Opcode Fuzzy Hash: 875acc07987b29fb107b9825acf1b7cce1e49a21829fc6d177c4c4e1cfa1b28f
Instruction Fuzzy Hash: FFF08972401321DBD7216F64C4517AAB661AF10728F31821EF9557B2C1D7B8494087DD

Function 0041D6C8 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 0041D6C8
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0041D6CD
___vcrt_initialize_locks.LIBVCRUNTIME ref: 0041D6D2

Part of subcall function 0041DA89: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0041DA9A

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 0041D6E7

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 4620ded051c162a4ab368f0813539878333b42ab7183a8981c68f5926920f08c
Instruction ID: 14806c7f250ec3626344af4879b1366c9576fbdb1d4d95a577f50898cf21947d
Opcode Fuzzy Hash: 4620ded051c162a4ab368f0813539878333b42ab7183a8981c68f5926920f08c
Instruction Fuzzy Hash: 4EC048F4C18A05611C10BAB72A025EE03200CA27CEB9524CBF9CA1B20B8D0E05CBA83F

Function 0042410D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0042419D

Strings

pow, xrefs: 00424175, 00424192

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: e5e82ffe086c981db9afb31094810e73edfc3309b85f83be6859e0d5b6128b63
Instruction ID: 189da1eceaaa8123b2eafa8983f7637ae16cf0e11565192851021ce7acfc06a0
Opcode Fuzzy Hash: e5e82ffe086c981db9afb31094810e73edfc3309b85f83be6859e0d5b6128b63
Instruction Fuzzy Hash: D8516861B1812596CB11BB14FD8637F7B94DB90740FA0596BE081823E9DE3C8CE59A8E

Function 00432B40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

>3C, xrefs: 00432B53
>3C, xrefs: 00432BD0, 00432CC7

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID:
String ID: >3C$>3C
API String ID: 0-3801535234
Opcode ID: 38464908b481d69f937ad94f196b31f0b6eee8f1eb4fe71198e47b4ab4eb7552
Instruction ID: 12e52974e394cac54a72286938c568d5ad8dbb484fd8cc99b5da34793fccba5c
Opcode Fuzzy Hash: 38464908b481d69f937ad94f196b31f0b6eee8f1eb4fe71198e47b4ab4eb7552
Instruction Fuzzy Hash: E1510A31A04255EBCB20CF54D991B6EB7B0FF19320F24916BD5589B3D0D3B89982C7D9

Function 00424786 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042488C
_free.LIBCMT ref: 00424896

Strings

C:\Users\user\Desktop\Wk6IMAhBNF.exe, xrefs: 004247B8, 004247BF, 004247EE, 00424826

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: _free
String ID: C:\Users\user\Desktop\Wk6IMAhBNF.exe
API String ID: 269201875-76231843
Opcode ID: a2204e26124afb59e109e3562998905899498828fdb93cae4cca61aeb0aed4a2
Instruction ID: d28aafec6ce904aa0ef55ce62c2edf42dfbfe93860beb333fdfc34f057bfea3d
Opcode Fuzzy Hash: a2204e26124afb59e109e3562998905899498828fdb93cae4cca61aeb0aed4a2
Instruction Fuzzy Hash: E7319375B00268EFDB21EF99E88499EBBF8EFC6310B50406BE40497211D7749E41CB58

Function 004062D1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004062D8
__CxxThrowException@8.LIBVCRUNTIME ref: 00406339

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

J, xrefs: 00406329

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID: J
API String ID: 1841272387-1141589763
Opcode ID: 21ccc6eb26e3514dd02dc366ebec23d5d77ad26cf889ffa905f28f2c01f6c566
Instruction ID: bd142b150e7d5f7b1d6d20f2e9f65cd08ff92f8dc46682db57dc9730bd17271b
Opcode Fuzzy Hash: 21ccc6eb26e3514dd02dc366ebec23d5d77ad26cf889ffa905f28f2c01f6c566
Instruction Fuzzy Hash: EF210BB7985B8CAFE310E6C5585DBB6B76CE31672BF204B37E562D12D0C77800028691

Function 0040686D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00406874
__CxxThrowException@8.LIBVCRUNTIME ref: 004068D5

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

., xrefs: 004068C8

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID: .
API String ID: 1841272387-248832578
Opcode ID: df488ffe395492a7805ad43ceb01c0eaa1b880c4131f3f59d55ce9b09a0377c7
Instruction ID: e5c55011ddf896b15ad970a0273a1d11157de5090f95664c0b4d7624cbe3adba
Opcode Fuzzy Hash: df488ffe395492a7805ad43ceb01c0eaa1b880c4131f3f59d55ce9b09a0377c7
Instruction Fuzzy Hash: 61210DB79C5A8CAFE310EAC5585DB7677ACE31673BF200737E552D2790D62844418190

Function 0040803F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00408046
__CxxThrowException@8.LIBVCRUNTIME ref: 004080A4

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

J, xrefs: 00408094

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID: J
API String ID: 1841272387-1141589763
Opcode ID: c3818944ac7596b4264a46947aa60dd8051a880f47ff73396ff69b8cbee30cf5
Instruction ID: 56ade25a5ef2ed7a3fde89bbd09d82a5c4e53b822f81685480d03e47512ca7b9
Opcode Fuzzy Hash: c3818944ac7596b4264a46947aa60dd8051a880f47ff73396ff69b8cbee30cf5
Instruction Fuzzy Hash: 04212B77989B8CAFE310E6C55C59BB6B7ACE316B3BF200B37E551D2280C77C00018591

Function 00404A53 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00404A5D
__CxxThrowException@8.LIBVCRUNTIME ref: 00404AC6

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

Q, xrefs: 00404AB0

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catch_ThrowUser
String ID: Q
API String ID: 2496864217-3463352047
Opcode ID: a18495e538ca8df67fbf7f549a35c935356fae9502840ff7da9844c1083b05de
Instruction ID: 12ea4b6d12ca5ea5f4f8bf261031fdeadcb1a468b35f8689ed9a9963d225adf1
Opcode Fuzzy Hash: a18495e538ca8df67fbf7f549a35c935356fae9502840ff7da9844c1083b05de
Instruction Fuzzy Hash: AF2126B3989B8CAFE320EAC59C5DBB6B7ACE306737F200B67E415D22D0C77845418A54

Function 00402746 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0040274D
__CxxThrowException@8.LIBVCRUNTIME ref: 004027A6

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Strings

6, xrefs: 00402799

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: DispatcherExceptionException@8H_prolog3_catchThrowUser
String ID: 6
API String ID: 1841272387-498629140
Opcode ID: 3a03316ee69d087bb876c30cd0bc8d4327f6de08990793fd5fa26647a4f13ea3
Instruction ID: 3c57e26f9aefef52b14ca4f69f2468dec3002322f978c6b7ece63b7feb34ed34
Opcode Fuzzy Hash: 3a03316ee69d087bb876c30cd0bc8d4327f6de08990793fd5fa26647a4f13ea3
Instruction Fuzzy Hash: 5C11E677988A48AFE320EBC59C59FB6B7ACE306B3AF300B37F512D6790D76854008594

Function 00401D5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00401D61
__CxxThrowException@8.LIBVCRUNTIME ref: 00401DBA

Part of subcall function 0041B2CA: KiUserExceptionDispatcher.NTDLL(?,?,?,?), ref: 0041B329

Part of subcall function 0040194B: __EH_prolog3_catch.LIBCMT ref: 00401952
Part of subcall function 0040194B: __CxxThrowException@8.LIBVCRUNTIME ref: 004019AB

Strings

C, xrefs: 00401DAA

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3_catchThrow$DispatcherExceptionUser
String ID: C
API String ID: 1909432332-1037565863
Opcode ID: b683ac18e3245f6b6a9a26d77790b351e86832feaa3594ecdf31e8f52a301825
Instruction ID: 6fb9e9940292d7d9457c01b70f608ec0d70ea234a51dbbc2a8c4d82ba037bf5c
Opcode Fuzzy Hash: b683ac18e3245f6b6a9a26d77790b351e86832feaa3594ecdf31e8f52a301825
Instruction Fuzzy Hash: 9311387798864CAFE720EAC59C56BBAB7ACE302B36F300B37F511D26C0D72C44008194

Function 0588B17E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0588BBD0: GetDesktopWindow.USER32 ref: 0588BBEF
Part of subcall function 0588BBD0: GetDC.USER32(00000000), ref: 0588BBFC
Part of subcall function 0588BBD0: CreateCompatibleDC.GDI32(00000000), ref: 0588BC02
Part of subcall function 0588BBD0: GetDC.USER32(00000000), ref: 0588BC0D
Part of subcall function 0588BBD0: GetDeviceCaps.GDI32(00000000,00000008), ref: 0588BC1A
Part of subcall function 0588BBD0: GetDeviceCaps.GDI32(00000000,00000076), ref: 0588BC22
Part of subcall function 0588BBD0: ReleaseDC.USER32(00000000,00000000), ref: 0588BC33
Part of subcall function 0588BBD0: GetSystemMetrics.USER32(0000004C), ref: 0588BCD8
Part of subcall function 0588BBD0: GetSystemMetrics.USER32(0000004D), ref: 0588BCED
Part of subcall function 0588BBD0: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0588BD06
Part of subcall function 0588BBD0: SelectObject.GDI32(?,00000000), ref: 0588BD14
Part of subcall function 0588BBD0: SetStretchBltMode.GDI32(?,00000003), ref: 0588BD20
Part of subcall function 0588BBD0: GetSystemMetrics.USER32(0000004F), ref: 0588BD2D
Part of subcall function 0588BBD0: GetSystemMetrics.USER32(0000004E), ref: 0588BD40

Part of subcall function 0588F5F7: _malloc.LIBCMT ref: 0588F611

_memset.LIBCMT ref: 0588B1C2
swprintf.LIBCMT ref: 0588B1E5

Strings

%s %s, xrefs: 0588B1D4

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memsetswprintf
String ID: %s %s
API String ID: 1028806752-581060391
Opcode ID: bcd66b8e0de4932203ade4df959862d87008c33010fe12d7ae96ef2ffe9a4f2a
Instruction ID: 27c6fc130e089fbe05d8ee30f598e9062ce9d109fbe2b5ea39b56eb16bf90b5c
Opcode Fuzzy Hash: bcd66b8e0de4932203ade4df959862d87008c33010fe12d7ae96ef2ffe9a4f2a
Instruction Fuzzy Hash: FA21E1B2A04341ABE611FE189C84E6BB7E8EFD5600F08452EFC89D6201E6719D09C7A3

Function 0041461E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00414625

Part of subcall function 00414782: __EH_prolog3_GS.LIBCMT ref: 00414789

Part of subcall function 0040FA39: std::_Deallocate.LIBCONCRT ref: 0040FA69

new.LIBCMT ref: 0041468E

Strings

?A^, xrefs: 00414683

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: H_prolog3_$Deallocatestd::_
String ID: ?A^
API String ID: 2283364142-1641652588
Opcode ID: 1d23dea81c4e98d75ac3add1cd86394256747e2509eb1a1ce4c850a5a4cd0506
Instruction ID: 994f9a054eef8c1c1bab20b20b6dd4485cfecc21ef81bf349a33104e299d0cff
Opcode Fuzzy Hash: 1d23dea81c4e98d75ac3add1cd86394256747e2509eb1a1ce4c850a5a4cd0506
Instruction Fuzzy Hash: 62219271E006089BDB14DFA9C451BDEF7F5AF58314F20812EE915A7381CB78A949CB94

Function 058890F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 05889105

Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE3E
Part of subcall function 0588EE29: __CxxThrowException@8.LIBCMT ref: 0588EE53
Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE64

std::_Xinvalid_argument.LIBCPMT ref: 05889118

Strings

string too long, xrefs: 05889100, 05889113

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 0803e36d07f046bf3558ee8e165b34f5db3c581b673722e3714ff0f5aa63cfa1
Instruction ID: a5c5cfee5c31d9fe553160efa3d96072e64c771312dc5b833a4c6045d8569592
Opcode Fuzzy Hash: 0803e36d07f046bf3558ee8e165b34f5db3c581b673722e3714ff0f5aa63cfa1
Instruction Fuzzy Hash: 6811CB797087409BD331EE1CD844A36B7E5EBD1621F100A6AE991C7741C776FC05C7A1

Function 058893E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0588940D
std::_Xinvalid_argument.LIBCPMT ref: 0588943A

Strings

invalid string position, xrefs: 05889435

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 343aec70f23c3b7778124432c1719552bab2fad92a224a7f9aac7f9d687acd30
Instruction ID: bfcef7b4f2fa22f86b1507a629514daf3c7ae9a319fd1e601cf30030b77858d8
Opcode Fuzzy Hash: 343aec70f23c3b7778124432c1719552bab2fad92a224a7f9aac7f9d687acd30
Instruction Fuzzy Hash: F301A2323043056BD724FE6CD884BBAB399EB50624F104A29E956CBA80D7B1AD44C7A2

Function 0588F6AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 0588F705

Part of subcall function 0588F80B: __getptd_noexit.LIBCMT ref: 0588F80B

Strings

B, xrefs: 0588F6FE

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 5bc75878e19a99f8b3291bc09011d637415e77d2edc72ea821797cd9c84227ee
Instruction ID: e215ed737104d085d97f353b057d8ab7607c4b1a61873669d036d12cac3ff309
Opcode Fuzzy Hash: 5bc75878e19a99f8b3291bc09011d637415e77d2edc72ea821797cd9c84227ee
Instruction Fuzzy Hash: F7016D75A0424DAFEF00AFA8CC05BFEBBB4FB44364F040116ED25E6290D7749941DBA5

Function 05889560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0588956F

Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EE8B
Part of subcall function 0588EE76: __CxxThrowException@8.LIBCMT ref: 0588EEA0
Part of subcall function 0588EE76: std::exception::exception.LIBCMT ref: 0588EEB1

_memmove.LIBCMT ref: 058895A5

Strings

invalid string position, xrefs: 0588956A

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 6db54662acb1df0bb36b866dc040bcacdd31bff65827a82680281b5e66a36e21
Instruction ID: cb2edecf55787628d4a154087c93372fc127f08c7fc4a7a3a63eaa1e58cdf083
Opcode Fuzzy Hash: 6db54662acb1df0bb36b866dc040bcacdd31bff65827a82680281b5e66a36e21
Instruction Fuzzy Hash: E801A2313043019BD725EE6CEC94A3AB3E7DBC5608B244E2CD892CBB49D6B0DC4A4790

Function 0588D100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0588D114

Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE3E
Part of subcall function 0588EE29: __CxxThrowException@8.LIBCMT ref: 0588EE53
Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE64

_memmove.LIBCMT ref: 0588D14D

Strings

vector<T> too long, xrefs: 0588D10F

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 16c6f307e4c31d62be50dfed548a680f7ec3d5e3f729bfefae6158776132e85b
Instruction ID: 37e8ea338ebdcb8a52462dd29f36eacd9f9d89fb479649e48e0aede10cb8f4a1
Opcode Fuzzy Hash: 16c6f307e4c31d62be50dfed548a680f7ec3d5e3f729bfefae6158776132e85b
Instruction Fuzzy Hash: B601B5766602055BE700EE6DF8EA87ABB9CE640210B14062AFC05D7380EB38BC04C691

Function 05888420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 05888433

Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE3E
Part of subcall function 0588EE29: __CxxThrowException@8.LIBCMT ref: 0588EE53
Part of subcall function 0588EE29: std::exception::exception.LIBCMT ref: 0588EE64

_memmove.LIBCMT ref: 0588845E

Strings

vector<T> too long, xrefs: 0588842E

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: a8def76b33f6a24b0ab0043daef7666a1a3cb1c18f8880c43e6f839a98414080
Instruction ID: 3af64b2a552103f9588efe803a85c1d7fe55fee0a841314a3cdd3640ab4acc91
Opcode Fuzzy Hash: a8def76b33f6a24b0ab0043daef7666a1a3cb1c18f8880c43e6f839a98414080
Instruction Fuzzy Hash: 6E018FB270430A9FDB24EEA8DC95C3AB3D8EB54214754492DE89AC3340E635FC00CB61

Function 058A05C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0589FFFA: __getptd.LIBCMT ref: 058A0000
Part of subcall function 0589FFFA: __getptd.LIBCMT ref: 058A0010

__getptd.LIBCMT ref: 058A05D3

Part of subcall function 05893D4B: __getptd_noexit.LIBCMT ref: 05893D4E
Part of subcall function 05893D4B: __amsg_exit.LIBCMT ref: 05893D5B

__getptd.LIBCMT ref: 058A05E1

Strings

csm, xrefs: 058A05EF

Memory Dump Source

Source File: 00000000.00000002.4460155852.0000000005880000.00000040.00001000.00020000.00000000.sdmp, Offset: 05880000, based on PE: true

Associated: 00000000.00000002.4460155852.00000000058B4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5880000_Wk6IMAhBNF.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: ab45b7028b632d56cbb7048a11012baae2c6a5cbc7e83483af1ba82223dcda62
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 71012C36901305CFEF289F6AC45CA6DB3B5BF94219F58481DD882D6590CF349D81CEA2

Function 0040AAE7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040AB2D

Part of subcall function 00414B1C: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00414B28
Part of subcall function 00414B1C: __CxxThrowException@8.LIBVCRUNTIME ref: 00414B36

Part of subcall function 00414B5C: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00414B68
Part of subcall function 00414B5C: __CxxThrowException@8.LIBVCRUNTIME ref: 00414B76

Strings

invalid stoi argument, xrefs: 0040AB28
stoi argument out of range, xrefs: 0040AB32

Memory Dump Source

Source File: 00000000.00000002.4457048912.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4457031381.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457077071.0000000000438000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457097434.0000000000439000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457126629.000000000044D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000452000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457145910.0000000000454000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457189053.000000000046B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457210193.000000000046D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457231771.0000000000481000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457246358.0000000000482000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457264153.000000000048A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457284792.0000000000490000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457334913.000000000051E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457353911.000000000051F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457371889.0000000000521000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457390726.0000000000522000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457408244.0000000000523000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.4457425861.0000000000524000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wk6IMAhBNF.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument$Xinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 2589434974-1606216832
Opcode ID: aa4968aba13a43a5c16a699d1b1b55d0bc9c810550d94cbb7f684cd8eff8e7fc
Instruction ID: 58f874d3dd26a64f0c691c3d6c0e84d97b5bb4d828d09f02d86860d651299440
Opcode Fuzzy Hash: aa4968aba13a43a5c16a699d1b1b55d0bc9c810550d94cbb7f684cd8eff8e7fc
Instruction Fuzzy Hash: AFF0E232600224BBDB14BA89E803A997369DF82315B41017BF44467152DAB87D908BBE

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wk6IMAhBNF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Wk6IMAhBNF.exe

Function 0040DC56 Relevance: 93.2, APIs: 5, Strings: 48, Instructions: 486
COMMON

Function 05885430 Relevance: 91.4, APIs: 40, Strings: 12, Instructions: 429
stringnetworklibraryCOMMON

Function 0588DE70 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 332
sleepregistrysynchronizationCOMMON

Function 0588BBD0 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Function 05886A40 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Function 0040CB1E Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 129
COMMON

Function 05887480 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Function 0040D249 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 135
COMMON

Function 05889E40 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Function 05882DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Function 0588ACF0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 347
registryCOMMON

Function 05886120 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 222
stringcomregistryCOMMON

Function 05885F10 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88
sleepstringsynchronizationCOMMON

Function 0040C806 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 238
comCOMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre