Edit tour

Windows Analysis Report
drop1.exe

Overview

General Information

Sample name:	drop1.exe
Analysis ID:	1584392
MD5:	cf2ac2dce038a884fce94f9350327033
SHA1:	a2d1c361993e3b1b3289e4905287cb2c9a1714de
SHA256:	6d38c8152edc5634fa7cae67424a5b28e1dca4b1037d99704c331c91faca77b7
Tags:	exeuser-juroots
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

drop1.exe (PID: 4836 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: CF2AC2DCE038A884FCE94F9350327033)

conhost.exe (PID: 3492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

drop1.exe (PID: 3444 cmdline: "C:\Users\user\Desktop\drop1.exe" MD5: CF2AC2DCE038A884FCE94F9350327033)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "1", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: drop1.exe PID: 3444	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: drop1.exe PID: 3444	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.drop1.exe.1416e20.1.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.1416e20.1.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
2.2.drop1.exe.400000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.drop1.exe.400000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
2.2.drop1.exe.400000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.drop1.exe.400000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
0.2.drop1.exe.1416e20.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.drop1.exe.1416e20.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
Click to see the 3 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T11:54:10.969583+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49733	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T11:54:10.969583+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.974496+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49733	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T11:54:10.969583+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.974496+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49733	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.drop1.exe.1416e20.1.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "1", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: drop1.exe	Virustotal: Detection: 78%			Perma Link
Source: drop1.exe	ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047A610 CryptUnprotectData,LocalFree,	2_2_0047A610
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043D4A0 BCryptDestroyKey,	2_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047A950 CryptProtectData,LocalFree,	2_2_0047A950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	2_2_0047AAE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00440B60 CryptUnprotectData,LocalFree,	2_2_00440B60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AE10 BCryptCloseAlgorithmProvider,	2_2_0047AE10
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	2_2_0047AE80
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A3123B CryptContextAddRef,	2_2_00A3123B

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A436A9 FindFirstFileExW,	0_2_00A436A9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A4375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A4375A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49733 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49733 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.4:49308 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49733 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

2_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: drop1.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: drop1.exe, 00000002.00000003.1782810357.000000000110D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1783620887.000000000110D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1979975777.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1781335416.0000000001112000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1781374886.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: drop1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: drop1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: drop1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: drop1.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: drop1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: drop1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: drop1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: drop1.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: drop1.exe, 00000002.00000002.1980297371.000000000130E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979361344.000000000130B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979420774.000000000130C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adob/1.0/.Y
Source: drop1.exe, 00000002.00000003.1979361344.000000000130B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979420774.000000000130C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.co2/t/Re
Source: drop1.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: drop1.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/d
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org2
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: drop1.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: drop1.exe, 00000002.00000003.1790572642.0000000004220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.moz
Source: drop1.exe, 00000002.00000003.1790572642.0000000004219000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B28000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B78000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047E2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790425715.0000000004858000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047DA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B20000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.0000000004825000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: drop1.exe, 00000002.00000003.1784605548.00000000047D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: drop1.exe, 00000002.00000003.1784605548.00000000047B1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784851444.000000000115E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784605548.000000000478B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: drop1.exe, 00000002.00000003.1784605548.00000000047D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: drop1.exe, 00000002.00000003.1784605548.00000000047B1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784851444.000000000115E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784605548.000000000478B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: drop1.exe, 00000002.00000003.1790572642.0000000004219000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B28000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B78000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047E2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790425715.0000000004858000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047DA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B20000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.0000000004825000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: drop1.exe, 00000002.00000003.1790572642.0000000004220000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B2F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: drop1.exe, 00000002.00000003.1790572642.0000000004220000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B88000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B2F000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.drop1.exe.1416e20.1.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.drop1.exe.1416e20.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		2_2_0048A0A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		2_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A31000	0_2_00A31000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A34C8C	0_2_00A34C8C
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A46F3A	0_2_00A46F3A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004422D0	2_2_004422D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043A2B0	2_2_0043A2B0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00446400	2_2_00446400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00488400	2_2_00488400
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043E4F0	2_2_0043E4F0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004395D0	2_2_004395D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00487780	2_2_00487780
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00485840	2_2_00485840
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043C970	2_2_0043C970
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004479C0	2_2_004479C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00459A06	2_2_00459A06
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046EB70	2_2_0046EB70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046BCE0	2_2_0046BCE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00439D60	2_2_00439D60
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00470EF0	2_2_00470EF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043BF70	2_2_0043BF70
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462080	2_2_00462080
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004320A0	2_2_004320A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004A70A7	2_2_004A70A7
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0042D150	2_2_0042D150
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00479130	2_2_00479130
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00474190	2_2_00474190
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461250	2_2_00461250
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00408270	2_2_00408270
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6380	2_2_004B6380
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462410	2_2_00462410
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045C4C0	2_2_0045C4C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043D4A0	2_2_0043D4A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0047E580	2_2_0047E580
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0046B620	2_2_0046B620
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00468750	2_2_00468750
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00419770	2_2_00419770
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045C700	2_2_0045C700
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004917CA	2_2_004917CA
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045D7A0	2_2_0045D7A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004627A0	2_2_004627A0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0049687E	2_2_0049687E
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6870	2_2_004B6870
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043A800	2_2_0043A800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00493800	2_2_00493800
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0049F8A2	2_2_0049F8A2
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461940	2_2_00461940
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00445950	2_2_00445950
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00478990	2_2_00478990
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ACA4B	2_2_004ACA4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00406AE0	2_2_00406AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B3AE0	2_2_004B3AE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00430AF0	2_2_00430AF0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0048AA80	2_2_0048AA80
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00414AA0	2_2_00414AA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0045EAA0	2_2_0045EAA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00476AB6	2_2_00476AB6
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00462B50	2_2_00462B50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00482C4B	2_2_00482C4B
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004BCC40	2_2_004BCC40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00461CC0	2_2_00461CC0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00478D40	2_2_00478D40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B6D30	2_2_004B6D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B1D30	2_2_004B1D30
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00440DE0	2_2_00440DE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0043AE50	2_2_0043AE50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_0042EEA0	2_2_0042EEA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00406F40	2_2_00406F40
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00444F50	2_2_00444F50
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00443F00	2_2_00443F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00456F00	2_2_00456F00
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00412FA0	2_2_00412FA0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A31000	2_2_00A31000
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A34C8C	2_2_00A34C8C
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A46F3A	2_2_00A46F3A

Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 004517F0 appears 53 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 00A35190 appears 91 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 00A3F534 appears 34 times
Source: C:\Users\user\Desktop\drop1.exe	Code function: String function: 00A3B767 appears 42 times

Source: drop1.exe

Static PE information: invalid certificate

Source: drop1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.drop1.exe.1416e20.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.drop1.exe.1416e20.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: drop1.exe	Static PE information: Section: .bss ZLIB complexity 1.0003138195647467
Source: drop1.exe	Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/2

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

2_2_0048CB50

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_004473D0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

2_2_00477EE0

Source: C:\Users\user\Desktop\drop1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E696363D80FD0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3492:120:WilError_03

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: drop1.exe	Virustotal: Detection: 78%
Source: drop1.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\drop1.exe

File read: C:\Users\user\Desktop\drop1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"
Source: C:\Users\user\Desktop\drop1.exe	Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: drop1.exe

Static file information: File size 2537088 > 1048576

Source: drop1.exe	Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00
Source: drop1.exe	Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: drop1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE

Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: drop1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A3326B pushad ; retf	0_2_00A3326D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A3534A push ecx; ret	0_2_00A3535D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A56ECF push ss; ret	0_2_00A56EDC
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ACE0C push ecx; ret	2_2_004ACE1F
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A422C7 push ecx; iretd	2_2_00A422C8
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A3534A push ecx; ret	2_2_00A3535D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A485CD push esi; ret	2_2_00A485CF

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

2_2_0047E240

Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-60760

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A436A9 FindFirstFileExW,	0_2_00A436A9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A4375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00A4375A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

2_2_00498574

Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: drop1.exe, 00000002.00000003.1783663510.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1782852697.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1979975777.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[As
Source: drop1.exe, 00000002.00000003.1783663510.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1782852697.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000002.1979975777.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\drop1.exe	API call chain: ExitProcess graph end node			graph_0-13464
Source: C:\Users\user\Desktop\drop1.exe	API call chain: ExitProcess graph end node			graph_2-60780

Source: C:\Users\user\Desktop\drop1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

2_2_0048A710

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00A35020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A35020

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

2_2_00498574

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A5519E mov edi, dword ptr fs:[00000030h]	0_2_00A5519E
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A31614 mov edi, dword ptr fs:[00000030h]	0_2_00A31614
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A31614 mov edi, dword ptr fs:[00000030h]	2_2_00A31614

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00A3FE2C GetProcessHeap,

0_2_00A3FE2C

Source: C:\Users\user\Desktop\drop1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A35020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A35020
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A35014 SetUnhandledExceptionFilter,	0_2_00A35014
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A3B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A3B4B9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 0_2_00A34C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A34C64
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004AC6BF
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004AC80A SetUnhandledExceptionFilter,	2_2_004AC80A
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00497B2D
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004ABFD4
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A35020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A35020
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A35014 SetUnhandledExceptionFilter,	2_2_00A35014
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A3B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A3B4B9
Source: C:\Users\user\Desktop\drop1.exe	Code function: 2_2_00A34C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A34C64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00A5519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00A5519E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\drop1.exe

Memory written: C:\Users\user\Desktop\drop1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

2_2_0047D2F0

Source: C:\Users\user\Desktop\drop1.exe

Process created: C:\Users\user\Desktop\drop1.exe "C:\Users\user\Desktop\drop1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_00486C50 cpuid

2_2_00486C50

Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	0_2_00A43086
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	0_2_00A430D1
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00A43178
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A42A13
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	0_2_00A3F21C
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	0_2_00A4327E
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A42CFF
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	0_2_00A42C64
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	0_2_00A42FB1
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	0_2_00A3F717
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	0_2_00A42F52
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004A6109
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_004B824D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_004A620F
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A62E5
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_0049C70E
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C67
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1A
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1C
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_0049CCB0
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_004A5D02
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A5D8D
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_004A5FE0
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_00A43086
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_00A430D1
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00A43178
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_00A3F21C
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_00A4327E
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_00A3F717
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A42A13
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00A42CFF
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_00A42C64
Source: C:\Users\user\Desktop\drop1.exe	Code function: GetLocaleInfoW,	2_2_00A42FB1
Source: C:\Users\user\Desktop\drop1.exe	Code function: EnumSystemLocalesW,	2_2_00A42F52

Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\drop1.exe

Code function: 0_2_00A359A7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A359A7

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004863F0 GetUserNameW,

2_2_004863F0

Source: C:\Users\user\Desktop\drop1.exe

Code function: 2_2_004A1074 GetTimeZoneInformation,

2_2_004A1074

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 3444, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.1416e20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.1416e20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 3444, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: drop1.exe, 00000002.00000002.1979975777.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\Local Storage\leveldbs\|+
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\drop1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\drop1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: drop1.exe PID: 3444, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.drop1.exe.1416e20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.drop1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.drop1.exe.1416e20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: drop1.exe PID: 3444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
drop1.exe	79%	Virustotal		Browse
drop1.exe	76%	ReversingLabs	Win32.Spyware.Meduzastealer

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://api.ipify.org2	0%	Avira URL Cloud	safe
http://ns.microsoft.co2/t/Re	0%	Avira URL Cloud	safe
https://support.moz	0%	Avira URL Cloud	safe
http://ns.adob/1.0/.Y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	drop1.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	drop1.exe	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	drop1.exe	false		high
http://ocsp.sectigo.com0	drop1.exe	false		high
https://api.ipify.org2	drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	drop1.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	drop1.exe, 00000002.00000003.1784006302.000000000478D000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784006302.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.0000000004774000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.co2/t/Re	drop1.exe, 00000002.00000003.1979361344.000000000130B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979420774.000000000130C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	drop1.exe, 00000002.00000003.1784605548.00000000047D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	drop1.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	drop1.exe, 00000002.00000003.1784605548.00000000047D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	drop1.exe, 00000002.00000003.1790425715.000000000485F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	drop1.exe	false		high
https://api.ipify.org	drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.moz	drop1.exe, 00000002.00000003.1790572642.0000000004220000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	drop1.exe	false		high
https://api.ipify.org/d	drop1.exe, 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	drop1.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	drop1.exe, 00000002.00000003.1784605548.00000000047B1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784851444.000000000115E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784605548.000000000478B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.adob/1.0/.Y	drop1.exe, 00000002.00000002.1980297371.000000000130E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979361344.000000000130B000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1979420774.000000000130C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	drop1.exe, 00000002.00000003.1790572642.0000000004219000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B28000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B78000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047E2000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790425715.0000000004858000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.00000000047DA000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789452784.0000000003B20000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1789672860.0000000004825000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1790222997.0000000003B80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	drop1.exe, 00000002.00000003.1784605548.00000000047B1000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784851444.000000000115E000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784605548.000000000478B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	drop1.exe, 00000002.00000003.1784152367.0000000001164000.00000004.00000020.00020000.00000000.sdmp, drop1.exe, 00000002.00000003.1784201858.000000000478D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	drop1.exe, 00000002.00000003.1794443745.000000000117A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	drop1.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584392
Start date and time:	2025-01-05 11:53:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	drop1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 80 Number of non-executed functions: 136
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.173	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.74.152
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	104.26.12.205
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	104.26.12.205
	Statement of Account - USD 16,720.00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	104.26.13.205
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	104.223.10.34
	1.elf	Get hash	malicious	Unknown	Browse	72.11.146.74
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	162.220.9.64
	Hilix.ppc.elf	Get hash	malicious	Mirai	Browse	45.199.228.221
	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	45.199.228.219
CLOUDFLARENETUS	avaydna.exe	Get hash	malicious	Njrat	Browse	104.17.25.14
	HateSpeech2024_Summary.pdf.lnk.bin.lnk	Get hash	malicious	Emmenhtal Loader, MalLnk	Browse	104.21.2.79
	paint.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	hkMUtKbCqV.exe	Get hash	malicious	Unknown	Browse	162.159.135.234
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	104.21.43.44
	3jL3mqtjCn.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	172.67.219.93
	elyho3x5zz.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	104.26.13.205
	c2.hta	Get hash	malicious	Remcos	Browse	104.26.13.205
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.26.13.205
	HGwpjJUqhW.exe	Get hash	malicious	GhostRat	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.97910480270726
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	drop1.exe
File size:	2'537'088 bytes
MD5:	cf2ac2dce038a884fce94f9350327033
SHA1:	a2d1c361993e3b1b3289e4905287cb2c9a1714de
SHA256:	6d38c8152edc5634fa7cae67424a5b28e1dca4b1037d99704c331c91faca77b7
SHA512:	635c847a0dba3dea3a902ab2394f466c7230e5d355c5a2aa6364b83fd7f9ab6bcc194d2dc6ae6d3b3b9623bfe110d3222bfddb2b5987ca77d95b7d871ef7a1df
SSDEEP:	49152:mGnxuIaLAA4B6oztxtwt81xuIaLAA4B6oztxtwt8N:mi1NvztxuG1NvztxuU
TLSH:	22C5236235D59031DCA35071EDE2D370CB2EB920A771BEDBA384063E5B121D6A77A32D
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@...........................&...........@..................................7..<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x405952
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67601EA3 [Mon Dec 16 12:35:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2ab4b10182ffafd3eedee95a25f64213

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	31/08/2023 01:00:00 31/08/2026 00:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F8B78AFCA0Ah
jmp 00007F8B78AFC879h
mov ecx, dword ptr [004257C0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F8B78AFCA06h
test esi, ecx
jne 00007F8B78AFCA28h
call 00007F8B78AFCA31h
mov ecx, eax
cmp ecx, edi
jne 00007F8B78AFCA09h
mov ecx, BB40E64Fh
jmp 00007F8B78AFCA10h
test esi, ecx
jne 00007F8B78AFCA0Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004257C0h], ecx
not ecx
pop edi
mov dword ptr [00425800h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [004239D8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00423990h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042398Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00423A20h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00426AA8h
call dword ptr [004239F8h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F8B78B019BAh
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23798	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a000	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x268800	0x2e80	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b000	0x1940	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1fe58	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1cde8	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23928	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a89c	0x1aa00	2c90bf01d6a75cfa91195eab195cb511	False	0.5897795627934272	data	6.625714555730625	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0x8b24	0x8c00	d082dcd702b8cfd5c38fc05ef266a1f7	False	0.3864955357142857	xBase (0xa) DBF * 0, update-date 170-1-3, with index file .MDX, with memo .FPT	4.662128172849137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25000	0x226c	0x1600	982bdad040c9e55617b82cb91da6c951	False	0.39417613636363635	data	4.554102284484849	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bsS	0x28000	0x53	0x200	f5c8cf64c90793e21e616701e55b6530	False	0.17578125	data	1.411880155989052	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.tls	0x29000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a000	0xe8	0x200	267fca3a548bff3d326d56604fef4ee6	False	0.306640625	data	2.344915704357875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b000	0x1940	0x1a00	ad27a2fd39c0f74f88141246becd5b06	False	0.7587139423076923	data	6.513010283131139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x2d000	0x120a00	0x120a00	efbff3ab6ace47c3f7ec21199d5a24af	False	1.0003138195647467	data	7.999828133959274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x14e000	0x120a00	0x120a00	efbff3ab6ace47c3f7ec21199d5a24af	False	1.0003138195647467	data	7.999828133959274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x2a060	0x87	XML 1.0 document, ASCII text	English	United States	0.8222222222222222

Imports

DLL

Import

ADVAPI32.dll

CryptContextAddRef

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T11:54:10.969583+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.969583+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.969583+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.974496+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49733	66.63.187.173	15666	TCP
2025-01-05T11:54:10.974496+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49733	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 11:54:07.142132044 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:07.147100925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:07.147173882 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:07.212558985 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.212578058 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.212807894 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.230053902 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.230068922 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.689429998 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.689512014 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.741281033 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.741292000 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.741569996 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.741624117 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.744940996 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.787337065 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.848509073 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.848551035 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.848552942 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:07.848594904 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.849226952 CET	49734	443	192.168.2.4	104.26.13.205
Jan 5, 2025 11:54:07.849236965 CET	443	49734	104.26.13.205	192.168.2.4
Jan 5, 2025 11:54:10.969583035 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.974416971 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974427938 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974442959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974452019 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974459887 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974495888 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.974596977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974606037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974662066 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.974674940 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974684000 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974750042 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.974780083 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.974836111 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979360104 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979368925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979377985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979396105 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979404926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979415894 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979435921 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979482889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979491949 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979517937 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979520082 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979563951 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979588032 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979597092 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979633093 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979662895 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979702950 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.979722977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.979826927 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984239101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984298944 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984308004 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984316111 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984390020 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984390974 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984400034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984409094 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984415054 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984448910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984489918 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984505892 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984539986 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984549999 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984559059 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984627962 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984638929 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984647989 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984663963 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984669924 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984673023 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984684944 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984704971 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984725952 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984743118 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984796047 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984802008 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984816074 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984824896 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984833002 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984857082 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984862089 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984869003 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984873056 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984888077 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984895945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.984920979 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.984950066 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989130020 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989140034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989156961 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989165068 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989173889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989188910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989196062 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989239931 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989248991 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989284039 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989288092 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989305973 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989322901 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989331007 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989339113 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989367008 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989396095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989404917 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989422083 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989453077 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989460945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989470005 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989480019 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989490032 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989512920 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989521027 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989553928 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989562988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989568949 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989578009 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989613056 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989626884 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989634991 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989666939 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989686966 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989696980 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989700079 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989706993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989739895 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989764929 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989773989 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989782095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989783049 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989840031 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989842892 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989850044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989857912 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989866972 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989892960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989897013 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989903927 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989911079 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989912033 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989921093 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989934921 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989974022 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.989979029 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989988089 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.989996910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990005016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990020037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990027905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990039110 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990060091 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990071058 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990077972 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990086079 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990088940 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990102053 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990109921 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990120888 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990128994 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990140915 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990144014 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990154028 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990163088 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990165949 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990180016 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990185022 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990195036 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990202904 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990211964 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990212917 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990236044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990238905 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990245104 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990253925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990255117 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990262985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990291119 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990326881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990336895 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990345001 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990354061 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.990362883 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990377903 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.990466118 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994092941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994102955 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994126081 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994134903 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994144917 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994154930 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994178057 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994179010 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994214058 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994227886 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994237900 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994239092 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994254112 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994262934 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994287968 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994309902 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994318962 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994321108 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994371891 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994410992 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994430065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994437933 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994446039 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994453907 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994462967 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994477987 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994486094 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994494915 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994494915 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994504929 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994527102 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994532108 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994541883 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994541883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994585037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994594097 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994615078 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994623899 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994632959 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994653940 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994661093 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994663954 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994707108 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994716883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994733095 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994756937 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994761944 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994765997 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994775057 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994784117 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994798899 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994807005 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994813919 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994823933 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994832993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994843006 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994851112 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994858027 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994868994 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994873047 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994878054 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994900942 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994909048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994910002 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.994976997 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.994992971 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995002031 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995029926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995038986 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995059967 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995100021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995104074 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995110035 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995119095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995126963 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995136023 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995151997 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995161057 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995182037 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995184898 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995197058 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995204926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995213032 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995213985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995239019 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995259047 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995333910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995343924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995353937 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995362997 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995372057 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995381117 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995388985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995397091 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995404959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995409012 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995412111 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995429993 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995436907 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995445967 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995460987 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995470047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995476961 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995481014 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995485067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995493889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995502949 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995503902 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995531082 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995544910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995554924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995563984 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995573044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995580912 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995580912 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995589972 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995598078 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995599031 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995615005 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995624065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995631933 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995641947 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995651007 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995651960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995660067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995668888 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995695114 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995737076 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995747089 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995754957 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995764017 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995771885 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995780945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995795965 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995800018 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995805025 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995814085 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995822906 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995826960 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995832920 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995842934 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995883942 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995903969 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995914936 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995923042 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995930910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995939016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995946884 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995958090 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995961905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995971918 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995974064 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.995980978 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995990038 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.995999098 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996002913 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996011972 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996015072 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996025085 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996033907 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996036053 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996042967 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996052980 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996053934 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996074915 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996084929 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996093035 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996093988 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996102095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996109009 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996113062 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996129990 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996138096 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996141911 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996146917 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996155977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996161938 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996174097 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996181965 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996189117 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996198893 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996220112 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996256113 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996265888 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996273041 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996280909 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996290922 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.996290922 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.996315956 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999293089 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999304056 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999320030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999397039 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999407053 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999448061 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999449015 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999458075 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999475002 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999484062 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999491930 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999497890 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999505997 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999532938 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999608040 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999618053 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999624968 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999634027 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999641895 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999651909 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999660015 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999665976 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999667883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999685049 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999713898 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999723911 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999731064 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999739885 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999744892 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999748945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999758959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999761105 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999775887 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999784946 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999794006 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999804974 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999824047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999833107 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999841928 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999864101 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999866009 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999874115 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999882936 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999906063 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999955893 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999960899 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:10.999965906 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999974966 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999983072 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999990940 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:10.999999046 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000014067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000014067 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000022888 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000025988 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000031948 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000049114 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000057936 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000066042 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000073910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000072002 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000082970 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000092030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000099897 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000099897 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000112057 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000124931 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000133038 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000140905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000149012 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000164032 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000179052 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000211954 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000221014 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000236034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000241041 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000247955 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000257015 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000264883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000273943 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000276089 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000283003 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000298023 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000298977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000308037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000309944 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000317097 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000325918 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000333071 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000356913 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000402927 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000412941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000417948 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000422955 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000432968 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000439882 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000447989 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000457048 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000469923 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000474930 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000484943 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000494003 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000502110 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000507116 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000526905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000535965 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000543118 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000544071 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000552893 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000557899 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000564098 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000574112 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000575066 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000582933 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000591993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000607967 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000616074 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000623941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000627995 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000633001 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000648975 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000650883 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000658035 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000667095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000674009 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000674963 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000713110 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000740051 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.000744104 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000808001 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.000991106 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001000881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001008987 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001017094 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001032114 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001039982 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001048088 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001056910 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001065016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001070976 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001113892 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001167059 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001177073 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001183987 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001193047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001200914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001208067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001223087 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001228094 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001231909 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001240969 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001250029 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001265049 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001274109 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001274109 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001281977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001313925 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001333952 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001344919 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001353025 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001358032 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001382113 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001413107 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001420975 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001422882 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001540899 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001710892 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001719952 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001728058 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001735926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001743078 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001750946 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001765966 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001775026 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001782894 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001782894 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001791954 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001799107 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001801014 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001810074 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001820087 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001822948 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001830101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001835108 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001843929 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001857996 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.001878977 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.001946926 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.045841932 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.046171904 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046231985 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046288013 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046329975 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046389103 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046446085 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046489000 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046550035 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046591043 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046648026 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046690941 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046753883 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.046789885 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.062172890 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.062393904 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.062465906 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.062514067 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.062572002 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.062603951 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.067209959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.067390919 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.067456961 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.067487955 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.109683990 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.110965967 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.158818007 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.159039974 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159101009 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159141064 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159193039 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159233093 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159281969 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159328938 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159389973 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159439087 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159501076 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.159513950 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.163944006 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.164144039 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.164208889 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.164242029 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.209788084 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.210038900 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.217187881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.217380047 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.217441082 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.217483044 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.217534065 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.222274065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.222429991 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.222507954 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.222544909 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.265738964 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.265790939 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292009115 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.292107105 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.292200089 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292309999 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292371988 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292459011 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292510033 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292574883 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292628050 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292686939 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.292707920 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.297076941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.297236919 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.337758064 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.337842941 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.354968071 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.355065107 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.355190039 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355257034 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355309963 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355370998 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355428934 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355511904 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355581999 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355655909 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.355685949 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360081911 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.360302925 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360388041 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360450983 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360513926 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360568047 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360631943 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.360650063 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.405766010 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.405915976 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414041996 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.414264917 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414323092 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414374113 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414426088 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414469957 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414519072 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414561033 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414608002 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414654970 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414714098 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414753914 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414819002 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414861917 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414916992 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.414953947 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419107914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419118881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419137001 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419158936 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419182062 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419187069 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419197083 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419214010 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419225931 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419234991 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419258118 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419282913 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419306993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419321060 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419337988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419369936 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419441938 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419451952 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419459105 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419466972 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419475079 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419482946 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419490099 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419506073 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419513941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419533014 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419557095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419565916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419567108 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419574022 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419584036 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419600964 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419605017 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419609070 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419637918 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419680119 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419689894 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419698000 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419706106 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419717073 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419723034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419733047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419732094 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419787884 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419817924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419826984 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419836998 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419846058 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419852972 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419861078 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419867992 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419903040 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419913054 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419915915 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419919968 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419929028 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419948101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419955969 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419970036 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.419970989 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.419980049 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420001984 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420005083 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420016050 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420017004 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420039892 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420047998 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420077085 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420079947 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420097113 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420113087 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420118093 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420120955 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420155048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420177937 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420186996 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420207977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420216084 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420239925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420243025 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420248985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420278072 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420291901 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420300007 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420301914 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420382023 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420388937 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420398951 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420407057 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420414925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420440912 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420511007 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420512915 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420521975 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420531034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420541048 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420548916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420557976 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420572042 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420578003 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420583010 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420591116 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420602083 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420610905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420618057 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420619011 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420629025 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420636892 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420689106 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420698881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420700073 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420707941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420716047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420723915 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420732021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420739889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420739889 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420747995 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420763969 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420773029 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420773983 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420804024 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420804977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420815945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420816898 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420819998 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420830965 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420839071 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420845985 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420860052 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420867920 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420867920 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420880079 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420886993 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420888901 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420906067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420914888 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420923948 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.420958042 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420969009 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.420975924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421003103 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421101093 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421111107 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421118021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421124935 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421128988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421132088 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421135902 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421155930 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421164036 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421170950 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421179056 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421192884 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421200037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421204090 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421207905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421216011 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421221018 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421224117 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421226025 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421256065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421258926 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421264887 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421268940 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421272993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421294928 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421303988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421308041 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421329021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421341896 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421361923 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421391964 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421401978 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421410084 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421412945 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421495914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421504974 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421508074 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421519041 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421521902 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421565056 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421574116 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421597004 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421606064 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421627998 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421681881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421691895 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.421715021 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.421843052 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.466856003 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.467170000 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467672110 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467730045 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467768908 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467818975 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467860937 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467907906 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.467947006 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468010902 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468053102 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468100071 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468138933 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468204021 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468250990 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468316078 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468360901 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468415022 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468456984 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468506098 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.468523979 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.477696896 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477766991 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477786064 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477793932 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477803946 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477818966 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477838993 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.477875948 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477885008 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.477885008 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477902889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477927923 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477936029 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477950096 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477958918 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477982998 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.477993965 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478015900 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478040934 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478049994 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478063107 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478070021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478075027 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478084087 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478122950 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478122950 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478137970 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478147984 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478214979 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478245020 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478254080 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478260040 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478266954 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478291988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478300095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478301048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478353977 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478363037 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478372097 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478384972 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478388071 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478399038 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478413105 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478430033 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478458881 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478467941 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478480101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478490114 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478492022 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478516102 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478523016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478527069 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478549957 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478554964 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478579044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478620052 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478627920 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478668928 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478677034 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478691101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478712082 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478715897 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478753090 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478771925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478780031 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478787899 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478816986 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478825092 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478832960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478857040 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478889942 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478915930 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478931904 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478939056 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478951931 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478957891 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478965998 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478980064 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.478982925 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.478993893 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479013920 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479017019 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479026079 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479044914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479048967 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479063988 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479073048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479084015 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479094028 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479120016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479126930 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479129076 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479176044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479183912 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479191065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479229927 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479238033 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479245901 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479248047 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479279995 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479288101 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479300022 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479324102 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479331970 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479351044 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479357958 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479360104 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479367971 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479379892 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479433060 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479440928 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479445934 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479486942 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479494095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479504108 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479511023 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479525089 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479532957 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479556084 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479588032 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479597092 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479604006 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479612112 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479619980 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479648113 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479652882 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479662895 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479677916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479686022 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479707956 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479717016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479727983 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479752064 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479774952 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479783058 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479790926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479806900 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479808092 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479816914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479830980 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479840994 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479846954 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479865074 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479867935 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479883909 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479899883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479918003 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479926109 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479932070 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.479944944 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.479959965 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480025053 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480026007 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480035067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480041981 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480050087 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480052948 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480071068 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480077982 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480078936 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480098009 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480107069 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480110884 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480134964 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480139971 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480156898 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480207920 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480216980 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480223894 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480227947 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480228901 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480267048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480278969 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480288029 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480302095 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480309010 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480324030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480335951 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480376959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480386019 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480400085 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480405092 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480408907 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480420113 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480432987 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480436087 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480473995 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480496883 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480505943 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480513096 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480526924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480535030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480559111 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480566025 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480577946 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480591059 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480612040 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480669022 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480676889 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480684042 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480690956 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480696917 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480700016 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480710030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480710983 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480721951 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480734110 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480742931 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480751991 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480767012 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480798960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480813026 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480813980 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480823040 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480849028 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480871916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480880976 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480887890 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480901957 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480910063 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480932951 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480936050 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480940104 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480962038 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.480973005 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480982065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.480994940 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481005907 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481020927 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481040955 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481071949 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481072903 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481082916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481091976 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481128931 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481144905 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481153011 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481161118 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481178045 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481223106 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481230021 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481231928 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481239080 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481255054 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481277943 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481292009 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481300116 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481319904 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481338978 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481368065 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481375933 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481389999 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481396914 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481419086 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481426954 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481435061 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481456041 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481461048 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481482983 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481489897 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481513023 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481520891 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481547117 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481561899 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481570959 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481581926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481590986 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481606960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481612921 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481635094 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481638908 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481657028 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481662035 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481698990 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481708050 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481714964 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481756926 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481766939 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481779099 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481786013 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481787920 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481796026 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481815100 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481836081 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481844902 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481848001 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481895924 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481905937 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481911898 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481919050 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481931925 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481961966 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.481981039 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481988907 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.481992960 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482008934 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482017040 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482027054 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482045889 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.482065916 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482075930 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482081890 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.482115030 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482124090 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482131004 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482147932 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.482192993 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482202053 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482212067 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482218981 CET	15666	49733	66.63.187.173	192.168.2.4
Jan 5, 2025 11:54:11.482228994 CET	49733	15666	192.168.2.4	66.63.187.173
Jan 5, 2025 11:54:11.482237101 CET	15666	49733	66.63.187.173	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 11:54:07.195625067 CET	192.168.2.4	1.1.1.1	0x378e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 11:54:07.202430010 CET	1.1.1.1	192.168.2.4	0x378e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 5, 2025 11:54:07.202430010 CET	1.1.1.1	192.168.2.4	0x378e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 5, 2025 11:54:07.202430010 CET	1.1.1.1	192.168.2.4	0x378e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.26.13.205	443	3444	C:\Users\user\Desktop\drop1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 10:54:07 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-05 10:54:07 UTC	424	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 10:54:07 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8fd2edb2b90d7d05-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2091&min_rtt=1943&rtt_var=835&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1502830&cwnd=195&unsent_bytes=0&cid=df368f3a209bae22&ts=169&x=0"
2025-01-05 10:54:07 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	05:53:53
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0xa30000
File size:	2'537'088 bytes
MD5 hash:	CF2AC2DCE038A884FCE94F9350327033
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:53:53
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:54:06
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\drop1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drop1.exe"
Imagebase:	0xa30000
File size:	2'537'088 bytes
MD5 hash:	CF2AC2DCE038A884FCE94F9350327033
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1979975777.0000000001098000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2%
Total number of Nodes:	1786
Total number of Limit Nodes:	23

Executed Functions

Function 00A5519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00A55110,00A55100), ref: 00A55334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00A55347
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 00A55365
ReadProcessMemory.KERNELBASE(0000010C,?,00A55154,00000004,00000000), ref: 00A55389
VirtualAllocEx.KERNELBASE(0000010C,?,?,00003000,00000040), ref: 00A553B4
WriteProcessMemory.KERNELBASE(0000010C,00000000,?,?,00000000,?), ref: 00A5540C
WriteProcessMemory.KERNELBASE(0000010C,00400000,?,?,00000000,?,00000028), ref: 00A55457
WriteProcessMemory.KERNELBASE(0000010C,?,?,00000004,00000000), ref: 00A55495
Wow64SetThreadContext.KERNEL32(0000008C,00E70000), ref: 00A554D1
ResumeThread.KERNELBASE(0000008C), ref: 00A554E0

Strings

ResumeThread, xrefs: 00A552D8
CreateProcessW, xrefs: 00A55250
ress, xrefs: 00A55226
SetThreadContext, xrefs: 00A552C2
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00A55333
Load, xrefs: 00A551DA
VirtualAlloc, xrefs: 00A55263
GetThreadContext, xrefs: 00A55276
WriteProcessMemory, xrefs: 00A552AF
ReadProcessMemory, xrefs: 00A55289
aryA, xrefs: 00A551E2
VirtualAllocEx, xrefs: 00A5529C
TerminateProcess, xrefs: 00A553C3
GetP, xrefs: 00A5521E

Memory Dump Source

Source File: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: a244eec38381f53e8ccb1554ca702baf08321115f45514bc0b5ca3083d933bc7
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 49B1077264064AAFDB60CF68CC80BDA73A5FF88715F158124EA0CAB341D774FA55CB94

Function 00A31614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A31675
GetFileSize.KERNEL32(00000000,00000000), ref: 00A31685
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00A316AB
CloseHandle.KERNELBASE(00000000), ref: 00A316BA
_strlen.LIBCMT ref: 00A31705
CloseHandle.KERNEL32(00000000), ref: 00A31805

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: File$CloseHandle$CreateReadSize_strlen
String ID:
API String ID: 1158390869-0
Opcode ID: 85aa641e573c8d6752378e22f8846b43a925aae028bde1e0b640cbad4f40099c
Instruction ID: 2e38e665e5b47aa0eedbf0a5f945e2f571f6a7968a065f1aae7265b06cbbbeda
Opcode Fuzzy Hash: 85aa641e573c8d6752378e22f8846b43a925aae028bde1e0b640cbad4f40099c
Instruction Fuzzy Hash: 4251FEB29043009BD700EF24DC85B2EBBE5FF88354F154A2DF88997252EB34E9458B62

Function 00A3155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00A3158B

Part of subcall function 00A3123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00A312C7

VirtualProtect.KERNELBASE(00A55011,00000549,00000040,?), ref: 00A315D7
ExitProcess.KERNEL32 ref: 00A3160E

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ConsoleDispatcherExceptionExitFreeProcessProtectUserVirtual
String ID:
API String ID: 1011651897-0
Opcode ID: 3faad6ea0e13aa4970f94ccf4c2ac13543921558d1962a7aff5f1edc11eb815c
Instruction ID: 98add4c229803cd8db06d93d0b8ebc8a200c9dfb6cdaab7615cc88a3a670b2b2
Opcode Fuzzy Hash: 3faad6ea0e13aa4970f94ccf4c2ac13543921558d1962a7aff5f1edc11eb815c
Instruction Fuzzy Hash: 6B11E372E00208ABEB00ABA59C52BBF7768FF85301F404425F908A7291E675AD154BE1

Function 00A3123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00A312C7

Strings

[+], xrefs: 00A312E1

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: [+]
API String ID: 6842923-4228040803
Opcode ID: 2f755d89029a6b5e1b040ecaff60019269738b6030ad02bdcef24161bb0436a0
Instruction ID: 29ff27674052fe35efbbc13f7f1f392d897bca75ae7c9326b9f6ecf994580a08
Opcode Fuzzy Hash: 2f755d89029a6b5e1b040ecaff60019269738b6030ad02bdcef24161bb0436a0
Instruction Fuzzy Hash: 2331093150C3804FD716AB74A8997EBBBD0BFBD318F18097DE8C987243D1615446CB62

Function 00A45283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A4562D: GetConsoleOutputCP.KERNEL32(1742AD29,00000000,00000000,?), ref: 00A45690

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00A3BBF3,?), ref: 00A45408
GetLastError.KERNEL32(?,?,00A3BBF3,?,00A3BE37,00000000,?,00000000,00A3BE37,?,?,?,00A54628,0000002C,00A3BD23,?), ref: 00A45412

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 82822c8e0d2eb71417e0e8246d8cdc4e62ade44f56e8c15be2f2352056b40ac8
Instruction ID: 92f69ab90aae3d2e83ac4d011aa7553abe97a6c1bbc91f8ac8d02fd82c8726b3
Opcode Fuzzy Hash: 82822c8e0d2eb71417e0e8246d8cdc4e62ade44f56e8c15be2f2352056b40ac8
Instruction Fuzzy Hash: AC61C27AD00619AFDF11CFB8C984AEEBBBABF89344F140155E900AB253D371DA45CB60

Function 00A45A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00A453EE,00000000,00A3BE37,?,00000000,?,00000000), ref: 00A45AF8
GetLastError.KERNEL32(?,00A453EE,00000000,00A3BE37,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00A3BBF3), ref: 00A45B1E

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 9ae3412d406646cdb84bf7280d9af145ab0cf28f3cbb46b9585c01548b3de4ef
Instruction ID: 9976a8407a32bddea768a36fe24c9c5006f3c4588abbe8fb5334e8eb311d1bf2
Opcode Fuzzy Hash: 9ae3412d406646cdb84bf7280d9af145ab0cf28f3cbb46b9585c01548b3de4ef
Instruction Fuzzy Hash: 96218035E006199BCF15CF69DD849E9B7B9FB88341F2441A9E906D7212E6309E46CF60

Function 00A3FF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00A3FE78,00A54948), ref: 00A3FFD5
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00A3FE78,00A54948), ref: 00A3FFE7

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 60679cbc01a743366b7a59bf88645a5119ec8aee40767857487893131451cb28
Instruction ID: 9fb7cb5f07541a0b35efcb865a9811afac9d3e073d21e746882800e4ae797a21
Opcode Fuzzy Hash: 60679cbc01a743366b7a59bf88645a5119ec8aee40767857487893131451cb28
Instruction Fuzzy Hash: 681172759147514ECB308B3D9C88B22BAA5A7D6330F38072EE6B7875F1C330D946E651

Function 00A3136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00A31388

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 9e1107721e47c8f5bb44c7dcdd2bb3d908a353ad91f0cd6360978b00b8c5ec9b
Instruction ID: 84a29e8b02ffb1e7640970112206018aad54b5dfb04277f06b0a2e09a5d056e4
Opcode Fuzzy Hash: 9e1107721e47c8f5bb44c7dcdd2bb3d908a353ad91f0cd6360978b00b8c5ec9b
Instruction Fuzzy Hash: E3519E713042048FCB14DF6CC994B6AB7E6EF88768F198668F969CB392D630ED05CB41

Function 00A33C0B Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 2db25939a48ce3064d53dc3846d77184a4eaf1e7849f4226592b61f381e35c23
Instruction ID: d18efc7fcc286877e0adb626f0b45f059a988f15ee37823977d956c20400543b
Opcode Fuzzy Hash: 2db25939a48ce3064d53dc3846d77184a4eaf1e7849f4226592b61f381e35c23
Instruction Fuzzy Hash: A931D87390811AAFCF11DFA8D9949EDB7B8BF09324F145666F402F3690DB21EA44CB50

Function 00A33C29 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a1645dbf8aa3377b3ff8bb593b1d69a95ee5b16748dd56bc29cfc2aab44f3b
Instruction ID: f8fd1eb13caf52fa521935577bc8697734bf31f8ed17969ce548cbb19d7357be
Opcode Fuzzy Hash: b9a1645dbf8aa3377b3ff8bb593b1d69a95ee5b16748dd56bc29cfc2aab44f3b
Instruction Fuzzy Hash: C1118F32608606EFCF08CF29E4909A9B3F5BF49324B60566DE802D7690DB31FA54CB90

Function 00A33C1B Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 3ea73b1645683f5b09456736a35afa41192eae603db40fca3c853cd996b0084e
Instruction ID: c93a3538c985dc035879c32df081fb6024d9e7fff51e96e583d016a15b6d5762
Opcode Fuzzy Hash: 3ea73b1645683f5b09456736a35afa41192eae603db40fca3c853cd996b0084e
Instruction Fuzzy Hash: E0F0283760C2564ACF45CB7CEA667ACBB60FF86334F24915FF412D94D1CA124A55C310

Function 00A3E531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00A331E1,00A3186A,?,00A360C1,00A3186C,00A3186A,?,?,?,00A33181,00A331E1,00A3186E,00A3186A,00A3186A,00A3186A), ref: 00A3E563

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83298f9d8c8f6da4d8b4d9d7501c02db3712ccd5e1dd47111e5cd384e2b38602
Instruction ID: 486f9d10c397bb5cc9ce88186c0b1bbac174caf49523d7e940572caa7c03eb6b
Opcode Fuzzy Hash: 83298f9d8c8f6da4d8b4d9d7501c02db3712ccd5e1dd47111e5cd384e2b38602
Instruction Fuzzy Hash: 04E02231A4122457DB30EBA9AC01B5A3A4CAF417F8F140120FC46E70D1FB61CD0082B0

Non-executed Functions

Function 00A43178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A42B49,00000002,00000000,?,?,?,00A42B49,?,00000000), ref: 00A43211
GetLocaleInfoW.KERNEL32(?,20001004,00A42B49,00000002,00000000,?,?,?,00A42B49,?,00000000), ref: 00A4323A
GetACP.KERNEL32(?,?,00A42B49,?,00000000), ref: 00A4324F

Strings

OCP, xrefs: 00A431CC
ACP, xrefs: 00A43196

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 9ed6ee8dc8d25704b1d7263d6bdf93c44f2695e15696a3f032909470795970f4
Instruction ID: d49d8a8879afe810d7751735bd993aaf06a6f69b8197ed2baf00ccd78099f4b7
Opcode Fuzzy Hash: 9ed6ee8dc8d25704b1d7263d6bdf93c44f2695e15696a3f032909470795970f4
Instruction Fuzzy Hash: 0221AC3B600101EADF348F68E905BEB73A6BFE4B51B268624E90AD7110E772DF41D350

Function 00A42A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00A42B1B
IsValidCodePage.KERNEL32(00000000), ref: 00A42B59
IsValidLocale.KERNEL32(?,00000001), ref: 00A42B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00A42BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00A42BCF

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 5f8576cc40f2f856cf334241ed765f2661259ec3b98ecceb1b0590a86fbf1c7e
Instruction ID: 2cebb25d7463f3634f39af6a6a6aa76e843fd3dbde9a79f0f32dd0ad6eecd653
Opcode Fuzzy Hash: 5f8576cc40f2f856cf334241ed765f2661259ec3b98ecceb1b0590a86fbf1c7e
Instruction Fuzzy Hash: FE517D76A00215AFDF21DFA4CC85BAE77B8FF94740F854469F900EB190EBB09A45CB61

Function 00A4375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A4384A

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: af20cae6ab848a087ea9e5c906d02ffc1fa94090574b9e08c6f283a0f5f449bd
Instruction ID: 602fa4cbe4807233ffbc21f6d82dddc0180ed9d97184a6906c619b9e6e9813aa
Opcode Fuzzy Hash: af20cae6ab848a087ea9e5c906d02ffc1fa94090574b9e08c6f283a0f5f449bd
Instruction Fuzzy Hash: F371E6BA905159AFDF20EF68CC9DAAEBBB8AF85300F1441DAE04993251DB714F859F10

Function 00A35020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A3502C
IsDebuggerPresent.KERNEL32 ref: 00A350F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A35111
UnhandledExceptionFilter.KERNEL32(?), ref: 00A3511B

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1768d5ac103420a924d1a2497add70d71a90f1434368e2737eb0c63f64da00ca
Instruction ID: 4953d4b3119afa4e89db6d2a5ecc32b39971cca95b1f42260a7eef8620979f4b
Opcode Fuzzy Hash: 1768d5ac103420a924d1a2497add70d71a90f1434368e2737eb0c63f64da00ca
Instruction Fuzzy Hash: 173114B5D053289BDF21EFA4D9497CDBBB8BF08340F1041AAE40DAB250EB719B858F44

Function 00A359A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A359B9
GetCurrentThreadId.KERNEL32 ref: 00A359C8
GetCurrentProcessId.KERNEL32 ref: 00A359D1
QueryPerformanceCounter.KERNEL32(?), ref: 00A359DE

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aa099a6cb5d468291ee548edd8d402f2da9df7f2c6a8bdd8c2039e5d1ddc9a4f
Instruction ID: 53d43602da9e60bc3695949c969fee92042a7199cbb4c7deb5d775830b2e0f5d
Opcode Fuzzy Hash: aa099a6cb5d468291ee548edd8d402f2da9df7f2c6a8bdd8c2039e5d1ddc9a4f
Instruction Fuzzy Hash: 3AF0AF71D1120CEBCF00DBF4C94998EFBF4FF5C241B918996A412E7110E670AB458F50

Function 00A42CFF Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A42D53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A42D9D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A42E63

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: ba89794c3459c8ef62f8d2b638cfeb3fa97279dad6acf4e4e471b538b34a741b
Instruction ID: 1e435e6cd91dbb48fd13a22a00a1716af03ff6094ec870ea3da3a2e9109c8561
Opcode Fuzzy Hash: ba89794c3459c8ef62f8d2b638cfeb3fa97279dad6acf4e4e471b538b34a741b
Instruction Fuzzy Hash: B261BC75910207EFDB38DF28CD82BAABBA8FF84301F94416AF905C6185E774DA94CB50

Function 00A3B4B9 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A3B5B1
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A3B5BB
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A3B5C8

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2aa71e7f863239ff97935967b3d033d78eb9f237daf79e8fe09b421e12df1544
Instruction ID: f798371bfc615aa9641c8afb7514fc912958a97619a35e159ad6cf59b2bde73d
Opcode Fuzzy Hash: 2aa71e7f863239ff97935967b3d033d78eb9f237daf79e8fe09b421e12df1544
Instruction Fuzzy Hash: EE31C1B5911228ABCB21DF68D98978CBBB8BF48310F5042EAE40CA6251E7709B818F54

Function 00A46F3A Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?), ref: 00A47167

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2c688348d05cde4d6334acec2f92664b73e8913eb71b10c11384fe6653fbcb57
Instruction ID: e347be15e7d26058c6ca3065364a77d0b0c0ef58d8e2294850d692c14fce5e24
Opcode Fuzzy Hash: 2c688348d05cde4d6334acec2f92664b73e8913eb71b10c11384fe6653fbcb57
Instruction Fuzzy Hash: 30B17D35614648DFD715CF28C48AB697BE0FF85364F258698E8D9CF2A1C336E981CB40

Function 00A34C8C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A34CA2

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a488239cfde598fc21e7528d5d89746bb8c3286f437492f1f5cd4b546a412a36
Instruction ID: 1b50ed0466562b7e72be4f50f3b8306a42ba74e77f0e6f25335b18caa4ca43c3
Opcode Fuzzy Hash: a488239cfde598fc21e7528d5d89746bb8c3286f437492f1f5cd4b546a412a36
Instruction Fuzzy Hash: DDA15CB1D21B05CBDB18CFA4D8966A9BBF1FB48315F28852AE415EB360D334A941CFD0

Function 00A436A9 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A3F807: HeapAlloc.KERNEL32(00000008,?,00A331E1,?,00A3E921,00000001,00000364,00A331E1,00000003,000000FF,?,00A360C1,00A3186C,00A3186A,?), ref: 00A3F848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A4384A
FindNextFileW.KERNEL32(00000000,?), ref: 00A4393E
FindClose.KERNEL32(00000000), ref: 00A4397D
FindClose.KERNEL32(00000000), ref: 00A439B0

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 8eff7345bd1f970c03fc3823cd684d0fd576178a391f405cd75892dbd103436a
Instruction ID: 8eca3dded93311f3efc54c46bdfd12d98727fa8e4c344eea79b20cf1475c3742
Opcode Fuzzy Hash: 8eff7345bd1f970c03fc3823cd684d0fd576178a391f405cd75892dbd103436a
Instruction Fuzzy Hash: F3519ABB900119AFDF14EF789C85EBEB7B9DFC5304F244199F45893241EA308E429B20

Function 00A42FB1 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A43005

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3623ef7eb058970474399d7f0303a941f2281e29b077f891da088b125bc1b51e
Instruction ID: f42bb682aa06d5f4a0726d55da7042c2c1681e15b7ac4a372fd5a442b30cbf7a
Opcode Fuzzy Hash: 3623ef7eb058970474399d7f0303a941f2281e29b077f891da088b125bc1b51e
Instruction Fuzzy Hash: 77218076601206ABDF28DB2ADD42ABB77A8EFC4711F10027AF901D6185EB74EE408B50

Function 00A430D1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A43125

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 18596f9f48ddead35fe93d676e27e4936a9156d5cc41379905cee3f6bf2a91b2
Instruction ID: 271c251e371c1ff04d115f0f340ce22be78dcd9352378d7398617628173584df
Opcode Fuzzy Hash: 18596f9f48ddead35fe93d676e27e4936a9156d5cc41379905cee3f6bf2a91b2
Instruction Fuzzy Hash: 5F11C277A11216ABDF14EB68DD42ABA77A8EF85310F10027AF505D7281EB74EE019B90

Function 00A42C64 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

EnumSystemLocalesW.KERNEL32(00A42CFF,00000001,00000000,?,-00000050,?,00A42AEF,00000000,-00000002,00000000,?,00000055,?), ref: 00A42CD6

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f25d161afac60c83639745c3d5aa71c3e2b71e5471f4ff2b9cbcd728ff92008a
Instruction ID: bf1af5f4375f6d0855702de74d6d954b9903f2527c3750a10e5161ab12b0eb16
Opcode Fuzzy Hash: f25d161afac60c83639745c3d5aa71c3e2b71e5471f4ff2b9cbcd728ff92008a
Instruction Fuzzy Hash: C211C23B2007059FDB18AF39C8A16BABB92FFC0358B55482CE94687A40D771B942D740

Function 00A4327E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A42F1B,00000000,00000000,?), ref: 00A432AA

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 53254847c7fec33f7c7e2b00b5b38e8b3268982e6f1101bbdc5a135f6d504c28
Instruction ID: 147a8a61bed7b21c4052d1976e28dc0816d0c3446438cd9b5b1037e6fb4cb738
Opcode Fuzzy Hash: 53254847c7fec33f7c7e2b00b5b38e8b3268982e6f1101bbdc5a135f6d504c28
Instruction Fuzzy Hash: 6901D63B600112BBDF189B64C807BFA3768EF90754F154529AC56A3180EAB1FF41C694

Function 00A42F52 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

EnumSystemLocalesW.KERNEL32(00A42FB1,00000001,?,?,-00000050,?,00A42AB7,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00A42F9C

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d6c6da0d6c547d612c56c1a1518c74330d83c91f7eded06669bddc8907f0de0f
Instruction ID: 29db2e354b320f11d8844db03659f895f9539671551a2a71bb4b6a3428f8a945
Opcode Fuzzy Hash: d6c6da0d6c547d612c56c1a1518c74330d83c91f7eded06669bddc8907f0de0f
Instruction Fuzzy Hash: 3BF0F63A2003046FDB149F799881B7A7BA1FFC0768F95842CF9454B680D7B1AC42C750

Function 00A3F717 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3B750: EnterCriticalSection.KERNEL32(-00023A67,?,00A38F5A,00000000,00A544D8,0000000C,00A38F13,?,?,00A3F83A,?,?,00A3E921,00000001,00000364,00A331E1), ref: 00A3B75F

EnumSystemLocalesW.KERNEL32(00A3F70A,00000001,00A54928,0000000C,00A3F118,-00000050), ref: 00A3F74F

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d4dbcf90fc7bc2be5f6b54e4d1ee0c2c7a64ac8cfc7b37ffcff2811937d1ac81
Instruction ID: 4bd2f26e8fb3089c9867aa20d9988916da6dc77280514d31e5db31165057eca5
Opcode Fuzzy Hash: d4dbcf90fc7bc2be5f6b54e4d1ee0c2c7a64ac8cfc7b37ffcff2811937d1ac81
Instruction Fuzzy Hash: E5F03772A14304EFD700EFA8E942B9D77B0FB48726F10452AF400DB2A0CB7959058F80

Function 00A43086 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

EnumSystemLocalesW.KERNEL32(00A430D1,00000001,?,?,?,00A42B11,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00A430BD

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 33d966d2ce9014ccfc67dff7e34432f325816afa03ac54ae2c36804ecdce3b95
Instruction ID: c8b228f5f74a5f278b3501ddb6431d5c4065546adfd14cef337b2e5046eacd83
Opcode Fuzzy Hash: 33d966d2ce9014ccfc67dff7e34432f325816afa03ac54ae2c36804ecdce3b95
Instruction Fuzzy Hash: 8BF0E53B700209A7CF08EF39D85566ABF94FFC1750F064458EA098B291C672AA82C790

Function 00A3F21C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00A3A4BC,?,20001004,00000000,00000002,?,?,00A393CE), ref: 00A3F250

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2d7f4f3d24b624342aaebb47750c9426e6067cf1bf2d08cb21984736f8f031b3
Instruction ID: c4b12585713236267efbce1aa22d0b0f8f18c3378d0e868b051e820d743fe122
Opcode Fuzzy Hash: 2d7f4f3d24b624342aaebb47750c9426e6067cf1bf2d08cb21984736f8f031b3
Instruction Fuzzy Hash: D5E04F76D10218FFCF126FA0DC05AEE7F25FF847A1F004420FD1565161CB718D21AA95

Function 00A35014 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00A35135), ref: 00A35019

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ee94a31860f9415440436a7bbfadb52b65f87dda8c5d58f2b027e1ba40112912
Instruction ID: 70214773c0d2bb0190c325fb5a96a66444b52d0c2a65ec7c642f0821c4c445ca
Opcode Fuzzy Hash: ee94a31860f9415440436a7bbfadb52b65f87dda8c5d58f2b027e1ba40112912
Instruction Fuzzy Hash:

Function 00A3FE2C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A3FE2C

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: bfd0a0a7cf8554cb97c0e963f6191ccb9d6b2be836404a1cfee0a51b8fff5437
Instruction ID: 4d738841fad71920dea7fd3f247497bb8063ac406a69468ead25f77eee9a534d
Opcode Fuzzy Hash: bfd0a0a7cf8554cb97c0e963f6191ccb9d6b2be836404a1cfee0a51b8fff5437
Instruction Fuzzy Hash: C5A01270901300CB4740CF7569046083B9875402C23044014A000C1020D72084415F00

Function 00A31000 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0e134041470e9fe284de6385fc1cd4d990d422bbc9f06d2e93a1de301e933c
Instruction ID: 35acbf0795dc401913ea8fb6acdf251d79747ac678701367bb77e374d4024b89
Opcode Fuzzy Hash: 5f0e134041470e9fe284de6385fc1cd4d990d422bbc9f06d2e93a1de301e933c
Instruction Fuzzy Hash: C71149323185610797AC9F28ADE503B7B97D7C71A4B25927DE8268F6D2E533CC83C294

Function 00A4A222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00EEFE18,00EEFE18,00000000,7FFFFFFF,?,00A4A20D,00EEFE18,00EEFE18,00000000,00EEFE18,?,?,?,?,00EEFE18,00000000), ref: 00A4A2C8
__alloca_probe_16.LIBCMT ref: 00A4A383
__alloca_probe_16.LIBCMT ref: 00A4A412
__freea.LIBCMT ref: 00A4A45D
__freea.LIBCMT ref: 00A4A463
__freea.LIBCMT ref: 00A4A499
__freea.LIBCMT ref: 00A4A49F
__freea.LIBCMT ref: 00A4A4AF

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b9615825a7d10d6b71d16e3e8464953bca7d4f6c53ca8ca4bcdddb4002c30358
Instruction ID: 50474bbc6f56ac8646396bf24752b5c67265841b5fa4f15ce352197a04af6547
Opcode Fuzzy Hash: b9615825a7d10d6b71d16e3e8464953bca7d4f6c53ca8ca4bcdddb4002c30358
Instruction Fuzzy Hash: 64710B7AE402059BDF219FA4CD45BEF7BBA9FE5310F244055F904AB281E7B5DC408762

Function 00A354C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00A3550C
__alloca_probe_16.LIBCMT ref: 00A35538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00A35577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A35594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A355D3
__alloca_probe_16.LIBCMT ref: 00A355F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00A35632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A35655

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 3841b413877272000eb3f6da4f873c1a18e37e2409d7b3362cc0d0e1526957f3
Instruction ID: e8df6e1eb66534cdddaeb6c0e242295024abf26a5a4b0cf48a0f5a39e34e07ae
Opcode Fuzzy Hash: 3841b413877272000eb3f6da4f873c1a18e37e2409d7b3362cc0d0e1526957f3
Instruction Fuzzy Hash: BF519172E00606AFEF209FB8CC46FBA7BBAEF80790F594425F905A6150D731DD118B90

Function 00A361E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A36217
___except_validate_context_record.LIBVCRUNTIME ref: 00A3621F
_ValidateLocalCookies.LIBCMT ref: 00A362A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A362D3
_ValidateLocalCookies.LIBCMT ref: 00A36328

Strings

csm, xrefs: 00A362BD

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f380553b7c01ebdaf6049ad25608e816263731a03584027a791230cbd7b820b7
Instruction ID: 747edec0d50c29a3d518d976d6a3b9bcc08ec68398f312da59d32a8e17c022c8
Opcode Fuzzy Hash: f380553b7c01ebdaf6049ad25608e816263731a03584027a791230cbd7b820b7
Instruction Fuzzy Hash: BA418F34E00218ABCF10DFA8C885ADEBBB5FF49324F15C555F9189B392D771AA06CB91

Function 00A3F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A3F578,00A3186A,?,00000000,00A331E1,00A3186C,?,00A3F1F6,00000022,FlsSetValue,00A4DFE0,00A4DFE8,00A331E1), ref: 00A3F52A

Strings

ext-ms-, xrefs: 00A3F4D4
api-ms-, xrefs: 00A3F4C0

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e76c3dd61ae6f929b1cf38d4197032f9c587e462863fff09c47465610e8776af
Instruction ID: 050bd25531daedaa5f609857a28c1faf6d2fd30404c506762cae1b1391f3f110
Opcode Fuzzy Hash: e76c3dd61ae6f929b1cf38d4197032f9c587e462863fff09c47465610e8776af
Instruction Fuzzy Hash: 4521A576E12311AFCF21DFA5EC45A5B7768AB817A5F244131FD16A7290E730EE01C6D0

Function 00A3D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A3D2B7,00A35FB7,00A35179), ref: 00A3D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A3D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A3D2F5
SetLastError.KERNEL32(00000000,00A3D2B7,00A35FB7,00A35179), ref: 00A3D347

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c23b975c9b26182ebcc09e162848bbe767eb26e2a16b39b1350dd843cba4754d
Instruction ID: ba9c96b39cdf5139265ba1cdb6b49ce4fc66dfc8d984bc356880c025bfd57858
Opcode Fuzzy Hash: c23b975c9b26182ebcc09e162848bbe767eb26e2a16b39b1350dd843cba4754d
Instruction Fuzzy Hash: A6017B32A0E711DFE7256BF47DC686B2A94FF417B6F200329F130590E0EF119C029281

Function 00A3DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A3DCA7
CallUnexpected.LIBVCRUNTIME ref: 00A3DF20

Strings

csm, xrefs: 00A3DBC5
csm, xrefs: 00A3DC32
csm, xrefs: 00A3DCDE

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: d01afdf39097f4691087decbb4c53d2d201c698b933d77187b4a55a4e758207f
Instruction ID: 5782ef8f235052db752ec50d92a82c88668f0becee8a64b488b130c83520eb98
Opcode Fuzzy Hash: d01afdf39097f4691087decbb4c53d2d201c698b933d77187b4a55a4e758207f
Instruction Fuzzy Hash: 2DB16871800209EFCF29DFA4E9819AEBBB5FF14310F24455AF8116B216D771EA61CF91

Function 00A38042 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\drop1.exe, xrefs: 00A3805E

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\drop1.exe
API String ID: 0-3875088153
Opcode ID: 3d2be88024b31be7807458e25accf6a65352ea610bd93b554db748ec6d521f6d
Instruction ID: 9f0f0121498f3c35e47f46e0ac93128ee22bb4cb69b4f969e07e3581bb054050
Opcode Fuzzy Hash: 3d2be88024b31be7807458e25accf6a65352ea610bd93b554db748ec6d521f6d
Instruction Fuzzy Hash: 5721FDB1200315AFDF24EF60CD8092BB7A8BF513A4F108629F86997651EF38EC0087A1

Function 00A38C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1742AD29,?,?,00000000,00A4B774,000000FF,?,00A38D16,00A38BFD,?,00A38DB2,00000000), ref: 00A38C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A38C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A4B774,000000FF,?,00A38D16,00A38BFD,?,00A38DB2,00000000), ref: 00A38CBE

Strings

mscoree.dll, xrefs: 00A38C83
CorExitProcess, xrefs: 00A38C94

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 855b09d8358cb439d04e7fb7802d89e105a13c09abea7a94604d1c5e51502603
Instruction ID: 087b17769f9ca60c3e0f3c564b7a13311e906400cf3888d104365ad6ffdf8d7b
Opcode Fuzzy Hash: 855b09d8358cb439d04e7fb7802d89e105a13c09abea7a94604d1c5e51502603
Instruction Fuzzy Hash: F6016772955755FFDB12CB94DC19FAEBBB8FB44B52F000525F811A22D0DBB89901CA90

Function 00A3FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A3FCC2
__alloca_probe_16.LIBCMT ref: 00A3FD8B
__freea.LIBCMT ref: 00A3FDF2

Part of subcall function 00A3E531: RtlAllocateHeap.NTDLL(00000000,00A331E1,00A3186A,?,00A360C1,00A3186C,00A3186A,?,?,?,00A33181,00A331E1,00A3186E,00A3186A,00A3186A,00A3186A), ref: 00A3E563

__freea.LIBCMT ref: 00A3FE05
__freea.LIBCMT ref: 00A3FE12

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5d95abd984e993738e1b62ff6cfdb7c11a0cea18d40d85c39c2e4fedf5c98e5b
Instruction ID: f14fef02ba5ff69e1dfadad44568b95d1d35a7f50b30d5c155908c5c0368f42f
Opcode Fuzzy Hash: 5d95abd984e993738e1b62ff6cfdb7c11a0cea18d40d85c39c2e4fedf5c98e5b
Instruction Fuzzy Hash: 3951B472E10206AFDF209F65CD85EBF7AAAEF44750F290439FD04D6151EB34DC5086A0

Function 00A33010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A33017
std::_Lockit::_Lockit.LIBCPMT ref: 00A33022
std::_Lockit::~_Lockit.LIBCPMT ref: 00A33090

Part of subcall function 00A32EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A32EFC

std::locale::_Setgloballocale.LIBCPMT ref: 00A3303D
_Yarn.LIBCPMT ref: 00A33053

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9577452f098d13db0bc822874a688b018fb8fb56e955ee1cbb5d6b52535d84a9
Instruction ID: 3ae95f9ab77f0c6665cecf023646f263927f822b96c6cb187c6b23fb5085a10e
Opcode Fuzzy Hash: 9577452f098d13db0bc822874a688b018fb8fb56e955ee1cbb5d6b52535d84a9
Instruction Fuzzy Hash: B50178B6A002209BCB0AEFA0D956A7DBB61FF85381F184009F81257391DF34AE02CB91

Function 00A47E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A47F2E,00000000,?,00A56E10,?,?,?,00A47E65,00000004,InitializeCriticalSectionEx,00A4E57C,00A4E584), ref: 00A47E9F
GetLastError.KERNEL32(?,00A47F2E,00000000,?,00A56E10,?,?,?,00A47E65,00000004,InitializeCriticalSectionEx,00A4E57C,00A4E584,00000000,?,00A3E1DC), ref: 00A47EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A47ED1

Strings

api-ms-, xrefs: 00A47EB6

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e96bc1bce8638432cdd2797c68dbb22c5dd479faae9cc46537eb68555b29b496
Instruction ID: fe5dad84ad8cd54406e3d1658182db8600ee311f48e48d57d411f7fbd8d77d0c
Opcode Fuzzy Hash: e96bc1bce8638432cdd2797c68dbb22c5dd479faae9cc46537eb68555b29b496
Instruction Fuzzy Hash: D7E01275284309B7DE119BA0DC06B593A59EB90BD6F104060FB0DB84E1D762995196C4

Function 00A4562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1742AD29,00000000,00000000,?), ref: 00A45690

Part of subcall function 00A3E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A3FDE8,?,00000000,-00000008), ref: 00A3E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A458E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A45928
GetLastError.KERNEL32 ref: 00A459CB

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 43e95401694e4de3f7809574677fa24bf4a7bd51b20fa0c503c5d1f7e23db669
Instruction ID: 668c5f2b003fea2bea63c7e7292863202dc7c6fe376402ea3964ef784683cc74
Opcode Fuzzy Hash: 43e95401694e4de3f7809574677fa24bf4a7bd51b20fa0c503c5d1f7e23db669
Instruction Fuzzy Hash: 36D16AB9D04648DFCF15CFE8D8809ADBBB5FF89310F28452AE456EB352D630A946CB50

Function 00A3D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A3D976
___AdjustPointer.LIBCMT ref: 00A3D999
___AdjustPointer.LIBCMT ref: 00A3DA35

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6eab244798cdce674f102622b0c0a37b094e50b0b2aa68b6d779e11c0e2c8984
Instruction ID: f3ed3a4ae8302b330167f6a3677782f37415e5985adbc03826673ff09b5d21a9
Opcode Fuzzy Hash: 6eab244798cdce674f102622b0c0a37b094e50b0b2aa68b6d779e11c0e2c8984
Instruction Fuzzy Hash: 6A51EE72A04706EFDB299F24E942B6AB7B4FF05310F14452DF8429BA91E731ED80CB90

Function 00A43537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00A3E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A3FDE8,?,00000000,-00000008), ref: 00A3E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00A35757,00000000,00000000), ref: 00A4359B
__dosmaperr.LIBCMT ref: 00A435A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00A435DC
__dosmaperr.LIBCMT ref: 00A435E3

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 851e799c3a6fa918862167c3db1a91b6cf52a7af5215d4dd379ad5e9ff07a94c
Instruction ID: ce71d513ae536b8d2293d9e067360995f3eaad3a57ed83538a70be174309bdd9
Opcode Fuzzy Hash: 851e799c3a6fa918862167c3db1a91b6cf52a7af5215d4dd379ad5e9ff07a94c
Instruction Fuzzy Hash: C021D776600615AFDF20AF66998192EB7A8FF80364B108519F86997551EB30EF108B92

Function 00A4484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,00A3B1C6,00000000,00A3B284,00A3B153,00A358B3,00A54458,00000014), ref: 00A44857

Part of subcall function 00A3E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A3FDE8,?,00000000,-00000008), ref: 00A3E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A4488F
FreeEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 00A448AF

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 727166b4172187f00dcc1be73fa72bdc175cdc8abc2147fcd6ba86e9ef3151de
Instruction ID: 31568b7909ee7c73ebe68b5942f0620683d0ded97824de4f91e8c8f55afc31c2
Opcode Fuzzy Hash: 727166b4172187f00dcc1be73fa72bdc175cdc8abc2147fcd6ba86e9ef3151de
Instruction Fuzzy Hash: 0C1126FA502665BF6B11A7B69D8EDBF29ACDECD3D57200424F401D1141FB64CE029270

Function 00A3457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A34582
std::_Lockit::_Lockit.LIBCPMT ref: 00A3458C

Part of subcall function 00A324C2: std::_Lockit::_Lockit.LIBCPMT ref: 00A324DE
Part of subcall function 00A324C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00A324F7

codecvt.LIBCPMT ref: 00A345C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A345FD

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 10b6c5145aa3e47a18b8103eb747e02b5ef45c0e8831454801a8bed65f380975
Instruction ID: bc7708e3172b81dc4b52407113c6546b0c92dcfa8d272f1bd03111d8ed1822c4
Opcode Fuzzy Hash: 10b6c5145aa3e47a18b8103eb747e02b5ef45c0e8831454801a8bed65f380975
Instruction Fuzzy Hash: E101F176D00215CBCF04EFA4DA267ADB7B1FF98710F240509F412AB291CF74AE028B91

Function 00A4A4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000), ref: 00A4A4F7
GetLastError.KERNEL32(?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000,?,?,?,00A45365,00000000), ref: 00A4A503

Part of subcall function 00A4A554: CloseHandle.KERNEL32(FFFFFFFE,00A4A513,?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000,?,?), ref: 00A4A564

___initconout.LIBCMT ref: 00A4A513

Part of subcall function 00A4A535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A4A4D1,00A49AFC,?,?,00A45A1F,?,00000000,00000000,?), ref: 00A4A548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000,?), ref: 00A4A528

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 358ada223e29ca03530a5fe006f41a01bb6d6fca0ad03ee53f4279b800108208
Instruction ID: fdd6ab4565c7d222531d5a6bf31cc5826248c27f3bd3c093128361bdcca15ebc
Opcode Fuzzy Hash: 358ada223e29ca03530a5fe006f41a01bb6d6fca0ad03ee53f4279b800108208
Instruction Fuzzy Hash: 50F01C3A450215BFCF229FD5ED08A9E3F26FBE83A2F004110FA0986120D63289219B92

Function 00A42117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A3E783: GetLastError.KERNEL32(00000000,?,00A40AB9), ref: 00A3E787
Part of subcall function 00A3E783: SetLastError.KERNEL32(00000000,?,?,00000028,00A3B9D2), ref: 00A3E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00A39266,?,?,?,00000055,?,-00000050,?,?,?), ref: 00A421D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00A39266,?,?,?,00000055,?,-00000050,?,?), ref: 00A4220D

Strings

utf8, xrefs: 00A422DF

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 811f78d9f3143a8b4b0e666f2629e55f723c4d958c743694f823f6cbce4a90c2
Instruction ID: 0f3b77c9ca12bcb0046bcf8ffcd441dc6f65a5367e566fb27f91a05bb2b3c29f
Opcode Fuzzy Hash: 811f78d9f3143a8b4b0e666f2629e55f723c4d958c743694f823f6cbce4a90c2
Instruction Fuzzy Hash: A051E57D640301AADB25AB748D82BEB73B8FFC4741F940529FA05DB181FBB4E94087A1

Function 00A3DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00A3DEAD,?,?,00000000,00000000,00000000,?), ref: 00A3DFD1

Strings

RCC, xrefs: 00A3DFEB
MOC, xrefs: 00A3DFE3

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6abd64fe5c3382cb1ccf269f95531dd7dd9b7bb1a8b47f52ef8bab2319a4b344
Instruction ID: 52cc11e40a7dff0e743a3d44c255f9e545039e9215363b1cad3403fb7c6d7879
Opcode Fuzzy Hash: 6abd64fe5c3382cb1ccf269f95531dd7dd9b7bb1a8b47f52ef8bab2319a4b344
Instruction Fuzzy Hash: 31414A71900209EFCF2ADF98DD81AEEBBB5FF49304F188059FA05AB2A1D3759950DB50

Function 00A3D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A3DA8F

Strings

csm, xrefs: 00A3DB22
csm, xrefs: 00A3DAB1

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 99c1688028975ed4f87052a9b2389684a9501f03e76cffa95a77a838868fb823
Instruction ID: 02680477053e899a494fa56df74c4c6eb3fa5f210dbc28999359f7cc2e377ad1
Opcode Fuzzy Hash: 99c1688028975ed4f87052a9b2389684a9501f03e76cffa95a77a838868fb823
Instruction Fuzzy Hash: 6931F636904358EFCF229F90ED409AABB65FF08365F19415AFC545A221C332DDA1DB91

Function 00A329D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00A5648C,ios_base::badbit set,?,?,00A31C84,00A56478,00A31B17), ref: 00A329DF
ReleaseSRWLockExclusive.KERNEL32(00A5648C,?,?,00A31C84,00A56478,00A31B17), ref: 00A32A19

Strings

ios_base::badbit set, xrefs: 00A329D8

Memory Dump Source

Source File: 00000000.00000002.1773934611.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.1773917542.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773961576.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773977138.0000000000A55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1773993600.0000000000A56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774027182.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774042590.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774055772.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_drop1.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: 51961f5fdbd1ec50831a334b2c4e84fd925cc9ee222bc2f76d71c7f972d97007
Instruction ID: 611b61a4ae31cf8ca58e947b8b55bc7471e28e6518669a42753853562edb73ce
Opcode Fuzzy Hash: 51961f5fdbd1ec50831a334b2c4e84fd925cc9ee222bc2f76d71c7f972d97007
Instruction Fuzzy Hash: 76F08C31900200DFCB20EF98E904B25BBB8FB857B6F14036EF9AA432A0C7312842CB51

Analysis Process: drop1.exePID: 3444, Parent PID: 4836COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	1750
Total number of Limit Nodes:	86

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

ram, xrefs: 00488B55
time, xrefs: 004895E2
timezone, xrefs: 004899BF
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
computer_name, xrefs: 00488CBE
>wfw, xrefs: 0048920B
user_name, xrefs: 004885A6
system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87
cpu, xrefs: 0048887B
gpu, xrefs: 00488712

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,5A06260C), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeDebugPrivilege, xrefs: 0047E337
SeImpersonatePrivilege, xrefs: 0047E341

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,5A06260C), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

vault, xrefs: 00447225
system, xrefs: 004471E6
!F, xrefs: 00446482

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,5A06260C,5A06260C,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,5A06260C), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: b80ddb96a06b86526d9d0c7726fb66be9f86ed69261ab88760f474c273869731
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: b80ddb96a06b86526d9d0c7726fb66be9f86ed69261ab88760f474c273869731
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 004402D0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

filename, xrefs: 004405E4
content, xrefs: 0044063C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$filename
API String ID: 1690352074-474635906
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000254), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,5A06260C,00000000,000000BF), ref: 00487C87

Strings

[UTC, xrefs: 00487C45
@Zb=, xrefs: 00487A4F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: ecc325c629874c76bfafec243e908c12f8c02a0cf1ea070a0f793f87ea8e073d
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: ecc325c629874c76bfafec243e908c12f8c02a0cf1ea070a0f793f87ea8e073d
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: cbda99af75327c4c820746f38f84b7f1daa917d9e057987815aac769d108124b
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: cbda99af75327c4c820746f38f84b7f1daa917d9e057987815aac769d108124b
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,5A06260C,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,5A06260C,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,5A06260C,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,5A06260C,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,5A06260C,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: 180cd1d566063b3f4d1c722b0ef54c63ff5fa531a30de0cc59ed50824c8dd10f
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: 180cd1d566063b3f4d1c722b0ef54c63ff5fa531a30de0cc59ed50824c8dd10f
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,5A06260C), ref: 00487605

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,5A06260C,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,00000000,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

NG, xrefs: 00481B1D
geo, xrefs: 00481C1D
system, xrefs: 00481B74

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: NG$geo$system
API String ID: 213021568-968879199
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

0hC, xrefs: 004812E2
exists, xrefs: 0048181F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 849f238cd3a392783c80e55f8389a1395318525961415ca9d71f5ff49262db28
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 849f238cd3a392783c80e55f8389a1395318525961415ca9d71f5ff49262db28
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,5A06260C), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

value, xrefs: 00453386, 004535E5
MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a11389edab33e3dfbab2a445fe6c4299cd53ba09190e4193bd27d35e7829d6b
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: 7a11389edab33e3dfbab2a445fe6c4299cd53ba09190e4193bd27d35e7829d6b
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 004823F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

0hC, xrefs: 00482852
exists, xrefs: 0048291E
0, xrefs: 004827FE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$exists
API String ID: 323602529-1229763112
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,5A06260C,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Standard Time, xrefs: 004A117F
Eastern Summer Time, xrefs: 004A1193

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 6d56e6c85ed9894342afe2715a6fa1724950ddd0880608aa6d3f753aba8a0eb9
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: 6d56e6c85ed9894342afe2715a6fa1724950ddd0880608aa6d3f753aba8a0eb9
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 00481F10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

0hC, xrefs: 0048237C
exists, xrefs: 004823DA

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$exists
API String ID: 1525435645-4085241440
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,5A06260C,00000001), ref: 004B84A8

Strings

directory_iterator::operator++, xrefs: 00438294
., xrefs: 004381CE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905
ProductName, xrefs: 00486900

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,5A06260C,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: f2df89f7ded2f01219635e19fa6094d0543fceec2d71050d0bf781645f1a3f7c
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: f2df89f7ded2f01219635e19fa6094d0543fceec2d71050d0bf781645f1a3f7c
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,5A06260C,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 004855F0 Relevance: 4.6, APIs: 3, Instructions: 99networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(00000254), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction ID: c065b03366e761df0b34e2ad76ec595a4b6e3bb6db0e63c2aea2bbb819f94b56
Opcode Fuzzy Hash: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction Fuzzy Hash: 6C415830D11398CEEB14EB65CC59BDEBB71AF10308F1081DAE449672A2DB741E88DFA5

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 004A2897 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004A2891,00000016,0049036B,?,?,5A06260C,0049036B,?), ref: 004A28A8
TerminateProcess.KERNEL32(00000000,?,004A2891,00000016,0049036B,?,?,5A06260C,0049036B,?), ref: 004A28AF
ExitProcess.KERNEL32 ref: 004A28C1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction ID: 5f52cdf8944b70cf92df4f225d6e01553ce615c3954620652ef0a1f31c52b3c3
Opcode Fuzzy Hash: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction Fuzzy Hash: ACD09E71001108BBDF423F65ED0DB8E3F2AEF55745F044026B9095A131DB799995EB98

Function 0047EE90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,5A06260C), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC
API String ID: 1131316584-2581318919
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00460310 Relevance: 3.3, APIs: 2, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004604B4

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction ID: 66707b960993136107624c9d81ef05c918eca4bbb2b21c6d520a63eb0cd0cd41
Opcode Fuzzy Hash: 8b13a2037e7e0b03ddde8346a73a64acbab074baffae8b20c15079bbed3282a0
Instruction Fuzzy Hash: 04A191B1E002159FDB14DF68C981AAFBBB4EB49314F24422FE815E7385E738AD05CB95

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,5A06260C,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,5A06260C), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049AD6F Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049ADBB
GetFileType.KERNEL32(00000000), ref: 0049ADCD

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction ID: 9b806bec79c801feb13e2bd810877b0a9fec2b0519df56a68c4b4061daa9a1e0
Opcode Fuzzy Hash: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction Fuzzy Hash: B611B7311047514ACF304A3E8C886677E96AB56331B39073FD4B687AF1C338D9A691CB

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,5A06260C), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,5A06260C,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 0049C6A4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0043FE48,00000001,?,00499445,00000001,00000364,00000001,00000006,000000FF,?,004AD408,0043FE4A,0043FE44,?), ref: 0049C6E5

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction ID: bf89d2d5fe5833ab0f4bff440cdb33f04d1e0b68cec02520bce29c64fa949510
Opcode Fuzzy Hash: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction Fuzzy Hash: 82F0BE322852256BAF215B229D85B5B3F589B417E0F195037FC08EA290CE78EC008AEC

Function 00454E60 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00454EB2

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 78740692b221e79a9762ccbd46d7f188a31b2ad2167c780b1c1497364ca8ea36
Instruction ID: 7ed3afec28be053f9a77c7416a11cc0d573f769e31c405d3d1c7fe45b1d11b08
Opcode Fuzzy Hash: 78740692b221e79a9762ccbd46d7f188a31b2ad2167c780b1c1497364ca8ea36
Instruction Fuzzy Hash: D3F0E9B11002080AA628D7A1950796F77C89EA036DB44453FE9058FA53E73DEDD9825D

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004A8D62 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D69

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction ID: f589969de9c028132caa70972cc51c37c6bf7195d426b38a2c2fae52dece88af
Opcode Fuzzy Hash: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction Fuzzy Hash: 71E09A76C4020D9ADB40DFD5C486BEFB7BCAB14304F50406BA205E6181EB7857448BE5

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,5A06260C,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,5A06260C,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL ref: 0048A153
NtQuerySystemInformation.NTDLL ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

ntdll.dll, xrefs: 0048A0EB
NtDuplicateObject, xrefs: 0048A0E6
File, xrefs: 0048A25B

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 00477EE0 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,5A06260C,?,?), ref: 00477F5C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction ID: d5989f67fd172e1006781f95ff6e7d6cbd1369fc69074948a5cb2319df95c689
Opcode Fuzzy Hash: eec43777c261d8a2dab22aea29dbdf31e886a527831d6dfb0425ac795999018e
Instruction Fuzzy Hash: 12D1F170D04288DBDB11CFA8D848BEDBBB0FF15314F14824AE508BB291DB796AC9DB55

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
.ps1, xrefs: 0047D365
.vbs, xrefs: 0047D3A5
0hC, xrefs: 0047D950
open, xrefs: 0047D7E5
.cmd, xrefs: 0047D385
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443
.exe, xrefs: 0047D349, 0047D423

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 6595408e174a39f32e18d343271d234c9a7f1da95b1be23f008c122fddbd1b18
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 6595408e174a39f32e18d343271d234c9a7f1da95b1be23f008c122fddbd1b18
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 0048A710 Relevance: 15.2, APIs: 10, Instructions: 215stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL(5A06260C,00000000,00000000), ref: 0048A766
NtAllocateVirtualMemory.NTDLL ref: 0048A78F
lstrcpyW.KERNEL32(?), ref: 0048A7C6
lstrcatW.KERNEL32(?), ref: 0048A8CD
NtAllocateVirtualMemory.NTDLL ref: 0048A904
lstrcpyW.KERNEL32(?), ref: 0048AA0F
RtlInitUnicodeString.NTDLL(-00000037), ref: 0048AA28
RtlInitUnicodeString.NTDLL(-0000003F), ref: 0048AA37
LdrEnumerateLoadedModules.NTDLL(00000000,Function_0008A6B0,00000000), ref: 0048AA44
RtlReleasePebLock.NTDLL ref: 0048AA4A

Part of subcall function 00480F90: SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,5A06260C,?,?), ref: 0048101E
Part of subcall function 00480F90: CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AllocateInitLockMemoryStringUnicodeVirtuallstrcpy$AcquireEnumerateFolderFreeKnownLoadedModulesPathReleaseTasklstrcat
String ID:
API String ID: 573923072-0
Opcode ID: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction ID: 1d72f842e61e5ce7feef92d17fc1071c4f69874d6174494518bfda03acdacd70
Opcode Fuzzy Hash: 9f0bc586ea1a7da28060736a8c13b163a192ecd6657979f9a74a2ad2d362be03
Instruction Fuzzy Hash: D6B190B4D05268EFDB14CFA9D885A9DBBB5FF08314F10822AE825A7361DB346946CF44

Function 0047AE80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000,00000001,?,0047AF9D,?,?,5A06260C), ref: 0047AE91
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0047AEAB
BCryptGenerateSymmetricKey.BCRYPT(?,?,00000000,00000000,?,?,00000000), ref: 0047AECF

Strings

ChainingMode, xrefs: 0047AEA4
ChainingModeGCM, xrefs: 0047AE9F
AES, xrefs: 0047AE88

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 1692524283-1213888626
Opcode ID: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction ID: 8d127e15825cd86a398cba4dadb085fb92217d3de15f733cf2195ed64ba2db48
Opcode Fuzzy Hash: b81ac72cefcce56172d4d4bf7609f9087b605a60a83836cd33b6e41b4b4cf51e
Instruction Fuzzy Hash: 1CF03031381710BBE7309E65AC4AFDB7BA8FB44F10F10492AFA41DA1D0D7A0F8559B5A

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 00A43178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,00A42B49,?,00000000), ref: 00A43211
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,00A42B49,?,00000000), ref: 00A4323A
GetACP.KERNEL32(?,?,00A42B49,?,00000000), ref: 00A4324F

Strings

OCP, xrefs: 00A431CC
ACP, xrefs: 00A43196

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 9ed6ee8dc8d25704b1d7263d6bdf93c44f2695e15696a3f032909470795970f4
Instruction ID: d49d8a8879afe810d7751735bd993aaf06a6f69b8197ed2baf00ccd78099f4b7
Opcode Fuzzy Hash: 9ed6ee8dc8d25704b1d7263d6bdf93c44f2695e15696a3f032909470795970f4
Instruction Fuzzy Hash: 0221AC3B600101EADF348F68E905BEB73A6BFE4B51B268624E90AD7110E772DF41D350

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 004A61CB
GetACP.KERNEL32 ref: 004A61E0

Strings

ACP, xrefs: 004A6127
OCP, xrefs: 004A615D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 00A42A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 00A42B1B
IsValidCodePage.KERNEL32(00000000), ref: 00A42B59
IsValidLocale.KERNEL32(?,00000001), ref: 00A42B6C
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00A42BB4
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00A42BCF

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: 5f8576cc40f2f856cf334241ed765f2661259ec3b98ecceb1b0590a86fbf1c7e
Instruction ID: 2cebb25d7463f3634f39af6a6a6aa76e843fd3dbde9a79f0f32dd0ad6eecd653
Opcode Fuzzy Hash: 5f8576cc40f2f856cf334241ed765f2661259ec3b98ecceb1b0590a86fbf1c7e
Instruction Fuzzy Hash: FE517D76A00215AFDF21DFA4CC85BAE77B8FF94740F854469F900EB190EBB09A45CB61

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32 ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 00A31614 Relevance: 7.7, APIs: 5, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A31098: _strlen.LIBCMT ref: 00A310F9

GetFileSize.KERNEL32(00000000,00000000), ref: 00A31685
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00A316AB
CloseHandle.KERNEL32(00000000), ref: 00A316BA
_strlen.LIBCMT ref: 00A31705
CloseHandle.KERNEL32(00000000), ref: 00A31805

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 116069594b6fc95415f3dcd476c2b37170055dde59227a07d4f1e578bc125763
Instruction ID: 2e38e665e5b47aa0eedbf0a5f945e2f571f6a7968a065f1aae7265b06cbbbeda
Opcode Fuzzy Hash: 116069594b6fc95415f3dcd476c2b37170055dde59227a07d4f1e578bc125763
Instruction Fuzzy Hash: 4251FEB29043009BD700EF24DC85B2EBBE5FF88354F154A2DF88997252EB34E9458B62

Function 00497B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 00497C25
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00497C2F
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000001), ref: 00497C3C

Strings

/LC, xrefs: 00497B2F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: /LC
API String ID: 3906539128-2135541996
Opcode ID: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction ID: bfbf58602b6ed5b9f74246d621f9e13e9ead8f3e4535d75d7aa199c35e3273ea
Opcode Fuzzy Hash: ba9b98a76fbca1403476e1f0242b14846ec85a4183b9da3279bb0f6910b30b28
Instruction Fuzzy Hash: 3231D274901229ABCB21DF65DC8878DBBB8BF18710F5041EAE40CA7250E7349F858F48

Function 00493800 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction ID: d1eb0eda3f30262f0aa428ac7e9151949e9d9ef7bd25f7153de96db8ebdefec9
Opcode Fuzzy Hash: 4ea11f6e400efd71b53824ee55fa65b6dac5785e4ad25e6ab9d2c54b6af7400f
Instruction Fuzzy Hash: DB023C71E002199BDF14CFA9C9806AEFBF1FF89315F24826AE519E7341D735AE018B94

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 00A35020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A3502C
IsDebuggerPresent.KERNEL32 ref: 00A350F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A35111
UnhandledExceptionFilter.KERNEL32(?), ref: 00A3511B

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1768d5ac103420a924d1a2497add70d71a90f1434368e2737eb0c63f64da00ca
Instruction ID: 4953d4b3119afa4e89db6d2a5ecc32b39971cca95b1f42260a7eef8620979f4b
Opcode Fuzzy Hash: 1768d5ac103420a924d1a2497add70d71a90f1434368e2737eb0c63f64da00ca
Instruction Fuzzy Hash: 173114B5D053289BDF21EFA4D9497CDBBB8BF08340F1041AAE40DAB250EB719B858F44

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 0043D4A0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

filename, xrefs: 0043E0E3
content, xrefs: 0043E150

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID: content$filename
API String ID: 0-474635906
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 00A3123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85encryptionCOMMON

Download Yara Rule

APIs

CryptContextAddRef.ADVAPI32(00000000,00000000,00000000), ref: 00A312C7

Strings

[+], xrefs: 00A312E1

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ContextCrypt
String ID: [+]
API String ID: 3075001677-4228040803
Opcode ID: 2f755d89029a6b5e1b040ecaff60019269738b6030ad02bdcef24161bb0436a0
Instruction ID: 29ff27674052fe35efbbc13f7f1f392d897bca75ae7c9326b9f6ecf994580a08
Opcode Fuzzy Hash: 2f755d89029a6b5e1b040ecaff60019269738b6030ad02bdcef24161bb0436a0
Instruction Fuzzy Hash: 2331093150C3804FD716AB74A8997EBBBD0BFBD318F18097DE8C987243D1615446CB62

Function 0047AAE0 Relevance: 3.2, APIs: 2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction ID: 33f7787d24f7b6ada88b2ec4e837cc4b10ca5ac34968b166931d9a07c874724e
Opcode Fuzzy Hash: 7a5cc1d22bd71ddba461825bf1e5a719f52907f0f441b03632678b65b188f3f2
Instruction Fuzzy Hash: 21B1A170D04249DFDB10CFA4C884BEEBBB5FF89304F20825AD505AB381D778A984CB96

Function 00440B60 Relevance: 3.1, APIs: 2, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,?,00000000,00000000,00000001,?), ref: 00440BFA
LocalFree.KERNEL32(?,00000000), ref: 00440C8E

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction ID: f58a043fe36a424058588bce6ee5e9d112fd586f94ce921f9f6943f9dc7e0036
Opcode Fuzzy Hash: 691253dd090d0692abb79b75d9c07df8674f2c8687ba40f9476d8420fea36caa
Instruction Fuzzy Hash: 68517E70D00249DBEB00CFA9C8457DEFBB4FF14308F14821AE8547B281D7B96A48CBA5

Function 0047A950 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A9B8
LocalFree.KERNEL32(?,00000000), ref: 0047AA4F

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction ID: 6fc12887242d51354b1d4be44c56afc8010d77d5c64fcd5971483ececb25fb38
Opcode Fuzzy Hash: 1650d13529f5b5e644ab9d1fc943a2e59ee628ce821009b7a4047a2a1a045cf0
Instruction Fuzzy Hash: 7351BF70D00249EBEB00CFA5D945BDEFBB4FF54308F10821AE81077281D7B96A58CBA5

Function 0047AE10 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT(?,00000000,5A06260C,?,?,?,004CB69D,000000FF), ref: 0047AE4A

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction ID: 7a92f9e53ad6301b38de286dc83f6de03fbb372fed7888f050c821ed69dc0e63
Opcode Fuzzy Hash: ba7b4d00b8746e9ab6913010367bb35a0b16d4da032a75110d36ee2580577608
Instruction Fuzzy Hash: B1F06D71A44618ABD720CF58DC05B9AB7F8EB04B20F10476FE821A37C0D779A9008B94

Function 00477B00 Relevance: 31.7, APIs: 21, Instructions: 230processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,5A06260C,?,?), ref: 00477B54
Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Process32NextW.KERNEL32(00000000,0000022C), ref: 00477BE0
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00477BFD
OpenProcessToken.ADVAPI32(00000000,0000000E,?), ref: 00477C2A
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C4D
GetLastError.KERNEL32 ref: 00477C5B
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00477C9C
CloseHandle.KERNEL32(00000000), ref: 00477CA7
CloseHandle.KERNEL32(?), ref: 00477CAF
CloseHandle.KERNEL32(?), ref: 00477E29
Process32NextW.KERNEL32(?,0000022C), ref: 00477E39
CloseHandle.KERNEL32(?), ref: 00477E62
CloseHandle.KERNEL32(00000000), ref: 00477E65
CloseHandle.KERNEL32(00000000), ref: 00477E84

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$CreateErrorFirstLastSnapshotToolhelp32
String ID:
API String ID: 1236848392-0
Opcode ID: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction ID: 454ab3ae29a80d327a78c61064fadb2005c2365cc5293efb4604dbbba27fe465
Opcode Fuzzy Hash: 8196f859269c8a2d89c48d56fc566d1cdbd904d5535603d3da99df98a23cf43e
Instruction Fuzzy Hash: F6A15B709052189FDF219F24DC89BAEBBB8EF44700F5441EAE90CA2250EB359E84DF59

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

`aC, xrefs: 0044E16A
cC, xrefs: 0044E17E
p]C, xrefs: 0044E15D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 004AAEF3 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,004AA85F), ref: 004AAF0C

Strings

log, xrefs: 004AAF69, 004AAF78
log10, xrefs: 004AAF4E, 004AAF5D
asin, xrefs: 004AB039
exp, xrefs: 004AAF8B, 004AAFF0
sqrt, xrefs: 004AB04B
acos, xrefs: 004AB042
pow, xrefs: 004AAFAA, 004AB054, 004AB0A1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction ID: 58aec3622616389bffb488f30e5ac45d5b57ecd31d6a71103e59991c775c814d
Opcode Fuzzy Hash: 74ba9069d7c1eb0fdfb04e1fac74ca4f81e2e7f03cc06b4bb9d653b05ebe1574
Instruction Fuzzy Hash: BE516C7090860ACFCF148F58D9481AFBFB0FB66300F558187E4A1A6355C7BD8966CB9A

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

`aC, xrefs: 00452385
p]C, xrefs: 00452378

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 00450EF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00450F2D
std::_Lockit::_Lockit.LIBCPMT ref: 00450F4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00450F77
std::_Facet_Register.LIBCPMT ref: 00451071
std::_Lockit::~_Lockit.LIBCPMT ref: 0045109B

Strings

`aC, xrefs: 0045101E
p]C, xrefs: 00451011
PbC, xrefs: 00451032

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: PbC$`aC$p]C
API String ID: 459529453-2418293346
Opcode ID: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction ID: e392c769357d74c7cb0e8da2cb70d10442ea48cde3856dc7faeb71697ce32a0a
Opcode Fuzzy Hash: c487c9fa1e9afb87366c1b148d14351f87e6f3e89ddbdc8a1e0c3778002b8b72
Instruction Fuzzy Hash: 9A519E71900249DFDF20CF99C5417AEBBB0FB14318F24845ED805AB382D7B9AE49CB95

Function 004AFE4C Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004AFF6B
___TypeMatch.LIBVCRUNTIME ref: 004B0079
CallUnexpected.LIBVCRUNTIME ref: 004B01E6

Strings

csm, xrefs: 004AFEF6
csm, xrefs: 004AFE89
<fM, xrefs: 004AFF62
csm, xrefs: 004AFFA2

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: <fM$csm$csm$csm
API String ID: 1206542248-3599101812
Opcode ID: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction ID: 5ce913a956d0af8773c3ee17d9b542f15401108c10c26080aa375b564815456b
Opcode Fuzzy Hash: aaac5c7749a7aa866996bcb2d51d73d9b1fe5293335fd4c63eebf0a3ecf9d180
Instruction Fuzzy Hash: DBB19B71800209EFCF18DFA5C8809EFB7B5FF25315B10816BE8056B212D779DA15CBA9

Function 0047CF70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0047D113
Concurrency::cancel_current_task.LIBCPMT ref: 0047D118
Concurrency::cancel_current_task.LIBCPMT ref: 0047D11D

Strings

`aC, xrefs: 0047D015
true, xrefs: 0047D0B8
p]C, xrefs: 0047D008
false, xrefs: 0047D092

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$false$p]C$true
API String ID: 118556049-4224333681
Opcode ID: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction ID: 10a02a47a4876ff195f080d04569540bf2a908c30d6efafbe52ebceab6b25fd0
Opcode Fuzzy Hash: 226f2742ad4bb82513da97dc0ea37b247d6440e1a842af39628b989b3fbf377a
Instruction Fuzzy Hash: 73510871910745DBDB20DF65C801B9EBBF4EF04718F20862FE815A7781E7BAAA04CB95

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

`aC, xrefs: 0047C7EE
p]C, xrefs: 0047C7E1

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 00A4A222 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00A4A20D,?,?,?,?,?,?,?,?,?), ref: 00A4A2C8
__alloca_probe_16.LIBCMT ref: 00A4A383
__alloca_probe_16.LIBCMT ref: 00A4A412
__freea.LIBCMT ref: 00A4A45D
__freea.LIBCMT ref: 00A4A463
__freea.LIBCMT ref: 00A4A499
__freea.LIBCMT ref: 00A4A49F
__freea.LIBCMT ref: 00A4A4AF

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: d33247f74f328ecbfc3c7d07e6dc1eefba42e9fa168c9a7b6d43e5e5d589b150
Instruction ID: 50474bbc6f56ac8646396bf24752b5c67265841b5fa4f15ce352197a04af6547
Opcode Fuzzy Hash: d33247f74f328ecbfc3c7d07e6dc1eefba42e9fa168c9a7b6d43e5e5d589b150
Instruction Fuzzy Hash: 64710B7AE402059BDF219FA4CD45BEF7BBA9FE5310F244055F904AB281E7B5DC408762

Function 004B9D99 Relevance: 12.2, APIs: 8, Instructions: 225COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 004B9E24
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9EB0
__alloca_probe_16.LIBCMT ref: 004B9EDA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F1B
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004B9F37
__alloca_probe_16.LIBCMT ref: 004B9F5D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004B9F9A
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004B9FB7

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction ID: 05f54580d30f9e3720c8b3961695daa3f0f937b9c5610d8c2bd80885558d9d7b
Opcode Fuzzy Hash: 3ce074e6bcc7f87e0e4de1f7dc2ca851322fbe0f14b3b5897e042b4e817243f3
Instruction Fuzzy Hash: 7871AE3290021AABDF219F65CC85BFF7BB9AF05724F18405BEA04E6291D7398C40C7B9

Function 00A354C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00A3550C
__alloca_probe_16.LIBCMT ref: 00A35538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00A35577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A35594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A355D3
__alloca_probe_16.LIBCMT ref: 00A355F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00A35632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A35655

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: a2b27fabeef5acb7b9a8ae4aced18095b61f1f3b18c7a35b1fe1784743b972b3
Instruction ID: e8df6e1eb66534cdddaeb6c0e242295024abf26a5a4b0cf48a0f5a39e34e07ae
Opcode Fuzzy Hash: a2b27fabeef5acb7b9a8ae4aced18095b61f1f3b18c7a35b1fe1784743b972b3
Instruction Fuzzy Hash: BF519172E00606AFEF209FB8CC46FBA7BBAEF80790F594425F905A6150D731DD118B90

Function 004B9AF7 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 004B9B40
__alloca_probe_16.LIBCMT ref: 004B9B6C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 004B9BAB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9BC8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004B9C07
__alloca_probe_16.LIBCMT ref: 004B9C24
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B9C66
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004B9C89

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction ID: 0cb7a2a667138b596a59e049b57baa22d652deda395932da07ab0cb8239329c9
Opcode Fuzzy Hash: 127654da753590042b08ac6595405d01716cfec311436dda6d72091204f46cc9
Instruction Fuzzy Hash: A151BF7250020AABEF219F65CC44FEB7FB9EF50740F24412AFA05A6260D7399C11CB68

Function 00489F30 Relevance: 12.1, APIs: 8, Instructions: 134COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00489F4B
GetProcessId.KERNEL32(00000000), ref: 00489F52
RmStartSession.RSTRTMGR(?,00000041,?), ref: 00489F76
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 00489F91
RmGetList.RSTRTMGR(?,?,?,00000003,?), ref: 00489FD4
RmGetList.RSTRTMGR(?,?,?,00000000,?), ref: 0048A020
RmEndSession.RSTRTMGR(?), ref: 0048A04A
RmEndSession.RSTRTMGR(?), ref: 0048A07A

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction ID: 0c548674b0cea8079c7009f79d794e669f8d4684f59b10cf2f6688a8c9d6d6ed
Opcode Fuzzy Hash: c8fc720c6df2cefa911e5ab8bfb66f499295b1f9aa4f52cb019436ebaefd8700
Instruction Fuzzy Hash: A7417971E011589BEF10AFE4DC44AEEBBBCEB45300F14412BE902EB254EB7A9C058B95

Function 00473B90 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00473D56
___std_exception_destroy.LIBVCRUNTIME ref: 00473D73

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,5A06260C), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 00473FC0
___std_exception_destroy.LIBVCRUNTIME ref: 00473FDD

Strings

value, xrefs: 00473C96, 00473EF5
MC, xrefs: 00473D4C, 00473D68, 00473FB6, 00473FD2

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction ID: 838f8dd16b3ea7f4eeb45613560c02c2ef3b01355b1a5592379bf0a45a67ceab
Opcode Fuzzy Hash: fad894e6791b73173a90b46eb5f7d570fcfb30b2d17f717ef1dd9171332bf87e
Instruction Fuzzy Hash: 31F15A70C05298DEEB20DB65C954BDEFBB4AF19304F1482DAD44963282E7746B88CF96

Function 00A361E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A36217
___except_validate_context_record.LIBVCRUNTIME ref: 00A3621F
_ValidateLocalCookies.LIBCMT ref: 00A362A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A362D3
_ValidateLocalCookies.LIBCMT ref: 00A36328

Strings

csm, xrefs: 00A362BD

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f380553b7c01ebdaf6049ad25608e816263731a03584027a791230cbd7b820b7
Instruction ID: 747edec0d50c29a3d518d976d6a3b9bcc08ec68398f312da59d32a8e17c022c8
Opcode Fuzzy Hash: f380553b7c01ebdaf6049ad25608e816263731a03584027a791230cbd7b820b7
Instruction Fuzzy Hash: BA418F34E00218ABCF10DFA8C885ADEBBB5FF49324F15C555F9189B392D771AA06CB91

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 00A3F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A3F578,00A3186A,?,00000000,00A331E1,00A3186C,?,00A3F1F6,00000022,FlsSetValue,00A4DFE0,00A4DFE8,00A331E1), ref: 00A3F52A

Strings

ext-ms-, xrefs: 00A3F4D4
api-ms-, xrefs: 00A3F4C0

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e76c3dd61ae6f929b1cf38d4197032f9c587e462863fff09c47465610e8776af
Instruction ID: 050bd25531daedaa5f609857a28c1faf6d2fd30404c506762cae1b1391f3f110
Opcode Fuzzy Hash: e76c3dd61ae6f929b1cf38d4197032f9c587e462863fff09c47465610e8776af
Instruction Fuzzy Hash: 4521A576E12311AFCF21DFA5EC45A5B7768AB817A5F244131FD16A7290E730EE01C6D0

Function 0049C8FA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0049CA09,0043FE48,00434C2F,00000000,00000001,0043FE4A,?,0049CC33,00000022,FlsSetValue,004D294C,FlsSetValue,00000001), ref: 0049C9BB

Strings

ext-ms-, xrefs: 0049C965
api-ms-, xrefs: 0049C951

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction ID: 9ca0f964f7470424b5d3057a4191f763ac6aa624da693043a33dcdca32e519f2
Opcode Fuzzy Hash: 7c1f6f25a6eeb0dcc1b48f853c441653626ec7c6eb0710202be6e4b6adacda37
Instruction Fuzzy Hash: A621E7B2A01211ABDF219B25ECC0B5F3B69AB527A4F250237E905A7390D738ED01C6DD

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,5A06260C), ref: 004AFA6C

Strings

0hC, xrefs: 004366E3
ios_base::badbit set, xrefs: 00436677, 004366A2
(>Q, xrefs: 004366D9
ios_base::eofbit set, xrefs: 00436686
ios_base::failbit set, xrefs: 00436681

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

a/p, xrefs: 004A236F
am/pm, xrefs: 004A230B

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 0047CCA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047CCD6
std::_Lockit::_Lockit.LIBCPMT ref: 0047CCF9
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CD21
std::_Facet_Register.LIBCPMT ref: 0047CD9A
std::_Lockit::~_Lockit.LIBCPMT ref: 0047CDC4
Concurrency::cancel_current_task.LIBCPMT ref: 0047CDE7

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction ID: 5e0d328f53af4ec2248f8036dfe48c657d56e4526373956cc4eb9e978e4c29ea
Opcode Fuzzy Hash: 28da64327ea27554a00a06c9e40525b24cdd21d51c36f3309ffdeb549bf855e5
Instruction Fuzzy Hash: FE419A71800219CFCB21CF98C980BEFBBB4EB15714F14856ED80A67381D738AE04CBA5

Function 00A3D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A3D2B7,00A35FB7,00A35179), ref: 00A3D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A3D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A3D2F5
SetLastError.KERNEL32(00000000,00A3D2B7,00A35FB7,00A35179), ref: 00A3D347

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c23b975c9b26182ebcc09e162848bbe767eb26e2a16b39b1350dd843cba4754d
Instruction ID: ba9c96b39cdf5139265ba1cdb6b49ce4fc66dfc8d984bc356880c025bfd57858
Opcode Fuzzy Hash: c23b975c9b26182ebcc09e162848bbe767eb26e2a16b39b1350dd843cba4754d
Instruction Fuzzy Hash: A6017B32A0E711DFE7256BF47DC686B2A94FF417B6F200329F130590E0EF119C029281

Function 004AFADE Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004AFAD5,004AF923,004AC85A), ref: 004AFAEC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004AFAFA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004AFB13
SetLastError.KERNEL32(00000000,004AFAD5,004AF923,004AC85A), ref: 004AFB65

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction ID: 5c97271c99781371f32c50c56a2d0a191a69233ae1c55058bab721689d3f3b0d
Opcode Fuzzy Hash: 0a9cead03a1cbea0f2d00e28f649f33043dad87cbbba68afa2d7a2a72df1b0e0
Instruction Fuzzy Hash: 9001F9321093119E9A2417F5AC559972A65EB23379B24463FF514951E0FB1A5C0CA16C

Function 00480AC0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00480B31
EnterCriticalSection.KERNEL32(00000004,5A06260C,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B42
EnterCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B4F
GdiplusShutdown.GDIPLUS(00000000,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B5C
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B69
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,004C21C0,000000FF,?,00480A9B), ref: 00480B70

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction ID: a49544f5ea7446c9cfb95f09875386710a40740b290a3353e41ff902735902d1
Opcode Fuzzy Hash: ab380d08308f5f7294dc0c8834127c13781bff22419dd726a23e31aeb0b35f9a
Instruction Fuzzy Hash: 8B117FB15002009FD3209F58D848B1A7BF8FF05728F20475EE4258B2D1C77AD806CB94

Function 00A3DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A3DCA7
CallUnexpected.LIBVCRUNTIME ref: 00A3DF20

Strings

csm, xrefs: 00A3DCDE
csm, xrefs: 00A3DC32
csm, xrefs: 00A3DBC5

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: d01afdf39097f4691087decbb4c53d2d201c698b933d77187b4a55a4e758207f
Instruction ID: 5782ef8f235052db752ec50d92a82c88668f0becee8a64b488b130c83520eb98
Opcode Fuzzy Hash: d01afdf39097f4691087decbb4c53d2d201c698b933d77187b4a55a4e758207f
Instruction Fuzzy Hash: 2DB16871800209EFCF29DFA4E9819AEBBB5FF14310F24455AF8116B216D771EA61CF91

Function 004A2923 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5A06260C,00000001,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A2958
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004A296A
FreeLibrary.KERNEL32(00000000,?,00000000,004CEBA0,000000FF,?,004A28BD,?,?,004A2891,00000016), ref: 004A298C

Strings

mscoree.dll, xrefs: 004A2951
CorExitProcess, xrefs: 004A2962

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction ID: 4a39d6f0df0723e62e133a2fe4a12dc63d6bfdc81165c834358a2709fa0273f6
Opcode Fuzzy Hash: bb5db20903b210e56e17606efd33f47167f5dac7559f5cad6f576f47fa7b3a02
Instruction Fuzzy Hash: DA01A271A10625AFCB118F54DC05FAFBBBCFB04B10F044627E812A2790DBB89900DA98

Function 00A38C57 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,?,00A4B774,000000FF), ref: 00A38C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A38C9C
FreeLibrary.KERNEL32(00000000,?,?,?,00A4B774,000000FF), ref: 00A38CBE

Strings

mscoree.dll, xrefs: 00A38C83
CorExitProcess, xrefs: 00A38C94

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d73cb7c46e4dc8d49919f682af7c42b70ce7d286cc7b5bb66232d787f4c8ffbe
Instruction ID: fca8900166438bfd2f4b6ffaff07219161e954a051c2b2f67259b0805cdc7dee
Opcode Fuzzy Hash: d73cb7c46e4dc8d49919f682af7c42b70ce7d286cc7b5bb66232d787f4c8ffbe
Instruction Fuzzy Hash: DA016772955755FFDB12CB94DC15BAEB7B8FB44B52F000525F811A22D0DBB89901CA90

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,5A06260C,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

kernel32.dll, xrefs: 004B82C4
GetTempPath2W, xrefs: 004B82CF

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 00A3FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A3FCC2
__alloca_probe_16.LIBCMT ref: 00A3FD8B
__freea.LIBCMT ref: 00A3FDF2

Part of subcall function 00A3E531: HeapAlloc.KERNEL32(00000000,00A331E1,00A3186A,?,00A360C1,00A3186C,00A3186A,?,?,?,00A33181,00A331E1,00A3186E,00A3186A,00A3186A,00A3186A), ref: 00A3E563

__freea.LIBCMT ref: 00A3FE05
__freea.LIBCMT ref: 00A3FE12

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e6275f77eb610dd8db295b25670cd2af98070920688af4192d270c095ee039d7
Instruction ID: f14fef02ba5ff69e1dfadad44568b95d1d35a7f50b30d5c155908c5c0368f42f
Opcode Fuzzy Hash: e6275f77eb610dd8db295b25670cd2af98070920688af4192d270c095ee039d7
Instruction Fuzzy Hash: 3951B472E10206AFDF209F65CD85EBF7AAAEF44750F290439FD04D6151EB34DC5086A0

Function 0049AEB4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0049AF39
__alloca_probe_16.LIBCMT ref: 0049B002
__freea.LIBCMT ref: 0049B069

Part of subcall function 0049D15A: RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

__freea.LIBCMT ref: 0049B07C
__freea.LIBCMT ref: 0049B089

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction ID: c461f83b43c969d084823d86eb7d78e4c690f12dee5ba4d22df99f96e1ee22eb
Opcode Fuzzy Hash: 1cf292f1027faf516ea3b58fb1ffeacfcc17b82ad5c767b33ec64858519d3555
Instruction Fuzzy Hash: 4C510072600206AFEF209F65AD81EBB7EA9EF84314F15013EFC54D6241EB39DC5086E8

Function 00A33010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A33017
std::_Lockit::_Lockit.LIBCPMT ref: 00A33022
std::_Lockit::~_Lockit.LIBCPMT ref: 00A33090

Part of subcall function 00A32EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A32EFC

std::locale::_Setgloballocale.LIBCPMT ref: 00A3303D
_Yarn.LIBCPMT ref: 00A33053

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 15c5d44ade13658ac67750766bb4020311a32c912138a158488f109f6912e4d5
Instruction ID: 3ae95f9ab77f0c6665cecf023646f263927f822b96c6cb187c6b23fb5085a10e
Opcode Fuzzy Hash: 15c5d44ade13658ac67750766bb4020311a32c912138a158488f109f6912e4d5
Instruction Fuzzy Hash: B50178B6A002209BCB0AEFA0D956A7DBB61FF85381F184009F81257391DF34AE02CB91

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 00A47E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A47F2E,00000000,?,00A56E10,?,?,?,00A47E65,00000004,InitializeCriticalSectionEx,00A4E57C,00A4E584), ref: 00A47E9F
GetLastError.KERNEL32(?,00A47F2E,00000000,?,00A56E10,?,?,?,00A47E65,00000004,InitializeCriticalSectionEx,00A4E57C,00A4E584,00000000,?,00A3E1DC), ref: 00A47EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A47ED1

Strings

api-ms-, xrefs: 00A47EB6

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e96bc1bce8638432cdd2797c68dbb22c5dd479faae9cc46537eb68555b29b496
Instruction ID: fe5dad84ad8cd54406e3d1658182db8600ee311f48e48d57d411f7fbd8d77d0c
Opcode Fuzzy Hash: e96bc1bce8638432cdd2797c68dbb22c5dd479faae9cc46537eb68555b29b496
Instruction Fuzzy Hash: D7E01275284309B7DE119BA0DC06B593A59EB90BD6F104060FB0DB84E1D762995196C4

Function 004B0B2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC), ref: 004B0B3B
GetLastError.KERNEL32(?,004B0ADF,00000000,?,0051BBA8,?,?,?,004B0C82,00000004,InitializeCriticalSectionEx,004D70E4,004D70EC,00000000,?,004B0A39), ref: 004B0B45
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004B0B6D

Strings

api-ms-, xrefs: 004B0B52

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction ID: d85af749d3a2776d246a861fdd0c76bc3b777c55ee5f54f02c25fa514b149693
Opcode Fuzzy Hash: e73f2d59ed71ffe050e3980c02a90d09a2b8a6f7f1eeff266cde429a2dd4b4c8
Instruction Fuzzy Hash: 25E04F30284305B7EF221BA1EC0AF5E3B55AB11B49F144032F90CA91E1EBA6A910859C

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,5A06260C,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,5A06260C,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,5A06260C,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,5A06260C,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: a0dbc40c373a09faf996666854544e2477bb30bde40116881ca4199e3a88db32
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: a0dbc40c373a09faf996666854544e2477bb30bde40116881ca4199e3a88db32
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5A06260C,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,5A06260C,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,5A06260C,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 0048A490 Relevance: 6.2, APIs: 4, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(5A06260C), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 0d066fd5a037e956643cd3d92a9a96980abf0cb91633621b3d58d647d7d5a7ef
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 00A3D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A3D976
___AdjustPointer.LIBCMT ref: 00A3D999
___AdjustPointer.LIBCMT ref: 00A3DA35

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d3cfccc1ce970c2bd9bef05a09b3d1aba552f33fa25d9b4547b30637db8e8951
Instruction ID: f3ed3a4ae8302b330167f6a3677782f37415e5985adbc03826673ff09b5d21a9
Opcode Fuzzy Hash: d3cfccc1ce970c2bd9bef05a09b3d1aba552f33fa25d9b4547b30637db8e8951
Instruction Fuzzy Hash: 6A51EE72A04706EFDB299F24E942B6AB7B4FF05310F14452DF8429BA91E731ED80CB90

Function 004AFBF5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004AFCBC
___AdjustPointer.LIBCMT ref: 004AFCDF
___AdjustPointer.LIBCMT ref: 004AFD7B

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction ID: 33b3d652e50ecda4e79a0ecf225597f03c3ffd3297545ef1ce997a4b46d38663
Opcode Fuzzy Hash: e71c71c21820e5819a4508bd04d803321a7ecaf8570da358721e6539f5a36dac
Instruction Fuzzy Hash: AF51D0B150020A9FEB269FD1D881BAA77A4FF62718F10003EEC434B291D739E849C798

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 00A43537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,?,00A438DD,?,?,?,00000000), ref: 00A4359B
__dosmaperr.LIBCMT ref: 00A435A2
GetLastError.KERNEL32(00A438DD,?,?,?,?,00000000,00000000,?,00A438DD,?,?,?,00000000), ref: 00A435DC
__dosmaperr.LIBCMT ref: 00A435E3

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ErrorLast__dosmaperr
String ID:
API String ID: 1659562826-0
Opcode ID: cf03ca27da2b8891a82855511c7cc6013faabb7ada80e5abc134b81a1db8daca
Instruction ID: ce71d513ae536b8d2293d9e067360995f3eaad3a57ed83538a70be174309bdd9
Opcode Fuzzy Hash: cf03ca27da2b8891a82855511c7cc6013faabb7ada80e5abc134b81a1db8daca
Instruction Fuzzy Hash: C021D776600615AFDF20AF66998192EB7A8FF80364B108519F86997551EB30EF108B92

Function 004BA942 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

GetLastError.KERNEL32 ref: 004BA9A6
__dosmaperr.LIBCMT ref: 004BA9AD
GetLastError.KERNEL32(?,?,?,?), ref: 004BA9E7
__dosmaperr.LIBCMT ref: 004BA9EE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction ID: cdbbd9429668cd5750c88df838a7d8834fbfbf28e86e5927cf8d45539b4e27df
Opcode Fuzzy Hash: 51edd5c4e5c25a430a3840a704f497c195c233776ddb3170bc40658ab91a4e1f
Instruction Fuzzy Hash: 7A21C871600605AF8F21AF66CC809ABBBADFF44368711492FF91597210D739EC60D7BA

Function 00A38042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98986187d09d293acd77fa410492d44921eccbc45f4098698f3821294ec6bfbf
Instruction ID: 9f0f0121498f3c35e47f46e0ac93128ee22bb4cb69b4f969e07e3581bb054050
Opcode Fuzzy Hash: 98986187d09d293acd77fa410492d44921eccbc45f4098698f3821294ec6bfbf
Instruction Fuzzy Hash: 5721FDB1200315AFDF24EF60CD8092BB7A8BF513A4F108629F86997651EF38EC0087A1

Function 004989A8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction ID: 5e5224636d54f024fd63f309ffc809bb58d9736df3a284f1f4315f29edb86acb
Opcode Fuzzy Hash: 29faf50d70bb4521c0c7912d0192e47e6614307814943c5259d0fead7ff358f5
Instruction Fuzzy Hash: F321A171600205AFCF21EF6ADC4496B7FA9AF42368720453FF91597251EF38ED008799

Function 00A4484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,00A3B1C6,00000000,00A3B284,00A3B153,00A358B3,00A54458,00000014), ref: 00A44857
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A4488F
FreeEnvironmentStringsW.KERNEL32(00000000,00000000), ref: 00A448AF

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: c6e41c80b08dbd3a0a76a6367d8e39fd7fa64cb564b76ce670e3317302f4d759
Instruction ID: 31568b7909ee7c73ebe68b5942f0620683d0ded97824de4f91e8c8f55afc31c2
Opcode Fuzzy Hash: c6e41c80b08dbd3a0a76a6367d8e39fd7fa64cb564b76ce670e3317302f4d759
Instruction Fuzzy Hash: 0C1126FA502665BF6B11A7B69D8EDBF29ACDECD3D57200424F401D1141FB64CE029270

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: eda48c8db903e939db4646882944d141a3a2cfedfc9bf96b1ab6e55aecfc3d90
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: eda48c8db903e939db4646882944d141a3a2cfedfc9bf96b1ab6e55aecfc3d90
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 00A3457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A34582
std::_Lockit::_Lockit.LIBCPMT ref: 00A3458C

Part of subcall function 00A324C2: std::_Lockit::_Lockit.LIBCPMT ref: 00A324DE
Part of subcall function 00A324C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00A324F7

codecvt.LIBCPMT ref: 00A345C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00A345FD

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: d1f7fdf5699efd5719d9ca27d19b29eaa7c5482221312f42caa3117be3aa4eef
Instruction ID: bc7708e3172b81dc4b52407113c6546b0c92dcfa8d272f1bd03111d8ed1822c4
Opcode Fuzzy Hash: d1f7fdf5699efd5719d9ca27d19b29eaa7c5482221312f42caa3117be3aa4eef
Instruction Fuzzy Hash: E101F176D00215CBCF04EFA4DA267ADB7B1FF98710F240509F412AB291CF74AE028B91

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,5A06260C,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,5A06260C,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,5A06260C,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,5A06260C,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 00A4A4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000), ref: 00A4A4F7
GetLastError.KERNEL32(?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000,?,?,?,00A45365,00000000), ref: 00A4A503
___initconout.LIBCMT ref: 00A4A513

Part of subcall function 00A4A535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A4A4D1,00A49AFC,?,?,00A45A1F,?,00000000,00000000,?), ref: 00A4A548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00A49B0F,00000000,00000001,00000000,?,?,00A45A1F,?,00000000,00000000,?), ref: 00A4A528

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 358ada223e29ca03530a5fe006f41a01bb6d6fca0ad03ee53f4279b800108208
Instruction ID: fdd6ab4565c7d222531d5a6bf31cc5826248c27f3bd3c093128361bdcca15ebc
Opcode Fuzzy Hash: 358ada223e29ca03530a5fe006f41a01bb6d6fca0ad03ee53f4279b800108208
Instruction Fuzzy Hash: 50F01C3A450215BFCF229FD5ED08A9E3F26FBE83A2F004110FA0986120D63289219B92

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 00A359A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00A359B9
GetCurrentThreadId.KERNEL32 ref: 00A359C8
GetCurrentProcessId.KERNEL32 ref: 00A359D1
QueryPerformanceCounter.KERNEL32(?), ref: 00A359DE

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aa099a6cb5d468291ee548edd8d402f2da9df7f2c6a8bdd8c2039e5d1ddc9a4f
Instruction ID: 53d43602da9e60bc3695949c969fee92042a7199cbb4c7deb5d775830b2e0f5d
Opcode Fuzzy Hash: aa099a6cb5d468291ee548edd8d402f2da9df7f2c6a8bdd8c2039e5d1ddc9a4f
Instruction Fuzzy Hash: 3AF0AF71D1120CEBCF00DBF4C94998EFBF4FF5C241B918996A412E7110E670AB458F50

Function 00A3DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00A3DEAD,?,?,00000000,00000000,00000000,?), ref: 00A3DFD1

Strings

RCC, xrefs: 00A3DFEB
MOC, xrefs: 00A3DFE3

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6abd64fe5c3382cb1ccf269f95531dd7dd9b7bb1a8b47f52ef8bab2319a4b344
Instruction ID: 52cc11e40a7dff0e743a3d44c255f9e545039e9215363b1cad3403fb7c6d7879
Opcode Fuzzy Hash: 6abd64fe5c3382cb1ccf269f95531dd7dd9b7bb1a8b47f52ef8bab2319a4b344
Instruction Fuzzy Hash: 31414A71900209EFCF2ADF98DD81AEEBBB5FF49304F188059FA05AB2A1D3759950DB50

Function 00453E10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00453EF4

Strings

`aC, xrefs: 00453F48
p]C, xrefs: 00453F59

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: `aC$p]C
API String ID: 118556049-1363152631
Opcode ID: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction ID: 7ffd0bf130dfa3baccabcf7c02000b8885a72f27ff8372dee48aba471c76e642
Opcode Fuzzy Hash: 15b0531adf7878dcd052dc043384283fbe7e7e749bd6b518c848f3481f58b70e
Instruction Fuzzy Hash: 2B4114B1D002089BCB24DF58C841BAFBBF4EF45354F10426FEC2597382E7799A148B95

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

RCC, xrefs: 004B0230
MOC, xrefs: 004B0228

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Function 00A3D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A3DA8F

Strings

csm, xrefs: 00A3DAB1
csm, xrefs: 00A3DB22

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 99c1688028975ed4f87052a9b2389684a9501f03e76cffa95a77a838868fb823
Instruction ID: 02680477053e899a494fa56df74c4c6eb3fa5f210dbc28999359f7cc2e377ad1
Opcode Fuzzy Hash: 99c1688028975ed4f87052a9b2389684a9501f03e76cffa95a77a838868fb823
Instruction Fuzzy Hash: 6931F636904358EFCF229F90ED409AABB65FF08365F19415AFC545A221C332DDA1DB91

Function 00435DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00435DCB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00435E2E

Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9375
Part of subcall function 004B9356: _Yarn.LIBCPMT ref: 004B9399

Strings

bad locale name, xrefs: 00435E51

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction ID: 3ec4c6a4a97d0462a05707b65000259191fcf5f6abdba4908dc577763c239046
Opcode Fuzzy Hash: 4f591d35f3d0401d16c29d601d846a696ee7aa1707a5175f538b14ce155db12b
Instruction Fuzzy Hash: 3B210570805784DFD320CF69C90478BBFF4AF15714F14868ED48597781D3B9AA04CBA5

Function 0047DD40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DDD1

Strings

.G, xrefs: 0047DD75
0hC, xrefs: 0047DDCB

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction ID: def2e33cd38b5e824c816681f9ae39c6530dfa40910c99229239c839cc9e5e1b
Opcode Fuzzy Hash: fa7f0577eed2ee249957cc315ff075d2cc7a9cf360a169e300ae923cf5853acc
Instruction Fuzzy Hash: 9B21AE74940245DFD720CF1AC844B99FBF8FF05324F148A6EE85597391D775A904CB84

Function 0044BEB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0044BEF3
___std_exception_copy.LIBVCRUNTIME ref: 0044BF26

Strings

MC, xrefs: 0044BEE4, 0044BF17

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction ID: 159077f32092c3bc03b4ae882dbf743a881f4ebbd8d79b989d6de070d85d5faa
Opcode Fuzzy Hash: ab36d56284830d128f6cf4340ca16e134d89125db0bb4639ace7817866229729
Instruction Fuzzy Hash: 4E112EB5900649EFCB11CF59C980B86FBE8FF19320F10C66BE815A7640E7B4A944CBA4

Function 004827A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0048285D

Strings

0hC, xrefs: 00482852
0, xrefs: 004827FE

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC
API String ID: 323602529-784950247
Opcode ID: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction ID: dd26a1c23eadb7639fef0861fdc2b6c05f84c76fd28c7669f454e47aafc92c53
Opcode Fuzzy Hash: 622b40fb6d894d5aa1115991de8c2c5b589d84d9705eb3b065fc2cec7fc6fad0
Instruction Fuzzy Hash: FC21F074905298CFCB10CF98C6887DCBBF0AB09308F2480EAD949A7381D775AE58CF55

Function 00A451E1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A44EF9: EnterCriticalSection.KERNEL32(?,?,00A45538,?,00A54AC8,00000014,00A3BC67,00000000,00000000,?,00000000,?,?,00000000), ref: 00A44F14

FlushFileBuffers.KERNEL32(00000000,00A54AA8,0000000C,00A451C9,?,00000000,?,00000000,?,00000000,?,00000000,00A3BE37,?,?,?), ref: 00A4522A
GetLastError.KERNEL32 ref: 00A45234

Strings

O;, xrefs: 00A4523C

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: O;
API String ID: 4109680722-584789618
Opcode ID: f5ff68bf2c9563ab040d1874a9bf21e729055d3a0e69da7e5ee9cb0c51b5c3dd
Instruction ID: aec5a5e21317a8cd296f6e9b765be4c5bdd3e99dfedccbc5df48a1c317373a99
Opcode Fuzzy Hash: f5ff68bf2c9563ab040d1874a9bf21e729055d3a0e69da7e5ee9cb0c51b5c3dd
Instruction Fuzzy Hash: 65019276A007109FCB14EFA8E90579D77A4AF89761F14421BF411AB3A2DBB49902CB90

Function 0047D9C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047DA4F

Strings

.G, xrefs: 0047D9F2
0hC, xrefs: 0047DA49

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: .G$0hC
API String ID: 323602529-633007509
Opcode ID: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction ID: 8e7f9f1aa37db0bf33048e17fc0a06a73726813013154025c8e8923a4ade326e
Opcode Fuzzy Hash: d1051db2cb1cfc94d531bfa9645f70c65f72b0c573f779327227424f90c0fd69
Instruction Fuzzy Hash: 121149B4940744CFDB21CF49C984A99BBF8FB09324F108A5EE89697391D775AA44CF80

Function 00438A00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438A46
___std_exception_destroy.LIBVCRUNTIME ref: 00438A5C

Strings

MC, xrefs: 00438A3C, 00438A56

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction ID: 2156576f1eef92af9ffbb3102a1cf8c86cd110feba5e05fe60ab6789c6c907d6
Opcode Fuzzy Hash: 36b679e11db0edd653e0a2647b8e85e069932705a2a35767823b219f623ddd02
Instruction Fuzzy Hash: 5A01B5B1C44318EBC710DF58DD01B8ABBE8EB1A714F10466FE811E3780E779A60487A5

Function 00438CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D06
___std_exception_destroy.LIBVCRUNTIME ref: 00438D1C

Strings

MC, xrefs: 00438CFC, 00438D16

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction ID: 34d925613d03c46ca24c24dcd021453886a1a957fa2bd66f6c30760aa6902abf
Opcode Fuzzy Hash: d7eaf932c4118910232a5250f95a2e385d092f5df7cd9ec96b40b31c7f1f2a93
Instruction Fuzzy Hash: 050192B1C443189BC711DF58DD05B89BBE8EB1A714F14466FE811A3780E7B9A60487A5

Function 00438DD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438E16
___std_exception_destroy.LIBVCRUNTIME ref: 00438E2C

Strings

MC, xrefs: 00438E0C, 00438E26

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction ID: 81858840e3503bfd15470ad0d796ddf3043ff6da9bec83e018f38d9446b02dde
Opcode Fuzzy Hash: dd0c4f4c0c82000e457c7f44c182c4aade15206cd65931e5a6e762cfa9f818e5
Instruction Fuzzy Hash: 4A01D2B1C442089FC710DF58DD01B8ABBE8EB1A714F10426FE811E3780E7B9A60487A5

Function 00438A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438AD6
___std_exception_destroy.LIBVCRUNTIME ref: 00438AEC

Strings

MC, xrefs: 00438ACC, 00438AE6

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction ID: 14708e90e5e2dd6187806a9d8007313cf644032e1f72ff90a2cf062a52645627
Opcode Fuzzy Hash: 54ef2c628f25b7a2a23f3ae652ac74171c9fd81bd4396ab0a0f6fcd8ada00686
Instruction Fuzzy Hash: AD0131B1C54658DFC710DF98D901B8ABBF8EB09724F10466BE815E3780E779A6048BA5

Function 00438D50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00438D96
___std_exception_destroy.LIBVCRUNTIME ref: 00438DAC

Strings

MC, xrefs: 00438D8C, 00438DA6

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: MC
API String ID: 4194217158-1829682832
Opcode ID: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction ID: 57808b7f7ef1f41f2f9046275374ae6f4c4975ec05ee0e2f2319a2ec8c3047b8
Opcode Fuzzy Hash: 2a7c72095c6804fc0da1c178a4919001dd8fbeb9815b62e3a8e22e5ece97145b
Instruction Fuzzy Hash: BB0136B1C44658DFC710DF98D901B89BBF8EB09714F10466FE815E3780E77566048B65

Function 00A329D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00A5648C,ios_base::badbit set,?,?,00A31C84,00A56478,00A31B17), ref: 00A329DF
ReleaseSRWLockExclusive.KERNEL32(00A5648C,?,?,00A31C84,00A56478,00A31B17), ref: 00A32A19

Strings

ios_base::badbit set, xrefs: 00A329D8

Memory Dump Source

Source File: 00000002.00000002.1979568826.0000000000A31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000002.00000002.1979550299.0000000000A30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979590062.0000000000A4C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979609661.0000000000A55000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979627356.0000000000A58000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979644659.0000000000A5A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1979661972.0000000000A5D000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a30000_drop1.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: 51961f5fdbd1ec50831a334b2c4e84fd925cc9ee222bc2f76d71c7f972d97007
Instruction ID: 611b61a4ae31cf8ca58e947b8b55bc7471e28e6518669a42753853562edb73ce
Opcode Fuzzy Hash: 51961f5fdbd1ec50831a334b2c4e84fd925cc9ee222bc2f76d71c7f972d97007
Instruction Fuzzy Hash: 76F08C31900200DFCB20EF98E904B25BBB8FB857B6F14036EF9AA432A0C7312842CB51

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,5A06260C,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,5A06260C,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000002.00000002.1979476158.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_drop1.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report drop1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
drop1.exe

Function 00A5519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00A31614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Function 00A3155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Function 00A3123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85
COMMON

Function 00A45283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00A45A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00A3FF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00A3136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Function 00A33C0B Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 00A33C29 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00A33C1B Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 00A3E531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre